# Flog Txt Version 1
# Analyzer Version: 3.0.2
# Analyzer Build Date: May 15 2019 18:28:42
# Log Creation Date: 03.06.2019 14:18:34.271

Process:
	id = "1"
	image_name = "consoleapp1.exe"
	filename = "c:\\users\\fd1hvy\\desktop\\consoleapp1.exe"
	page_root = "0x713c9000"
	os_pid = "0xb98"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe\" "
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0xdb4

	[0033.192] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0033.197] RoInitialize () returned 0x1
	[0033.197] RoUninitialize () returned 0x0
	[0036.532] CryptAcquireContextW (in: phProv=0x4feb50, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x4feb50*=0x7f93c0) returned 1
	[0036.909] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x1 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.943] CoTaskMemAlloc (cb=0x20) returned 0x7fbcd0
	[0036.943] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbcd0, pdwDataLen=0x4feb14, dwFlags=0x1 | out: pbData=0x7fbcd0, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemFree (pv=0x7fbcd0) 
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemAlloc (cb=0x20) returned 0x7fbcd0
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbcd0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbcd0, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemFree (pv=0x7fbcd0) 
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemAlloc (cb=0x20) returned 0x7fbc80
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbc80, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbc80, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemFree (pv=0x7fbc80) 
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemAlloc (cb=0x20) returned 0x7fc090
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fc090, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fc090, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemFree (pv=0x7fc090) 
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemAlloc (cb=0x20) returned 0x7fc090
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fc090, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fc090, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemFree (pv=0x7fc090) 
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemAlloc (cb=0x20) returned 0x7fc0e0
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fc0e0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fc0e0, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemFree (pv=0x7fc0e0) 
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemAlloc (cb=0x20) returned 0x7fbd48
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbd48, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbd48, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemFree (pv=0x7fbd48) 
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.945] CoTaskMemAlloc (cb=0x20) returned 0x7fc090
	[0036.945] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fc090, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fc090, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemFree (pv=0x7fc090) 
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemAlloc (cb=0x20) returned 0x7fbd48
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbd48, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbd48, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemFree (pv=0x7fbd48) 
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemAlloc (cb=0x20) returned 0x7fbeb0
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbeb0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbeb0, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemFree (pv=0x7fbeb0) 
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemAlloc (cb=0x20) returned 0x7fbc30
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbc30, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbc30, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemFree (pv=0x7fbc30) 
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemAlloc (cb=0x20) returned 0x7fbeb0
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbeb0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbeb0, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemFree (pv=0x7fbeb0) 
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemAlloc (cb=0x20) returned 0x7fbeb0
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbeb0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbeb0, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemFree (pv=0x7fbeb0) 
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemAlloc (cb=0x20) returned 0x7fbd48
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbd48, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbd48, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemFree (pv=0x7fbd48) 
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemAlloc (cb=0x20) returned 0x7fbeb0
	[0036.946] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbeb0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbeb0, pdwDataLen=0x4feb14) returned 1
	[0036.946] CoTaskMemFree (pv=0x7fbeb0) 
	[0036.947] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.947] CoTaskMemAlloc (cb=0x20) returned 0x7fc090
	[0036.947] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fc090, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fc090, pdwDataLen=0x4feb14) returned 1
	[0036.947] CoTaskMemFree (pv=0x7fc090) 
	[0036.947] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.947] CoTaskMemAlloc (cb=0x20) returned 0x7fbd48
	[0036.947] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbd48, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbd48, pdwDataLen=0x4feb14) returned 1
	[0036.947] CoTaskMemFree (pv=0x7fbd48) 
	[0036.947] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.947] CoTaskMemAlloc (cb=0x20) returned 0x7fc108
	[0036.947] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fc108, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fc108, pdwDataLen=0x4feb14) returned 1
	[0036.947] CoTaskMemFree (pv=0x7fc108) 
	[0036.947] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.947] CoTaskMemAlloc (cb=0x20) returned 0x7fbeb0
	[0036.947] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbeb0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbeb0, pdwDataLen=0x4feb14) returned 1
	[0036.947] CoTaskMemFree (pv=0x7fbeb0) 
	[0036.947] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 1
	[0036.947] CoTaskMemAlloc (cb=0x20) returned 0x7fbeb0
	[0036.947] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x7fbeb0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x7fbeb0, pdwDataLen=0x4feb14) returned 1
	[0036.947] CoTaskMemFree (pv=0x7fbeb0) 
	[0036.947] CryptGetProvParam (in: hProv=0x7f93c0, dwParam=0x1, pbData=0x0, pdwDataLen=0x4feb14, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x4feb14) returned 0
	[0036.950] GetLogicalDrives () returned 0x4
	[0036.964] SleepEx (dwMilliseconds=0xa8, bAlertable=1) returned 0x0
	[0037.138] SleepEx (dwMilliseconds=0x1ca, bAlertable=1) returned 0x0
	[0037.638] SleepEx (dwMilliseconds=0xae, bAlertable=1) returned 0x0
	[0037.842] SleepEx (dwMilliseconds=0x18, bAlertable=1) returned 0x0
	[0037.870] SleepEx (dwMilliseconds=0x26, bAlertable=1) returned 0x0
	[0037.920] SleepEx (dwMilliseconds=0xef, bAlertable=1) returned 0x0
	[0038.255] SleepEx (dwMilliseconds=0x16, bAlertable=1) returned 0x0
	[0038.295] SleepEx (dwMilliseconds=0x14f, bAlertable=1) returned 0x0
	[0038.646] SleepEx (dwMilliseconds=0x19c, bAlertable=1) returned 0x0
	[0039.067] SleepEx (dwMilliseconds=0x5e, bAlertable=1) returned 0x0
	[0039.179] SleepEx (dwMilliseconds=0x5a, bAlertable=1) returned 0x0
	[0039.285] SleepEx (dwMilliseconds=0x11b, bAlertable=1) returned 0x0
	[0039.586] SleepEx (dwMilliseconds=0x43, bAlertable=1) returned 0x0
	[0039.667] SleepEx (dwMilliseconds=0xe4, bAlertable=1) returned 0x0
	[0039.908] SleepEx (dwMilliseconds=0x15, bAlertable=1) returned 0x0
	[0039.973] SleepEx (dwMilliseconds=0x181, bAlertable=1) returned 0x0
	[0040.406] SleepEx (dwMilliseconds=0x26, bAlertable=1) returned 0x0
	[0040.466] SleepEx (dwMilliseconds=0x56, bAlertable=1) returned 0x0
	[0040.598] SleepEx (dwMilliseconds=0x6f, bAlertable=1) returned 0x0
	[0040.744] SleepEx (dwMilliseconds=0x1b9, bAlertable=1) returned 0x0
	[0041.234] SleepEx (dwMilliseconds=0x41, bAlertable=1) returned 0x0
	[0041.316] SleepEx (dwMilliseconds=0xad, bAlertable=1) returned 0x0
	[0041.508] SleepEx (dwMilliseconds=0x6b, bAlertable=1) returned 0x0
	[0041.629] SleepEx (dwMilliseconds=0x1b0, bAlertable=1) returned 0x0
	[0042.078] SleepEx (dwMilliseconds=0xe0, bAlertable=1) returned 0x0
	[0042.308] SleepEx (dwMilliseconds=0x45, bAlertable=1) returned 0x0
	[0042.390] SleepEx (dwMilliseconds=0x1c9, bAlertable=1) returned 0x0
	[0042.862] SleepEx (dwMilliseconds=0x19f, bAlertable=1) returned 0x0
	[0043.285] SleepEx (dwMilliseconds=0x98, bAlertable=1) returned 0x0
	[0043.451] SleepEx (dwMilliseconds=0xca, bAlertable=1) returned 0x0
	[0043.678] SleepEx (dwMilliseconds=0x1aa, bAlertable=1) returned 0x0
	[0044.152] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0
	[0044.198] SleepEx (dwMilliseconds=0xc6, bAlertable=1) returned 0x0
	[0044.408] SleepEx (dwMilliseconds=0x1c8, bAlertable=1) returned 0x0
	[0044.891] SleepEx (dwMilliseconds=0xe, bAlertable=1) returned 0x0
	[0044.920] SleepEx (dwMilliseconds=0x1da, bAlertable=1) returned 0x0
	[0045.416] SleepEx (dwMilliseconds=0x12a, bAlertable=1) returned 0x0
	[0045.719] SleepEx (dwMilliseconds=0x1c4, bAlertable=1) returned 0x0
	[0046.214] SleepEx (dwMilliseconds=0x100, bAlertable=1) returned 0x0
	[0046.587] SleepEx (dwMilliseconds=0x37, bAlertable=1) returned 0x0
	[0046.674] SleepEx (dwMilliseconds=0x148, bAlertable=1) returned 0x0
	[0047.030] SleepEx (dwMilliseconds=0xe6, bAlertable=1) returned 0x0
	[0047.279] SleepEx (dwMilliseconds=0xc1, bAlertable=1) returned 0x0
	[0047.539] SleepEx (dwMilliseconds=0xcf, bAlertable=1) returned 0x0
	[0047.769] SleepEx (dwMilliseconds=0x106, bAlertable=1) returned 0x0
	[0048.058] SleepEx (dwMilliseconds=0xd1, bAlertable=1) returned 0x0
	[0048.950] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe.config", nBufferLength=0x105, lpBuffer=0x4fea88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe.config", lpFilePart=0x0) returned 0x2e
	[0048.953] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x4fe7b0 | out: phkResult=0x4fe7b0*=0x0) returned 0x2
	[0048.954] RegCloseKey (hKey=0x80000002) returned 0x0
	[0049.797] GetCurrentProcess () returned 0xffffffff
	[0049.797] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fedf0 | out: TokenHandle=0x4fedf0*=0xe4) returned 1
	[0049.895] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x4fe87c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e
	[0049.897] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x4fede8 | out: lpFileInformation=0x4fede8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1
	[0049.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x4fe848, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
	[0049.905] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x4fedf0 | out: lpFileInformation=0x4fedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1
	[0049.905] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x4fe7e4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
	[0049.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4fed28) returned 1
	[0049.906] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0
	[0049.907] GetFileType (hFile=0x2e0) returned 0x1
	[0049.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4fed24) returned 1
	[0049.907] GetFileType (hFile=0x2e0) returned 0x1
	[0049.941] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x4fed74 | out: phkResult=0x4fed74*=0x0) returned 0x2
	[0049.941] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x4fed74 | out: phkResult=0x4fed74*=0x0) returned 0x2
	[0049.942] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x4fede4 | out: lpFileSizeHigh=0x4fede4*=0x0) returned 0x8c8f
	[0049.942] ReadFile (in: hFile=0x2e0, lpBuffer=0x2449b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4feda0, lpOverlapped=0x0 | out: lpBuffer=0x2449b24*, lpNumberOfBytesRead=0x4feda0*=0x1000, lpOverlapped=0x0) returned 1
	[0050.090] ReadFile (in: hFile=0x2e0, lpBuffer=0x2449b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4fec4c, lpOverlapped=0x0 | out: lpBuffer=0x2449b24*, lpNumberOfBytesRead=0x4fec4c*=0x1000, lpOverlapped=0x0) returned 1
	[0050.091] ReadFile (in: hFile=0x2e0, lpBuffer=0x2449b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4feb00, lpOverlapped=0x0 | out: lpBuffer=0x2449b24*, lpNumberOfBytesRead=0x4feb00*=0x1000, lpOverlapped=0x0) returned 1
	[0050.092] ReadFile (in: hFile=0x2e0, lpBuffer=0x2449b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4feb00, lpOverlapped=0x0 | out: lpBuffer=0x2449b24*, lpNumberOfBytesRead=0x4feb00*=0x1000, lpOverlapped=0x0) returned 1
	[0050.092] ReadFile (in: hFile=0x2e0, lpBuffer=0x2449b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4feb00, lpOverlapped=0x0 | out: lpBuffer=0x2449b24*, lpNumberOfBytesRead=0x4feb00*=0x1000, lpOverlapped=0x0) returned 1
	[0050.092] ReadFile (in: hFile=0x2e0, lpBuffer=0x2449b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4fea38, lpOverlapped=0x0 | out: lpBuffer=0x2449b24*, lpNumberOfBytesRead=0x4fea38*=0x1000, lpOverlapped=0x0) returned 1
	[0050.095] ReadFile (in: hFile=0x2e0, lpBuffer=0x2449b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4febbc, lpOverlapped=0x0 | out: lpBuffer=0x2449b24*, lpNumberOfBytesRead=0x4febbc*=0x1000, lpOverlapped=0x0) returned 1
	[0050.097] ReadFile (in: hFile=0x2e0, lpBuffer=0x2449b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4feac8, lpOverlapped=0x0 | out: lpBuffer=0x2449b24*, lpNumberOfBytesRead=0x4feac8*=0x1000, lpOverlapped=0x0) returned 1
	[0050.097] ReadFile (in: hFile=0x2e0, lpBuffer=0x2449b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4feac8, lpOverlapped=0x0 | out: lpBuffer=0x2449b24*, lpNumberOfBytesRead=0x4feac8*=0xc8f, lpOverlapped=0x0) returned 1
	[0050.097] ReadFile (in: hFile=0x2e0, lpBuffer=0x2449b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4feb8c, lpOverlapped=0x0 | out: lpBuffer=0x2449b24*, lpNumberOfBytesRead=0x4feb8c*=0x0, lpOverlapped=0x0) returned 1
	[0050.097] CloseHandle (hObject=0x2e0) returned 1
	[0050.098] GetCurrentProcess () returned 0xffffffff
	[0050.098] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fef38 | out: TokenHandle=0x4fef38*=0x2e0) returned 1
	[0050.099] GetCurrentProcess () returned 0xffffffff
	[0050.099] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fef38 | out: TokenHandle=0x4fef38*=0x2e8) returned 1
	[0050.099] GetCurrentProcess () returned 0xffffffff
	[0050.099] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fedf0 | out: TokenHandle=0x4fedf0*=0x2ec) returned 1
	[0050.099] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\consoleapp1.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x4fede8 | out: lpFileInformation=0x4fede8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0050.099] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe.config", nBufferLength=0x105, lpBuffer=0x4fe848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe.config", lpFilePart=0x0) returned 0x2e
	[0050.099] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\consoleapp1.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x4fedf0 | out: lpFileInformation=0x4fedf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0050.100] GetCurrentProcess () returned 0xffffffff
	[0050.100] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fef38 | out: TokenHandle=0x4fef38*=0x2f0) returned 1
	[0050.100] GetCurrentProcess () returned 0xffffffff
	[0050.100] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fef38 | out: TokenHandle=0x4fef38*=0x2f4) returned 1
	[0050.113] GetCurrentProcess () returned 0xffffffff
	[0050.113] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fed98 | out: TokenHandle=0x4fed98*=0x2f8) returned 1
	[0050.178] GetCurrentProcess () returned 0xffffffff
	[0050.178] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4feda8 | out: TokenHandle=0x4feda8*=0x2fc) returned 1
	[0050.197] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x300
	[0050.197] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x304
	[0050.200] GetCurrentProcess () returned 0xffffffff
	[0050.200] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fedf8 | out: TokenHandle=0x4fedf8*=0x308) returned 1
	[0050.202] GetCurrentProcess () returned 0xffffffff
	[0050.202] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fee08 | out: TokenHandle=0x4fee08*=0x30c) returned 1
	[0050.204] QueryPerformanceFrequency (in: lpFrequency=0x625bb8 | out: lpFrequency=0x625bb8*=100000000) returned 1
	[0050.204] QueryPerformanceCounter (in: lpPerformanceCount=0x4ff17c | out: lpPerformanceCount=0x4ff17c*=14187669060) returned 1
	[0050.207] GetCurrentProcess () returned 0xffffffff
	[0050.207] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fedc4 | out: TokenHandle=0x4fedc4*=0x310) returned 1
	[0050.210] GetCurrentProcess () returned 0xffffffff
	[0050.210] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fedd4 | out: TokenHandle=0x4fedd4*=0x314) returned 1
	[0050.265] GetCurrentProcess () returned 0xffffffff
	[0050.265] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fedd8 | out: TokenHandle=0x4fedd8*=0x318) returned 1
	[0050.267] GetCurrentProcess () returned 0xffffffff
	[0050.267] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fede8 | out: TokenHandle=0x4fede8*=0x31c) returned 1
	[0050.270] GetCurrentProcess () returned 0xffffffff
	[0050.270] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4ff060 | out: TokenHandle=0x4ff060*=0x320) returned 1
	[0050.274] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x4fe19c | out: phkResult=0x4fe19c*=0x324) returned 0x0
	[0050.275] RegQueryValueExW (in: hKey=0x324, lpValueName="InstallationType", lpReserved=0x0, lpType=0x4fe1bc, lpData=0x0, lpcbData=0x4fe1b8*=0x0 | out: lpType=0x4fe1bc*=0x1, lpData=0x0, lpcbData=0x4fe1b8*=0xe) returned 0x0
	[0050.275] RegQueryValueExW (in: hKey=0x324, lpValueName="InstallationType", lpReserved=0x0, lpType=0x4fe1bc, lpData=0x246c3e0, lpcbData=0x4fe1b8*=0xe | out: lpType=0x4fe1bc*=0x1, lpData="Client", lpcbData=0x4fe1b8*=0xe) returned 0x0
	[0050.275] RegCloseKey (hKey=0x324) returned 0x0
	[0050.535] CoTaskMemAlloc (cb=0xcc0) returned 0x80aec8
	[0050.536] RasEnumConnectionsW (in: param_1=0x80aec8, param_2=0x4ff070, param_3=0x4ff074 | out: param_1=0x80aec8, param_2=0x4ff070, param_3=0x4ff074) returned 0x0
	[0050.647] CoTaskMemFree (pv=0x80aec8) 
	[0050.729] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4fee5c | out: lpWSAData=0x4fee5c) returned 0
	[0050.734] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x390
	[0050.948] setsockopt (s=0x390, level=65535, optname=128, optval="\x01", optlen=4) returned -1
	[0050.948] closesocket (s=0x390) returned 0
	[0050.949] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x390
	[0050.949] setsockopt (s=0x390, level=65535, optname=128, optval="\x01", optlen=4) returned -1
	[0050.949] closesocket (s=0x390) returned 0
	[0050.950] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x390
	[0050.950] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x394
	[0050.951] ioctlsocket (in: s=0x390, cmd=-2147195266, argp=0x4ff078 | out: argp=0x4ff078) returned 0
	[0050.951] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x398
	[0050.951] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x39c
	[0050.951] ioctlsocket (in: s=0x398, cmd=-2147195266, argp=0x4ff078 | out: argp=0x4ff078) returned 0
	[0050.952] WSAIoctl (in: s=0x390, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x4ff060, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x4ff060, lpOverlapped=0x0) returned -1
	[0050.953] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x4fed90, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
	[0050.961] WSAEventSelect (s=0x390, hEventObject=0x394, lNetworkEvents=512) returned 0
	[0050.962] WSAIoctl (in: s=0x398, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x4ff060, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x4ff060, lpOverlapped=0x0) returned -1
	[0050.962] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x4fed90, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
	[0050.962] WSAEventSelect (s=0x398, hEventObject=0x39c, lNetworkEvents=512) returned 0
	[0050.963] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a4
	[0050.963] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x3a4, param_3=0x3) returned 0x0
	[0050.968] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x4ff08c | out: phkResult=0x4ff08c*=0x3bc) returned 0x0
	[0050.969] RegOpenKeyExW (in: hKey=0x3bc, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x4ff040 | out: phkResult=0x4ff040*=0x3c0) returned 0x0
	[0050.969] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c4
	[0050.969] RegNotifyChangeKeyValue (hKey=0x3c0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x3c4, fAsynchronous=1) returned 0x0
	[0050.970] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x4ff044 | out: phkResult=0x4ff044*=0x3c8) returned 0x0
	[0050.970] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3cc
	[0050.970] RegNotifyChangeKeyValue (hKey=0x3c8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x3cc, fAsynchronous=1) returned 0x0
	[0050.970] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x4ff044 | out: phkResult=0x4ff044*=0x3d0) returned 0x0
	[0050.970] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3d4
	[0050.970] RegNotifyChangeKeyValue (hKey=0x3d0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x3d4, fAsynchronous=1) returned 0x0
	[0050.970] GetCurrentProcess () returned 0xffffffff
	[0050.971] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4ff030 | out: TokenHandle=0x4ff030*=0x3d8) returned 1
	[0050.973] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x4fe938 | out: phkResult=0x4fe938*=0x3dc) returned 0x0
	[0050.973] RegQueryValueExW (in: hKey=0x3dc, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x4fe954, lpData=0x0, lpcbData=0x4fe950*=0x0 | out: lpType=0x4fe954*=0x0, lpData=0x0, lpcbData=0x4fe950*=0x0) returned 0x2
	[0050.973] RegCloseKey (hKey=0x3dc) returned 0x0
	[0051.038] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x8119b0
	[0051.269] WinHttpSetTimeouts (hInternet=0x8119b0, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1
	[0051.269] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x4ff040 | out: pProxyConfig=0x4ff040) returned 1
	[0051.466] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x4fe8b0, nSize=0x80 | out: lpBuffer="\xff89\x72f4\xffff\xffff\xe8e4\x4f\x1022\x729e\x3980\x715f\x76b4\x7198\x4f5a\x72a7\x100\xde1f\x73a0\x7e\x76b4\x7198\x3980\x715f\x80f0\x7183\x3980\x715f\x80f0\x7183\xe908\x4f\x557e\x72a7\xffff\xffff\xe974\x4f\xa6f0\x72f4\xffff\xffff\x4f5a\x72a7\x5210\x72a7\x4a8c\x71a2") returned 0x0
	[0051.466] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x4fe8b0, nSize=0x80 | out: lpBuffer="\xff89\x72f4\xffff\xffff\xe8e4\x4f\x1022\x729e\x3980\x715f\x76b4\x7198\x4f5a\x72a7\x100\xde1f\x73a0\x7e\x76b4\x7198\x3980\x715f\x80f0\x7183\x3980\x715f\x80f0\x7183\xe908\x4f\x557e\x72a7\xffff\xffff\xe974\x4f\xa6f0\x72f4\xffff\xffff\x4f5a\x72a7\x5210\x72a7\x4a8c\x71a2") returned 0x0
	[0051.473] EtwEventRegister (in: ProviderId=0x246f2f8, EnableCallback=0x49505de, CallbackContext=0x0, RegHandle=0x246f2d4 | out: RegHandle=0x246f2d4) returned 0x0
	[0051.476] GetCurrentProcess () returned 0xffffffff
	[0051.476] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4feda0 | out: TokenHandle=0x4feda0*=0x428) returned 1
	[0051.477] GetCurrentProcess () returned 0xffffffff
	[0051.477] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fedb0 | out: TokenHandle=0x4fedb0*=0x434) returned 1
	[0051.479] EtwEventRegister (in: ProviderId=0x24707a4, EnableCallback=0x4950606, CallbackContext=0x0, RegHandle=0x2470780 | out: RegHandle=0x2470780) returned 0x0
	[0051.479] EtwEventSetInformation (RegHandle=0x816458, InformationClass=0x43, EventInformation=0x2, InformationLength=0x2470744) returned 0x0
	[0051.481] SetEvent (hEvent=0x300) returned 1
	[0051.542] WinHttpGetProxyForUrl (in: hSession=0x8119b0, lpcwszUrl="http://checkip.dyndns.org/", pAutoProxyOptions=0x4fef74, pProxyInfo=0x4fefe4 | out: pProxyInfo=0x4fefe4) returned 0
	[0052.190] GetCurrentProcess () returned 0xffffffff
	[0052.190] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fed18 | out: TokenHandle=0x4fed18*=0x47c) returned 1
	[0052.191] GetCurrentProcess () returned 0xffffffff
	[0052.191] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4fed28 | out: TokenHandle=0x4fed28*=0x480) returned 1
	[0052.192] GetTimeZoneInformation (in: lpTimeZoneInformation=0x4fee98 | out: lpTimeZoneInformation=0x4fee98) returned 0x2
	[0052.192] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x4fecf4 | out: pTimeZoneInformation=0x4fecf4) returned 0x2
	[0052.194] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x4fedd8 | out: phkResult=0x4fedd8*=0x484) returned 0x0
	[0052.194] RegQueryValueExW (in: hKey=0x484, lpValueName="TZI", lpReserved=0x0, lpType=0x4fedf4, lpData=0x0, lpcbData=0x4fedf0*=0x0 | out: lpType=0x4fedf4*=0x3, lpData=0x0, lpcbData=0x4fedf0*=0x2c) returned 0x0
	[0052.194] RegQueryValueExW (in: hKey=0x484, lpValueName="TZI", lpReserved=0x0, lpType=0x4fedf4, lpData=0x2472558, lpcbData=0x4fedf0*=0x2c | out: lpType=0x4fedf4*=0x3, lpData=0x2472558*, lpcbData=0x4fedf0*=0x2c) returned 0x0
	[0052.195] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x4fec2c | out: phkResult=0x4fec2c*=0x0) returned 0x2
	[0052.195] RegQueryValueExW (in: hKey=0x484, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x4fedcc, lpData=0x0, lpcbData=0x4fedc8*=0x0 | out: lpType=0x4fedcc*=0x1, lpData=0x0, lpcbData=0x4fedc8*=0x20) returned 0x0
	[0052.195] RegQueryValueExW (in: hKey=0x484, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x4fedcc, lpData=0x247297c, lpcbData=0x4fedc8*=0x20 | out: lpType=0x4fedcc*=0x1, lpData="@tzres.dll,-320", lpcbData=0x4fedc8*=0x20) returned 0x0
	[0052.195] RegQueryValueExW (in: hKey=0x484, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x4fedcc, lpData=0x0, lpcbData=0x4fedc8*=0x0 | out: lpType=0x4fedcc*=0x1, lpData=0x0, lpcbData=0x4fedc8*=0x20) returned 0x0
	[0052.195] RegQueryValueExW (in: hKey=0x484, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x4fedcc, lpData=0x24729d4, lpcbData=0x4fedc8*=0x20 | out: lpType=0x4fedcc*=0x1, lpData="@tzres.dll,-322", lpcbData=0x4fedc8*=0x20) returned 0x0
	[0052.195] RegQueryValueExW (in: hKey=0x484, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x4fedcc, lpData=0x0, lpcbData=0x4fedc8*=0x0 | out: lpType=0x4fedcc*=0x1, lpData=0x0, lpcbData=0x4fedc8*=0x20) returned 0x0
	[0052.195] RegQueryValueExW (in: hKey=0x484, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x4fedcc, lpData=0x2472a2c, lpcbData=0x4fedc8*=0x20 | out: lpType=0x4fedcc*=0x1, lpData="@tzres.dll,-321", lpcbData=0x4fedc8*=0x20) returned 0x0
	[0053.115] CoTaskMemAlloc (cb=0x20c) returned 0x81e720
	[0053.115] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x81e720 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0
	[0053.118] CoTaskMemFree (pv=0x81e720) 
	[0053.118] CoTaskMemAlloc (cb=0x20c) returned 0x81e720
	[0053.118] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x4fede8, pwszFileMUIPath=0x81e720, pcchFileMUIPath=0x4fedec, pululEnumerator=0x4fede0 | out: pwszLanguage=0x0, pcchLanguage=0x4fede8, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x4fedec, pululEnumerator=0x4fede0) returned 1
	[0053.147] CoTaskMemFree (pv=0x0) 
	[0053.147] CoTaskMemFree (pv=0x81e720) 
	[0053.148] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x2400001
	[0053.156] CoTaskMemAlloc (cb=0x3ec) returned 0x821460
	[0053.156] LoadStringW (in: hInstance=0x2400001, uID=0x140, lpBuffer=0x821460, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c
	[0053.156] CoTaskMemFree (pv=0x821460) 
	[0053.156] FreeLibrary (hLibModule=0x2400001) returned 1
	[0053.157] CoTaskMemAlloc (cb=0x20c) returned 0x81e720
	[0053.157] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x81e720 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0
	[0053.157] CoTaskMemFree (pv=0x81e720) 
	[0053.157] CoTaskMemAlloc (cb=0x20c) returned 0x81e720
	[0053.157] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x4fede8, pwszFileMUIPath=0x81e720, pcchFileMUIPath=0x4fedec, pululEnumerator=0x4fede0 | out: pwszLanguage=0x0, pcchLanguage=0x4fede8, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x4fedec, pululEnumerator=0x4fede0) returned 1
	[0053.158] CoTaskMemFree (pv=0x0) 
	[0053.158] CoTaskMemFree (pv=0x81e720) 
	[0053.158] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x2400001
	[0053.159] CoTaskMemAlloc (cb=0x3ec) returned 0x821460
	[0053.159] LoadStringW (in: hInstance=0x2400001, uID=0x142, lpBuffer=0x821460, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17
	[0053.159] CoTaskMemFree (pv=0x821460) 
	[0053.159] FreeLibrary (hLibModule=0x2400001) returned 1
	[0053.160] CoTaskMemAlloc (cb=0x20c) returned 0x81e720
	[0053.160] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x81e720 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0
	[0053.160] CoTaskMemFree (pv=0x81e720) 
	[0053.160] CoTaskMemAlloc (cb=0x20c) returned 0x81e720
	[0053.160] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x4fede8, pwszFileMUIPath=0x81e720, pcchFileMUIPath=0x4fedec, pululEnumerator=0x4fede0 | out: pwszLanguage=0x0, pcchLanguage=0x4fede8, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x4fedec, pululEnumerator=0x4fede0) returned 1
	[0053.161] CoTaskMemFree (pv=0x0) 
	[0053.161] CoTaskMemFree (pv=0x81e720) 
	[0053.161] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x2400001
	[0053.161] CoTaskMemAlloc (cb=0x3ec) returned 0x821460
	[0053.161] LoadStringW (in: hInstance=0x2400001, uID=0x141, lpBuffer=0x821460, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17
	[0053.161] CoTaskMemFree (pv=0x821460) 
	[0053.161] FreeLibrary (hLibModule=0x2400001) returned 1
	[0053.162] RegCloseKey (hKey=0x484) returned 0x0
	[0053.162] SetEvent (hEvent=0x300) returned 1
	[0053.229] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x4feff4 | out: pFixedInfo=0x0, pOutBufLen=0x4feff4) returned 0x6f
	[0054.274] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x81e720
	[0054.274] GetNetworkParams (in: pFixedInfo=0x81e720, pOutBufLen=0x4feff4 | out: pFixedInfo=0x81e720, pOutBufLen=0x4feff4) returned 0x0
	[0054.589] LocalFree (hMem=0x81e720) returned 0x0
	[0054.591] CoTaskMemAlloc (cb=0x20c) returned 0x830018
	[0054.591] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x830018, nSize=0x104 | out: lpBuffer="\xe720\x81\x4c48\x82") returned 0x0
	[0054.591] CoTaskMemFree (pv=0x830018) 
	[0054.592] CoTaskMemAlloc (cb=0x20c) returned 0x830018
	[0054.592] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x830018, nSize=0x104 | out: lpBuffer="\xe720\x81\x4c48\x82") returned 0x0
	[0054.592] CoTaskMemFree (pv=0x830018) 
	[0054.594] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x52c
	[0054.594] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x504
	[0054.595] GetAddrInfoW (in: pNodeName="checkip.dyndns.org", pServiceName=0x0, pHints=0x4feedc*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x4fee84 | out: ppResult=0x4fee84*=0x82d8b8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="checkip.dyndns.com", ai_addr=0x81bae0*(sa_family=2, sin_port=0x0, sin_addr="162.88.193.70"), ai_next=0x82d688*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x81bca8*(sa_family=2, sin_port=0x0, sin_addr="216.146.43.71"), ai_next=0x82d7c8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x81bb10*(sa_family=2, sin_port=0x0, sin_addr="131.186.113.70"), ai_next=0x82d890*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x81bb88*(sa_family=2, sin_port=0x0, sin_addr="216.146.43.70"), ai_next=0x0))))) returned 0
	[0055.105] FreeAddrInfoW (pAddrInfo=0x82d8b8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="checkip.dyndns.com", ai_addr=0x81bae0*(sa_family=2, sin_port=0x0, sin_addr="162.88.193.70"), ai_next=0x82d688*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x81bca8*(sa_family=2, sin_port=0x0, sin_addr="216.146.43.71"), ai_next=0x82d7c8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x81bb10*(sa_family=2, sin_port=0x0, sin_addr="131.186.113.70"), ai_next=0x82d890*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x81bb88*(sa_family=2, sin_port=0x0, sin_addr="216.146.43.70"), ai_next=0x0))))) 
	[0055.106] GetAddrInfoW (in: pNodeName="checkip.dyndns.org", pServiceName=0x0, pHints=0x4feedc*(ai_flags=131072, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x4fee84 | out: ppResult=0x4fee84*=0x82d8e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="checkip.dyndns.org", ai_addr=0x81bb28*(sa_family=2, sin_port=0x0, sin_addr="162.88.193.70"), ai_next=0x82d9a8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x81bae0*(sa_family=2, sin_port=0x0, sin_addr="216.146.43.71"), ai_next=0x82d728*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x81bb88*(sa_family=2, sin_port=0x0, sin_addr="131.186.113.70"), ai_next=0x82d7a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x81bbd0*(sa_family=2, sin_port=0x0, sin_addr="216.146.43.70"), ai_next=0x0))))) returned 0
	[0055.234] FreeAddrInfoW (pAddrInfo=0x82d8e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="checkip.dyndns.org", ai_addr=0x81bb28*(sa_family=2, sin_port=0x0, sin_addr="162.88.193.70"), ai_next=0x82d9a8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x81bae0*(sa_family=2, sin_port=0x0, sin_addr="216.146.43.71"), ai_next=0x82d728*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x81bb88*(sa_family=2, sin_port=0x0, sin_addr="131.186.113.70"), ai_next=0x82d7a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x81bbd0*(sa_family=2, sin_port=0x0, sin_addr="216.146.43.70"), ai_next=0x0))))) 
	[0055.235] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x53c
	[0055.235] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x540
	[0055.235] ioctlsocket (in: s=0x53c, cmd=-2147195266, argp=0x4feeb0 | out: argp=0x4feeb0) returned 0
	[0055.235] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x544
	[0055.235] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x548
	[0055.235] ioctlsocket (in: s=0x544, cmd=-2147195266, argp=0x4feeb0 | out: argp=0x4feeb0) returned 0
	[0055.235] WSAIoctl (in: s=0x53c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x4fee98, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x4fee98, lpOverlapped=0x0) returned -1
	[0055.235] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x4febc8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
	[0055.235] WSAEventSelect (s=0x53c, hEventObject=0x540, lNetworkEvents=512) returned 0
	[0055.235] WSAIoctl (in: s=0x544, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x4fee98, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x4fee98, lpOverlapped=0x0) returned -1
	[0055.235] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x4febc8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
	[0055.235] WSAEventSelect (s=0x544, hEventObject=0x548, lNetworkEvents=512) returned 0
	[0055.236] GetAdaptersAddresses () returned 0x6f
	[0055.238] LocalAlloc (uFlags=0x0, uBytes=0x810) returned 0x824f60
	[0055.238] GetAdaptersAddresses () returned 0x0
	[0055.244] LocalFree (hMem=0x824f60) returned 0x0
	[0055.245] WSAConnect (in: s=0x52c, name=0x247f51c*(sa_family=2, sin_port=0x50, sin_addr="162.88.193.70"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0
	[0055.410] closesocket (s=0x504) returned 0
	[0055.413] send (s=0x52c, buf=0x2480260*, len=68, flags=0) returned 68
	[0055.414] setsockopt (s=0x52c, level=65535, optname=4102, optval="\xa0\x86\x01", optlen=4) returned 0
	[0055.414] recv (in: s=0x52c, buf=0x247aeb0, len=4096, flags=0 | out: buf=0x247aeb0*) returned 263
	[0055.537] setsockopt (s=0x52c, level=65535, optname=4102, optval="\xe0\x93\x04", optlen=4) returned 0
	[0055.537] SetEvent (hEvent=0x300) returned 1
	[0055.538] shutdown (s=0x52c, how=2) returned 0
	[0055.538] closesocket (s=0x52c) returned 0
	[0056.471] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x82f260
	[0056.547] QueryPerformanceCounter (in: lpPerformanceCount=0x4ff0b4 | out: lpPerformanceCount=0x4ff0b4*=14821955660) returned 1
	[0056.547] SetEvent (hEvent=0x300) returned 1
	[0056.548] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x52c
	[0056.549] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x54c
	[0056.549] GetAddrInfoW (in: pNodeName="ip-api.com", pServiceName=0x0, pHints=0x4fee14*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x4fedbc | out: ppResult=0x4fedbc*=0x82db60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ip-api.com", ai_addr=0x81be40*(sa_family=2, sin_port=0x0, sin_addr="54.38.92.92"), ai_next=0x0)) returned 0
	[0056.574] FreeAddrInfoW (pAddrInfo=0x82db60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ip-api.com", ai_addr=0x81be40*(sa_family=2, sin_port=0x0, sin_addr="54.38.92.92"), ai_next=0x0)) 
	[0056.574] WSAConnect (in: s=0x52c, name=0x248b1e0*(sa_family=2, sin_port=0x50, sin_addr="54.38.92.92"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1
	[0077.696] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274c, dwLanguageId=0x0, lpBuffer=0x4febf0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.\r\n") returned 0xb9
	[0077.723] setsockopt (s=0x52c, level=65535, optname=128, optval="\x01", optlen=4) returned 0
	[0077.723] closesocket (s=0x52c) returned 0
	[0077.724] setsockopt (s=0x54c, level=65535, optname=128, optval="\x01", optlen=4) returned 0
	[0077.724] closesocket (s=0x54c) returned 0
	[0077.758] GetFullPathNameW (in: lpFileName="passwordd!.txt", nBufferLength=0x105, lpBuffer=0x4fea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\passwordd!.txt", lpFilePart=0x0) returned 0x26
	[0077.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4fefe0) returned 1
	[0077.758] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\passwordd!.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\passwordd!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x54c
	[0077.760] GetFileType (hFile=0x54c) returned 0x1
	[0077.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4fefdc) returned 1
	[0077.760] GetFileType (hFile=0x54c) returned 0x1
	[0077.761] WriteFile (in: hFile=0x54c, lpBuffer=0x2496c64*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x4ff05c, lpOverlapped=0x0 | out: lpBuffer=0x2496c64*, lpNumberOfBytesWritten=0x4ff05c*=0x81, lpOverlapped=0x0) returned 1
	[0077.762] CloseHandle (hObject=0x54c) returned 1
	[0077.858] GetFullPathNameW (in: lpFileName="C:\\Users\\WOT\\Desktop\\Fox\\готово\\ConsoleApp1\\ConsoleApp1\\bin\\Debug\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x4fec48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\WOT\\Desktop\\Fox\\готово\\ConsoleApp1\\ConsoleApp1\\bin\\Debug\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0077.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4ff148) returned 1
	[0077.858] GetFileAttributesExW (in: lpFileName="C:\\Users\\WOT\\Desktop\\Fox\\готово\\ConsoleApp1\\ConsoleApp1\\bin\\Debug\\Decrypt.txt" (normalized: "c:\\users\\wot\\desktop\\fox\\готово\\consoleapp1\\consoleapp1\\bin\\debug\\decrypt.txt"), fInfoLevelId=0x0, lpFileInformation=0x249af28 | out: lpFileInformation=0x249af28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0077.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4ff144) returned 1
	[0077.867] GetFullPathNameW (in: lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER", nBufferLength=0x105, lpBuffer=0x4fec48, lpFilePart=0x0 | out: lpBuffer="C:\\$WINRE_BACKUP_PARTITION.MARKER", lpFilePart=0x0) returned 0x21
	[0077.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4ff148) returned 1
	[0077.867] GetFileAttributesExW (in: lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), fInfoLevelId=0x0, lpFileInformation=0x249db84 | out: lpFileInformation=0x249db84*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0077.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4ff144) returned 1
	[0077.920] WindowsCreateStringReference () returned 0x0
	[0077.920] RoGetActivationFactory () returned 0x0
	[0078.091] QueryInterface () returned 0x0
	[0078.092] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002
	[0078.092] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002
	[0078.092] QueryInterface () returned 0x0
	[0078.092] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::GetRuntimeClassName () returned 0x8000000e
	[0078.092] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3
	[0078.092] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::AddRef () returned 0x4
	[0078.092] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002
	[0078.092] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0
	[0078.092] Release () returned 0x4
	[0078.092] CoGetContextToken (in: pToken=0x4fddb0 | out: pToken=0x4fddb0) returned 0x0
	[0078.092] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002
	[0078.092] CoGetContextToken (in: pToken=0x4fe0c0 | out: pToken=0x4fe0c0) returned 0x0
	[0078.092] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0
	[0078.092] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x4
	[0078.092] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3
	[0078.092] WindowsDeleteString () returned 0x0
	[0078.093] Release () returned 0x2
	[0078.093] CoGetContextToken (in: pToken=0x4fe838 | out: pToken=0x4fe838) returned 0x0
	[0078.093] CoGetContextToken (in: pToken=0x4fe798 | out: pToken=0x4fe798) returned 0x0
	[0078.093] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0
	[0078.093] AddRef () returned 0x4
	[0078.093] Release () returned 0x3
	[0078.098] IIDFromString (in: lpsz="{410B7711-FF3B-477F-9C9A-D2EFDA302DC3}", lpiid=0x4fded0 | out: lpiid=0x4fded0) returned 0x0
	[0078.099] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::add_TracingStatusChanged () returned 0x0
	[0078.216] GenericStreamBase<IStream,AllocationWrapper>::Write () returned 0x0
	[0078.216] GenericStreamBase<IStream,AllocationWrapper>::Write () returned 0x0
	[0078.217] CoCreateGuid (in: pguid=0x730347a8 | out: pguid=0x730347a8*(Data1=0xb6c4ac66, Data2=0x599f, Data3=0x40c9, Data4=([0]=0xb5, [1]=0xc8, [2]=0x16, [3]=0x3e, [4]=0x9f, [5]=0x17, [6]=0x24, [7]=0x66))) returned 0x0
	[0078.217] GenericStreamBase<IStream,AllocationWrapper>::Write () returned 0x0
	[0078.219] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0
	[0078.219] CExtensionCatalog::AddRef () returned 0x3
	[0078.219] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002
	[0078.219] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0
	[0078.219] Release () returned 0x3
	[0078.219] CoGetContextToken (in: pToken=0x4fdc88 | out: pToken=0x4fdc88) returned 0x0
	[0078.219] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002
	[0078.220] WindowsCreateString () returned 0x0
	[0078.220] CExtensionCatalog::AddRef () returned 0x4
	[0078.221] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x3
	[0078.221] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::get_Enabled () returned 0x0
	[0078.223] EtwEventRegister (in: ProviderId=0x249e908, EnableCallback=0x4950c26, CallbackContext=0x0, RegHandle=0x249e8e4 | out: RegHandle=0x249e8e4) returned 0x0
	[0078.223] EtwEventSetInformation (RegHandle=0x817898, InformationClass=0x66, EventInformation=0x2, InformationLength=0x249e8b4) returned 0x0

Thread:
	id = 2
	os_tid = 0xa6c


Thread:
	id = 3
	os_tid = 0xc48


Thread:
	id = 4
	os_tid = 0xa90

	[0033.198] CoGetContextToken (in: pToken=0x23ffbc4 | out: pToken=0x23ffbc4) returned 0x0
	[0033.198] CObjectContext::QueryInterface () returned 0x0
	[0033.198] CObjectContext::GetCurrentThreadType () returned 0x0
	[0033.199] Release () returned 0x0
	[0033.199] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0033.199] RoInitialize () returned 0x1
	[0033.199] RoUninitialize () returned 0x0
	[0079.433] CoGetContextToken (in: pToken=0x23ffbb0 | out: pToken=0x23ffbb0) returned 0x0
	[0079.433] CoGetContextToken (in: pToken=0x23ffb30 | out: pToken=0x23ffb30) returned 0x0
	[0079.433] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x1
	[0079.433] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x0
	[0079.434] CloseHandle (hObject=0x320) returned 1
	[0079.434] CloseHandle (hObject=0xe4) returned 1
	[0079.434] CloseHandle (hObject=0x31c) returned 1
	[0079.435] CloseHandle (hObject=0x318) returned 1
	[0079.435] CloseHandle (hObject=0x480) returned 1
	[0079.435] CloseHandle (hObject=0x314) returned 1
	[0079.436] CloseHandle (hObject=0x2e0) returned 1
	[0079.436] CloseHandle (hObject=0x310) returned 1
	[0079.436] CloseHandle (hObject=0x47c) returned 1
	[0079.436] CloseHandle (hObject=0x30c) returned 1
	[0079.436] CloseHandle (hObject=0x308) returned 1
	[0079.436] CloseHandle (hObject=0x434) returned 1
	[0079.436] CloseHandle (hObject=0x2fc) returned 1
	[0079.436] CloseHandle (hObject=0x2f8) returned 1
	[0079.436] CloseHandle (hObject=0x428) returned 1
	[0079.436] CloseHandle (hObject=0x2f4) returned 1
	[0079.437] CloseHandle (hObject=0x2f0) returned 1
	[0079.437] CloseHandle (hObject=0x2ec) returned 1
	[0079.437] CloseHandle (hObject=0x2e8) returned 1

Thread:
	id = 5
	os_tid = 0xd34


Thread:
	id = 6
	os_tid = 0xc58


Thread:
	id = 7
	os_tid = 0xd60

	[0051.538] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0051.538] RoInitialize () returned 0x1
	[0051.538] RoUninitialize () returned 0x0
	[0051.539] ResetEvent (hEvent=0x300) returned 1
	[0185.620] CoUninitialize () 

Thread:
	id = 8
	os_tid = 0xd64


Thread:
	id = 9
	os_tid = 0xd70


Thread:
	id = 10
	os_tid = 0xf58


Thread:
	id = 11
	os_tid = 0xeb4

	[0077.765] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0077.765] RoInitialize () returned 0x1
	[0077.765] RoUninitialize () returned 0x0
	[0077.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0077.787] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0077.788] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x82b140
	[0077.789] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0077.789] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0077.789] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0077.789] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0077.789] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0077.789] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1
	[0077.790] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1
	[0077.790] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0077.790] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0077.790] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0077.790] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0077.790] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0077.791] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1
	[0077.791] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4018e603, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x4018e603, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0077.791] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1
	[0077.791] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1
	[0077.791] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0077.791] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1
	[0077.791] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1
	[0077.791] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0077.791] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0077.791] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1
	[0077.792] FindNextFileW (in: hFindFile=0x82b140, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.792] FindClose (in: hFindFile=0x82b140 | out: hFindFile=0x82b140) returned 1
	[0077.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0077.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0077.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0077.792] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0077.792] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x82b240
	[0077.792] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0077.792] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0077.792] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0077.793] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0077.793] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0077.793] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1
	[0077.793] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1
	[0077.793] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0077.793] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0077.793] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0077.793] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0077.793] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0077.794] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1
	[0077.794] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4018e603, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x4018e603, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0077.794] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1
	[0077.794] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1
	[0077.794] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0077.794] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1
	[0077.794] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1
	[0077.795] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0077.795] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0077.795] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1
	[0077.795] FindNextFileW (in: hFindFile=0x82b240, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0
	[0077.795] FindClose (in: hFindFile=0x82b240 | out: hFindFile=0x82b240) returned 1
	[0077.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0077.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0077.801] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe.config", nBufferLength=0x105, lpBuffer=0x511eb1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe.config", lpFilePart=0x0) returned 0x2e
	[0077.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511efd8) returned 1
	[0077.801] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\consoleapp1.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x511f054 | out: lpFileInformation=0x511f054*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0077.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511efd4) returned 1
	[0078.500] GetFullPathNameW (in: lpFileName="C:\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Decrypt.txt", lpFilePart=0x0) returned 0xe
	[0078.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.500] CreateFileW (lpFileName="C:\\Decrypt.txt" (normalized: "c:\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.508] GetFileType (hFile=0x5f4) returned 0x1
	[0078.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.508] GetFileType (hFile=0x5f4) returned 0x1
	[0078.508] WriteFile (in: hFile=0x5f4, lpBuffer=0x24aa278*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24aa278*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.509] CloseHandle (hObject=0x5f4) returned 1
	[0078.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.510] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent", lpFilePart=0x0) returned 0xe
	[0078.510] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.528] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.529] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0078.529] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0078.529] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.529] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.532] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent", lpFilePart=0x0) returned 0xe
	[0078.532] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0078.532] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.533] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0078.533] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0078.533] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0078.533] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0078.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.533] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Decrypt.txt", lpFilePart=0x0) returned 0x1a
	[0078.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.533] CreateFileW (lpFileName="C:\\$GetCurrent\\Decrypt.txt" (normalized: "c:\\$getcurrent\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.540] GetFileType (hFile=0x5f4) returned 0x1
	[0078.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.540] GetFileType (hFile=0x5f4) returned 0x1
	[0078.541] WriteFile (in: hFile=0x5f4, lpBuffer=0x24ae40c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ae40c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.541] CloseHandle (hObject=0x5f4) returned 1
	[0078.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.541] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf
	[0078.542] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0078.542] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.542] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0078.542] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0078.542] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.542] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0078.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.542] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf
	[0078.542] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0078.543] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.543] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0078.543] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0078.543] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0078.543] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0078.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.543] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\Decrypt.txt", lpFilePart=0x0) returned 0x1b
	[0078.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.543] CreateFileW (lpFileName="C:\\$Recycle.Bin\\Decrypt.txt" (normalized: "c:\\$recycle.bin\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.544] GetFileType (hFile=0x5f4) returned 0x1
	[0078.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.544] GetFileType (hFile=0x5f4) returned 0x1
	[0078.545] WriteFile (in: hFile=0x5f4, lpBuffer=0x24b16fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b16fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.545] CloseHandle (hObject=0x5f4) returned 1
	[0078.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.546] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212", lpFilePart=0x0) returned 0x15
	[0078.546] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0078.609] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.610] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1025", cAlternateFileName="")) returned 1
	[0078.611] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1
	[0078.611] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1029", cAlternateFileName="")) returned 1
	[0078.611] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1030", cAlternateFileName="")) returned 1
	[0078.611] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1
	[0078.611] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1032", cAlternateFileName="")) returned 1
	[0078.611] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0078.611] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1035", cAlternateFileName="")) returned 1
	[0078.611] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1
	[0078.612] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1037", cAlternateFileName="")) returned 1
	[0078.612] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1038", cAlternateFileName="")) returned 1
	[0078.612] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1
	[0078.612] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1
	[0078.612] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1
	[0078.612] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1043", cAlternateFileName="")) returned 1
	[0078.612] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1044", cAlternateFileName="")) returned 1
	[0078.612] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1045", cAlternateFileName="")) returned 1
	[0078.613] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1
	[0078.613] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1
	[0078.613] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1053", cAlternateFileName="")) returned 1
	[0078.613] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1055", cAlternateFileName="")) returned 1
	[0078.613] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1
	[0078.614] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1
	[0078.614] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3076", cAlternateFileName="")) returned 1
	[0078.614] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1
	[0078.614] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1
	[0078.614] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1
	[0078.614] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1
	[0078.614] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1
	[0078.615] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0078.615] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="header.bmp", cAlternateFileName="")) returned 1
	[0078.615] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1
	[0078.615] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1
	[0078.615] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1
	[0078.615] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1
	[0078.616] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1
	[0078.616] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1
	[0078.617] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0078.617] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1
	[0078.617] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1
	[0078.617] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1
	[0078.617] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1
	[0078.618] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1
	[0078.618] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1
	[0078.618] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1
	[0078.618] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1
	[0078.618] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0078.619] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strings.xml", cAlternateFileName="")) returned 1
	[0078.619] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0078.619] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1
	[0078.619] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0078.619] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1
	[0078.620] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1
	[0078.620] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1
	[0078.620] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0
	[0078.620] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0078.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.621] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212", lpFilePart=0x0) returned 0x15
	[0078.621] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0078.622] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.622] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1025", cAlternateFileName="")) returned 1
	[0078.623] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1
	[0078.623] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1029", cAlternateFileName="")) returned 1
	[0078.623] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1030", cAlternateFileName="")) returned 1
	[0078.623] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1
	[0078.623] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1032", cAlternateFileName="")) returned 1
	[0078.623] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0078.623] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1035", cAlternateFileName="")) returned 1
	[0078.623] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1
	[0078.624] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1037", cAlternateFileName="")) returned 1
	[0078.624] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1038", cAlternateFileName="")) returned 1
	[0078.624] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1
	[0078.624] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1
	[0078.624] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1
	[0078.624] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1043", cAlternateFileName="")) returned 1
	[0078.624] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1044", cAlternateFileName="")) returned 1
	[0078.624] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1045", cAlternateFileName="")) returned 1
	[0078.625] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1
	[0078.625] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1
	[0078.625] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1053", cAlternateFileName="")) returned 1
	[0078.625] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1055", cAlternateFileName="")) returned 1
	[0078.625] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1
	[0078.625] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1
	[0078.625] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3076", cAlternateFileName="")) returned 1
	[0078.625] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1
	[0078.626] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1
	[0078.626] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1
	[0078.626] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1
	[0078.626] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1
	[0078.626] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0078.626] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="header.bmp", cAlternateFileName="")) returned 1
	[0078.626] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1
	[0078.627] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1
	[0078.627] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1
	[0078.627] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1
	[0078.627] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1
	[0078.627] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1
	[0078.627] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0078.627] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1
	[0078.628] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1
	[0078.628] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1
	[0078.628] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1
	[0078.628] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1
	[0078.628] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1
	[0078.628] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1
	[0078.629] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1
	[0078.629] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0078.629] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strings.xml", cAlternateFileName="")) returned 1
	[0078.629] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0078.629] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1
	[0078.629] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0078.629] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1
	[0078.630] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1
	[0078.630] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1
	[0078.630] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.630] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0078.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.631] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Decrypt.txt", lpFilePart=0x0) returned 0x21
	[0078.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.631] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.632] GetFileType (hFile=0x5f4) returned 0x1
	[0078.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.632] GetFileType (hFile=0x5f4) returned 0x1
	[0078.632] WriteFile (in: hFile=0x5f4, lpBuffer=0x24bb98c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24bb98c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.633] CloseHandle (hObject=0x5f4) returned 1
	[0078.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.633] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7
	[0078.633] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0078.634] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.634] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0078.634] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0078.635] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0078.635] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0078.635] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0078.635] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0078.635] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0078.635] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0078.635] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0078.635] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0078.635] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0078.636] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0078.636] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0078.636] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0078.636] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0078.636] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0078.636] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0078.636] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0078.636] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0078.636] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0078.636] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0078.636] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0078.637] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0078.637] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0078.637] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0078.637] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0078.637] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0078.637] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0078.637] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0078.637] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0078.637] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0078.637] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0078.637] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0078.638] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0078.638] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0078.638] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0078.638] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0078.638] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0078.638] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0078.638] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0078.638] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0078.638] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0078.638] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0078.639] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0078.639] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0078.639] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x0, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0078.639] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0078.639] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0078.639] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0078.639] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.639] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0078.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.639] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7
	[0078.639] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0078.640] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.640] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0078.640] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0078.640] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0078.640] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0078.640] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0078.640] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0078.640] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0078.640] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0078.640] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0078.641] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0078.641] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0078.641] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0078.641] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0078.641] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0078.641] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0078.641] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0078.641] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0078.641] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0078.641] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0078.641] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0078.641] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x0, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0078.642] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0078.643] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0078.643] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0078.643] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0078.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.643] GetFullPathNameW (in: lpFileName="C:\\Boot\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Decrypt.txt", lpFilePart=0x0) returned 0x13
	[0078.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.643] CreateFileW (lpFileName="C:\\Boot\\Decrypt.txt" (normalized: "c:\\boot\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.643] GetFileType (hFile=0x5f4) returned 0x1
	[0078.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.643] GetFileType (hFile=0x5f4) returned 0x1
	[0078.643] WriteFile (in: hFile=0x5f4, lpBuffer=0x24c2c48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c2c48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.644] CloseHandle (hObject=0x5f4) returned 1
	[0078.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.645] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings", lpFilePart=0x0) returned 0x19
	[0078.645] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0078.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0078.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.647] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings", lpFilePart=0x0) returned 0x19
	[0078.647] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0078.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0078.649] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0078.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.649] CreateFileW (lpFileName="C:\\Documents and Settings\\Decrypt.txt" (normalized: "c:\\documents and settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.650] GetFileType (hFile=0x5f4) returned 0x1
	[0078.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.650] GetFileType (hFile=0x5f4) returned 0x1
	[0078.650] WriteFile (in: hFile=0x5f4, lpBuffer=0x24c5de8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c5de8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.651] CloseHandle (hObject=0x5f4) returned 1
	[0078.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.651] GetFullPathNameW (in: lpFileName="C:\\ESD", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ESD", lpFilePart=0x0) returned 0x6
	[0078.651] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.656] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.656] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.656] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.657] GetFullPathNameW (in: lpFileName="C:\\ESD", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ESD", lpFilePart=0x0) returned 0x6
	[0078.657] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0078.657] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.657] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.657] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0078.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.657] GetFullPathNameW (in: lpFileName="C:\\ESD\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ESD\\Decrypt.txt", lpFilePart=0x0) returned 0x12
	[0078.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.657] CreateFileW (lpFileName="C:\\ESD\\Decrypt.txt" (normalized: "c:\\esd\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.658] GetFileType (hFile=0x5f4) returned 0x1
	[0078.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.658] GetFileType (hFile=0x5f4) returned 0x1
	[0078.658] WriteFile (in: hFile=0x5f4, lpBuffer=0x24c898c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c898c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.659] CloseHandle (hObject=0x5f4) returned 1
	[0078.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.659] GetFullPathNameW (in: lpFileName="C:\\Logs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Logs", lpFilePart=0x0) returned 0x7
	[0078.659] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.675] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.680] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1
	[0078.680] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1
	[0078.680] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1
	[0078.680] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1
	[0078.680] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1
	[0078.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1
	[0078.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1
	[0078.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1
	[0078.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1
	[0078.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1
	[0078.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1
	[0078.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1
	[0078.682] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1
	[0078.682] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1
	[0078.682] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1
	[0078.682] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1
	[0078.682] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1
	[0078.682] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1
	[0078.682] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1
	[0078.683] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1
	[0078.683] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1
	[0078.683] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1
	[0078.683] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1
	[0078.683] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1
	[0078.684] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1
	[0078.684] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1
	[0078.684] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1
	[0078.684] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1
	[0078.684] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1
	[0078.684] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1
	[0078.684] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1
	[0078.685] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1
	[0078.685] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1
	[0078.685] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1
	[0078.685] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1
	[0078.685] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1
	[0078.685] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1
	[0078.685] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1
	[0078.686] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1
	[0078.686] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1
	[0078.686] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1
	[0078.686] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1
	[0078.686] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1
	[0078.687] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1
	[0078.687] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1
	[0078.687] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1
	[0078.687] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1
	[0078.687] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1
	[0078.687] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1
	[0078.687] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1
	[0078.688] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1
	[0078.688] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1
	[0078.688] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1
	[0078.688] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1
	[0078.688] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1
	[0078.688] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1
	[0078.688] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1
	[0078.689] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1
	[0078.689] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1
	[0078.689] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1
	[0078.689] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1
	[0078.689] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1
	[0078.690] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1
	[0078.690] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1
	[0078.690] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1
	[0078.690] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1
	[0078.690] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1
	[0078.690] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1
	[0078.690] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1
	[0078.691] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1
	[0078.691] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1
	[0078.691] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1
	[0078.691] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1
	[0078.692] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1
	[0078.692] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1
	[0078.692] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1
	[0078.692] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1
	[0078.692] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1
	[0078.692] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1
	[0078.693] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1
	[0078.693] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1
	[0078.693] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1
	[0078.693] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1
	[0078.694] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1
	[0078.694] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1
	[0078.694] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1
	[0078.694] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1
	[0078.694] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1
	[0078.694] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0
	[0078.694] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.695] GetFullPathNameW (in: lpFileName="C:\\Logs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Logs", lpFilePart=0x0) returned 0x7
	[0078.695] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0078.696] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.697] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1
	[0078.697] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1
	[0078.697] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1
	[0078.697] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1
	[0078.697] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1
	[0078.697] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1
	[0078.697] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1
	[0078.697] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1
	[0078.698] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1
	[0078.698] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1
	[0078.698] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1
	[0078.698] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1
	[0078.698] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1
	[0078.698] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1
	[0078.698] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1
	[0078.698] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1
	[0078.699] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1
	[0078.699] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1
	[0078.699] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1
	[0078.699] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1
	[0078.699] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1
	[0078.699] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1
	[0078.699] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1
	[0078.700] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1
	[0078.700] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1
	[0078.700] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1
	[0078.700] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1
	[0078.700] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1
	[0078.700] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1
	[0078.700] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1
	[0078.700] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1
	[0078.700] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1
	[0078.700] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1
	[0078.701] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1
	[0078.701] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1
	[0078.701] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1
	[0078.701] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1
	[0078.701] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1
	[0078.701] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1
	[0078.701] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1
	[0078.701] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1
	[0078.701] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1
	[0078.701] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1
	[0078.702] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1
	[0078.703] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1
	[0078.703] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1
	[0078.703] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1
	[0078.703] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1
	[0078.703] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1
	[0078.703] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1
	[0078.703] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1
	[0078.703] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1
	[0078.703] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1
	[0078.703] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1
	[0078.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1
	[0078.705] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1
	[0078.705] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1
	[0078.705] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1
	[0078.705] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1
	[0078.705] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1
	[0078.705] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1
	[0078.705] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1
	[0078.705] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.705] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0078.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.706] GetFullPathNameW (in: lpFileName="C:\\Logs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Decrypt.txt", lpFilePart=0x0) returned 0x13
	[0078.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.706] CreateFileW (lpFileName="C:\\Logs\\Decrypt.txt" (normalized: "c:\\logs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.707] GetFileType (hFile=0x5f4) returned 0x1
	[0078.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.708] GetFileType (hFile=0x5f4) returned 0x1
	[0078.708] WriteFile (in: hFile=0x5f4, lpBuffer=0x24df5e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24df5e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.708] CloseHandle (hObject=0x5f4) returned 1
	[0078.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.709] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb
	[0078.709] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.709] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.709] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.709] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.710] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb
	[0078.710] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0078.710] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.710] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.710] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0078.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.710] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Decrypt.txt", lpFilePart=0x0) returned 0x17
	[0078.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.710] CreateFileW (lpFileName="C:\\PerfLogs\\Decrypt.txt" (normalized: "c:\\perflogs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.711] GetFileType (hFile=0x5f4) returned 0x1
	[0078.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.711] GetFileType (hFile=0x5f4) returned 0x1
	[0078.711] WriteFile (in: hFile=0x5f4, lpBuffer=0x24e225c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e225c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.712] CloseHandle (hObject=0x5f4) returned 1
	[0078.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe
	[0078.712] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.712] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.712] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0078.712] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1
	[0078.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.713] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe
	[0078.714] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0078.714] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.714] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0078.714] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0078.714] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1
	[0078.714] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0078.714] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0078.714] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0078.714] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1
	[0078.714] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1
	[0078.714] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1
	[0078.714] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1
	[0078.715] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1
	[0078.715] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0078.715] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0078.715] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1
	[0078.715] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1
	[0078.715] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1
	[0078.715] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0
	[0078.715] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0078.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.715] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Decrypt.txt", lpFilePart=0x0) returned 0x1a
	[0078.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.715] CreateFileW (lpFileName="C:\\ProgramData\\Decrypt.txt" (normalized: "c:\\programdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.716] GetFileType (hFile=0x5f4) returned 0x1
	[0078.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.716] GetFileType (hFile=0x5f4) returned 0x1
	[0078.716] WriteFile (in: hFile=0x5f4, lpBuffer=0x24e704c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e704c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.717] CloseHandle (hObject=0x5f4) returned 1
	[0078.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.717] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb
	[0078.717] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0078.718] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.718] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0078.718] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 1
	[0078.718] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 0
	[0078.718] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0078.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.718] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb
	[0078.718] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.718] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.718] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0078.718] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 1
	[0078.718] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.718] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.718] GetFullPathNameW (in: lpFileName="C:\\Recovery\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\Decrypt.txt", lpFilePart=0x0) returned 0x17
	[0078.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.718] CreateFileW (lpFileName="C:\\Recovery\\Decrypt.txt" (normalized: "c:\\recovery\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.719] GetFileType (hFile=0x5f4) returned 0x1
	[0078.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.719] GetFileType (hFile=0x5f4) returned 0x1
	[0078.719] WriteFile (in: hFile=0x5f4, lpBuffer=0x24ea09c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ea09c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.720] CloseHandle (hObject=0x5f4) returned 1
	[0078.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.720] GetFullPathNameW (in: lpFileName="C:\\System Volume Information", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information", lpFilePart=0x0) returned 0x1c
	[0078.720] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0078.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0078.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.721] GetFullPathNameW (in: lpFileName="C:\\System Volume Information", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information", lpFilePart=0x0) returned 0x1c
	[0078.721] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0078.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0078.723] GetFullPathNameW (in: lpFileName="C:\\System Volume Information\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0078.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.723] CreateFileW (lpFileName="C:\\System Volume Information\\Decrypt.txt" (normalized: "c:\\system volume information\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0078.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511db20) returned 1
	[0078.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.727] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
	[0078.727] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6935b522, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0078.727] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6935b522, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.727] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1
	[0078.727] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6935b522, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6935b522, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6935b522, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0078.727] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1
	[0078.727] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1
	[0078.727] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1
	[0078.727] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.728] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1
	[0078.728] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1
	[0078.728] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.728] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0078.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.728] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
	[0078.728] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6935b522, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6935b522, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0078.728] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6935b522, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6935b522, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.728] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1
	[0078.729] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6935b522, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6935b522, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6935b522, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0078.729] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1
	[0078.729] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1
	[0078.729] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1
	[0078.729] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.729] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1
	[0078.729] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1
	[0078.729] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0
	[0078.729] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0078.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.730] GetFullPathNameW (in: lpFileName="C:\\Users\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Decrypt.txt", lpFilePart=0x0) returned 0x14
	[0078.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.730] CreateFileW (lpFileName="C:\\Users\\Decrypt.txt" (normalized: "c:\\users\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.730] GetFileType (hFile=0x5f4) returned 0x1
	[0078.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.730] GetFileType (hFile=0x5f4) returned 0x1
	[0078.731] WriteFile (in: hFile=0x5f4, lpBuffer=0x24ee8d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ee8d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.731] CloseHandle (hObject=0x5f4) returned 1
	[0078.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.731] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs", lpFilePart=0x0) returned 0x13
	[0078.732] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0078.734] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.734] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1
	[0078.734] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1
	[0078.734] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1
	[0078.734] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0
	[0078.734] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0078.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.735] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs", lpFilePart=0x0) returned 0x13
	[0078.735] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0078.736] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.736] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1
	[0078.736] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1
	[0078.736] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1
	[0078.736] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.737] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0078.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.737] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\Decrypt.txt", lpFilePart=0x0) returned 0x1f
	[0078.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.737] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\Decrypt.txt" (normalized: "c:\\$getcurrent\\logs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.738] GetFileType (hFile=0x5f4) returned 0x1
	[0078.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.738] GetFileType (hFile=0x5f4) returned 0x1
	[0078.738] WriteFile (in: hFile=0x5f4, lpBuffer=0x24f20ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f20ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.739] CloseHandle (hObject=0x5f4) returned 1
	[0078.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.739] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS", lpFilePart=0x0) returned 0x15
	[0078.739] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0078.746] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.746] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1
	[0078.746] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1
	[0078.746] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1
	[0078.746] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1
	[0078.746] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1
	[0078.747] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0
	[0078.747] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0078.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.747] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS", lpFilePart=0x0) returned 0x15
	[0078.747] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0078.748] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.748] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1
	[0078.749] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1
	[0078.749] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1
	[0078.749] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1
	[0078.749] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1
	[0078.749] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.749] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0078.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.750] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\Decrypt.txt", lpFilePart=0x0) returned 0x21
	[0078.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.750] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\Decrypt.txt" (normalized: "c:\\$getcurrent\\safeos\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.751] GetFileType (hFile=0x5f4) returned 0x1
	[0078.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.751] GetFileType (hFile=0x5f4) returned 0x1
	[0078.751] WriteFile (in: hFile=0x5f4, lpBuffer=0x24f6094*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f6094*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.752] CloseHandle (hObject=0x5f4) returned 1
	[0078.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.752] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-18", lpFilePart=0x0) returned 0x18
	[0078.752] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0078.752] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.752] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.753] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0078.753] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0078.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.753] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-18", lpFilePart=0x0) returned 0x18
	[0078.753] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0078.753] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.753] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.754] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.754] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0078.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.754] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-18\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0078.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.754] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\Decrypt.txt" (normalized: "c:\\$recycle.bin\\s-1-5-18\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.758] GetFileType (hFile=0x5f4) returned 0x1
	[0078.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.758] GetFileType (hFile=0x5f4) returned 0x1
	[0078.758] WriteFile (in: hFile=0x5f4, lpBuffer=0x24f91c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f91c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.759] CloseHandle (hObject=0x5f4) returned 1
	[0078.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.759] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000", lpFilePart=0x0) returned 0x3d
	[0078.759] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0078.759] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.759] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.760] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0078.760] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0078.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.760] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000", lpFilePart=0x0) returned 0x3d
	[0078.760] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0078.760] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.760] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.760] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.760] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0078.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.760] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0078.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.761] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\Decrypt.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.761] GetFileType (hFile=0x5f4) returned 0x1
	[0078.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.761] GetFileType (hFile=0x5f4) returned 0x1
	[0078.761] WriteFile (in: hFile=0x5f4, lpBuffer=0x24fcadc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24fcadc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.762] CloseHandle (hObject=0x5f4) returned 1
	[0078.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.762] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025", lpFilePart=0x0) returned 0x1a
	[0078.762] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0078.763] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.763] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.763] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.764] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.764] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.764] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0078.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.764] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025", lpFilePart=0x0) returned 0x1a
	[0078.764] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0078.764] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.764] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.764] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.765] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.765] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.765] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0078.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.765] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.765] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.766] GetFileType (hFile=0x5f4) returned 0x1
	[0078.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.766] GetFileType (hFile=0x5f4) returned 0x1
	[0078.766] WriteFile (in: hFile=0x5f4, lpBuffer=0x2500200*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2500200*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.767] CloseHandle (hObject=0x5f4) returned 1
	[0078.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.767] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028", lpFilePart=0x0) returned 0x1a
	[0078.767] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0078.768] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.768] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.768] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.768] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.768] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.768] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0078.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.769] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028", lpFilePart=0x0) returned 0x1a
	[0078.769] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0078.769] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.769] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.769] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.770] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.770] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.770] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0078.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.770] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.770] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.770] GetFileType (hFile=0x5f4) returned 0x1
	[0078.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.770] GetFileType (hFile=0x5f4) returned 0x1
	[0078.770] WriteFile (in: hFile=0x5f4, lpBuffer=0x2503924*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2503924*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.771] CloseHandle (hObject=0x5f4) returned 1
	[0078.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.771] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029", lpFilePart=0x0) returned 0x1a
	[0078.771] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0078.772] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.772] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.772] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.772] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.772] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.773] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0078.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.773] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029", lpFilePart=0x0) returned 0x1a
	[0078.773] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0078.773] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.773] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.773] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.773] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.773] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.773] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0078.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.774] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.774] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.774] GetFileType (hFile=0x5f4) returned 0x1
	[0078.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.774] GetFileType (hFile=0x5f4) returned 0x1
	[0078.774] WriteFile (in: hFile=0x5f4, lpBuffer=0x2507048*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2507048*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.775] CloseHandle (hObject=0x5f4) returned 1
	[0078.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.775] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030", lpFilePart=0x0) returned 0x1a
	[0078.775] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0078.776] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.776] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.776] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.776] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.776] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.776] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0078.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.777] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030", lpFilePart=0x0) returned 0x1a
	[0078.777] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0078.777] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.777] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.777] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.777] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.777] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.777] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0078.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.778] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.778] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.778] GetFileType (hFile=0x5f4) returned 0x1
	[0078.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.778] GetFileType (hFile=0x5f4) returned 0x1
	[0078.778] WriteFile (in: hFile=0x5f4, lpBuffer=0x250a76c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250a76c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.779] CloseHandle (hObject=0x5f4) returned 1
	[0078.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.779] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031", lpFilePart=0x0) returned 0x1a
	[0078.779] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0078.780] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.780] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.780] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.780] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.780] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.780] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0078.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.780] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031", lpFilePart=0x0) returned 0x1a
	[0078.780] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0078.781] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.781] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.781] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.781] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.781] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.781] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0078.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.781] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.781] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.782] GetFileType (hFile=0x5f4) returned 0x1
	[0078.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.782] GetFileType (hFile=0x5f4) returned 0x1
	[0078.782] WriteFile (in: hFile=0x5f4, lpBuffer=0x250de90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250de90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.783] CloseHandle (hObject=0x5f4) returned 1
	[0078.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.783] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032", lpFilePart=0x0) returned 0x1a
	[0078.783] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0078.784] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.784] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.784] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.784] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.784] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.784] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0078.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.784] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032", lpFilePart=0x0) returned 0x1a
	[0078.784] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0078.790] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.791] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.791] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.791] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.791] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.791] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0078.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.791] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.791] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.792] GetFileType (hFile=0x5f4) returned 0x1
	[0078.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.792] GetFileType (hFile=0x5f4) returned 0x1
	[0078.792] WriteFile (in: hFile=0x5f4, lpBuffer=0x25115b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25115b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.793] CloseHandle (hObject=0x5f4) returned 1
	[0078.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.793] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033", lpFilePart=0x0) returned 0x1a
	[0078.793] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0078.832] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.832] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.832] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.832] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.832] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.832] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0078.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.833] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033", lpFilePart=0x0) returned 0x1a
	[0078.833] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0078.833] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.833] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.833] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.833] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.833] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.833] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0078.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.833] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.833] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.834] GetFileType (hFile=0x5f4) returned 0x1
	[0078.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.834] GetFileType (hFile=0x5f4) returned 0x1
	[0078.834] WriteFile (in: hFile=0x5f4, lpBuffer=0x2514cd8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2514cd8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.835] CloseHandle (hObject=0x5f4) returned 1
	[0078.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.835] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035", lpFilePart=0x0) returned 0x1a
	[0078.835] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0078.879] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.879] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.880] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.880] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.880] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.880] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0078.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.880] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035", lpFilePart=0x0) returned 0x1a
	[0078.880] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0078.880] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.880] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.880] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.881] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.881] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.881] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0078.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.881] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.881] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.881] GetFileType (hFile=0x5f4) returned 0x1
	[0078.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.881] GetFileType (hFile=0x5f4) returned 0x1
	[0078.881] WriteFile (in: hFile=0x5f4, lpBuffer=0x25183fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25183fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.882] CloseHandle (hObject=0x5f4) returned 1
	[0078.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.882] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036", lpFilePart=0x0) returned 0x1a
	[0078.882] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0078.883] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.883] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.883] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.883] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.883] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.883] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0078.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.884] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036", lpFilePart=0x0) returned 0x1a
	[0078.884] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0078.884] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.884] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.884] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.884] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.884] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.884] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0078.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.884] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.885] GetFileType (hFile=0x5f4) returned 0x1
	[0078.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.885] GetFileType (hFile=0x5f4) returned 0x1
	[0078.885] WriteFile (in: hFile=0x5f4, lpBuffer=0x251bb20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251bb20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.886] CloseHandle (hObject=0x5f4) returned 1
	[0078.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.886] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037", lpFilePart=0x0) returned 0x1a
	[0078.886] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0078.886] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.887] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.887] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.887] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.887] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.887] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0078.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.887] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037", lpFilePart=0x0) returned 0x1a
	[0078.887] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0078.887] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.887] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.888] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.888] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.888] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.888] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0078.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.888] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.888] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.888] GetFileType (hFile=0x5f4) returned 0x1
	[0078.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.888] GetFileType (hFile=0x5f4) returned 0x1
	[0078.888] WriteFile (in: hFile=0x5f4, lpBuffer=0x251f244*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251f244*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.889] CloseHandle (hObject=0x5f4) returned 1
	[0078.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.889] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038", lpFilePart=0x0) returned 0x1a
	[0078.889] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0078.889] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.890] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.890] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.890] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.890] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.890] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0078.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.890] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038", lpFilePart=0x0) returned 0x1a
	[0078.890] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0078.890] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.890] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.891] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.891] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.891] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.891] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0078.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.891] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.891] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.891] GetFileType (hFile=0x5f4) returned 0x1
	[0078.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.891] GetFileType (hFile=0x5f4) returned 0x1
	[0078.891] WriteFile (in: hFile=0x5f4, lpBuffer=0x2522968*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2522968*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.892] CloseHandle (hObject=0x5f4) returned 1
	[0078.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.892] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040", lpFilePart=0x0) returned 0x1a
	[0078.892] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0078.893] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.893] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.893] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.893] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.893] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.893] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0078.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.893] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040", lpFilePart=0x0) returned 0x1a
	[0078.894] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.894] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.894] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.894] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.894] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.894] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.894] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.894] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.894] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.895] GetFileType (hFile=0x5f4) returned 0x1
	[0078.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.895] GetFileType (hFile=0x5f4) returned 0x1
	[0078.895] WriteFile (in: hFile=0x5f4, lpBuffer=0x252608c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x252608c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.895] CloseHandle (hObject=0x5f4) returned 1
	[0078.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.896] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041", lpFilePart=0x0) returned 0x1a
	[0078.896] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0078.897] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.897] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.897] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.897] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.897] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.897] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0078.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.898] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041", lpFilePart=0x0) returned 0x1a
	[0078.898] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.898] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.898] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.898] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.898] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.898] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.898] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.898] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.898] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.899] GetFileType (hFile=0x5f4) returned 0x1
	[0078.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.899] GetFileType (hFile=0x5f4) returned 0x1
	[0078.899] WriteFile (in: hFile=0x5f4, lpBuffer=0x25297b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25297b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.900] CloseHandle (hObject=0x5f4) returned 1
	[0078.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.900] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042", lpFilePart=0x0) returned 0x1a
	[0078.900] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0078.900] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.900] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.900] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.900] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.900] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.900] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0078.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.901] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042", lpFilePart=0x0) returned 0x1a
	[0078.901] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.901] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.901] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.901] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.901] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.901] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.901] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.901] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.901] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.901] GetFileType (hFile=0x5f4) returned 0x1
	[0078.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.901] GetFileType (hFile=0x5f4) returned 0x1
	[0078.901] WriteFile (in: hFile=0x5f4, lpBuffer=0x252ced4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x252ced4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.902] CloseHandle (hObject=0x5f4) returned 1
	[0078.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.902] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043", lpFilePart=0x0) returned 0x1a
	[0078.902] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0078.903] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.903] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.903] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.903] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.903] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.903] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0078.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.903] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043", lpFilePart=0x0) returned 0x1a
	[0078.903] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.903] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.903] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.903] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.903] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.903] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.903] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.903] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0078.904] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.904] GetFileType (hFile=0x5f4) returned 0x1
	[0078.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0078.904] GetFileType (hFile=0x5f4) returned 0x1
	[0078.904] WriteFile (in: hFile=0x5f4, lpBuffer=0x25305f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25305f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.905] CloseHandle (hObject=0x5f4) returned 1
	[0078.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0078.905] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044", lpFilePart=0x0) returned 0x1a
	[0078.905] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0078.905] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.905] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.905] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.905] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.905] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.906] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0078.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0078.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0078.906] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044", lpFilePart=0x0) returned 0x1a
	[0078.906] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0078.906] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.906] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.906] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.906] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.906] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.906] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0078.907] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.907] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.907] GetFileType (hFile=0x5f4) returned 0x1
	[0078.907] GetFileType (hFile=0x5f4) returned 0x1
	[0078.907] WriteFile (in: hFile=0x5f4, lpBuffer=0x2533d1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2533d1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.908] CloseHandle (hObject=0x5f4) returned 1
	[0078.908] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045", lpFilePart=0x0) returned 0x1a
	[0078.908] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.909] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.909] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.909] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.909] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.909] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.909] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.909] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045", lpFilePart=0x0) returned 0x1a
	[0078.909] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0078.909] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.909] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.910] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.910] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.910] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.910] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0078.910] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.910] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.911] GetFileType (hFile=0x5f4) returned 0x1
	[0078.911] GetFileType (hFile=0x5f4) returned 0x1
	[0078.911] WriteFile (in: hFile=0x5f4, lpBuffer=0x2537440*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2537440*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.911] CloseHandle (hObject=0x5f4) returned 1
	[0078.912] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046", lpFilePart=0x0) returned 0x1a
	[0078.912] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0078.912] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.912] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.912] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.912] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.912] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.912] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0078.912] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046", lpFilePart=0x0) returned 0x1a
	[0078.913] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.913] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.913] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.913] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.913] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.913] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.913] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.913] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.913] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.913] GetFileType (hFile=0x5f4) returned 0x1
	[0078.913] GetFileType (hFile=0x5f4) returned 0x1
	[0078.913] WriteFile (in: hFile=0x5f4, lpBuffer=0x253ab64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253ab64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.914] CloseHandle (hObject=0x5f4) returned 1
	[0078.914] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049", lpFilePart=0x0) returned 0x1a
	[0078.914] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0078.914] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.914] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.915] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.915] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.915] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0078.915] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.915] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049", lpFilePart=0x0) returned 0x1a
	[0078.915] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0078.915] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.915] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.915] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.915] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0078.915] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.915] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0078.915] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0078.915] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\Decrypt.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0078.915] GetFileType (hFile=0x5f4) returned 0x1
	[0078.915] GetFileType (hFile=0x5f4) returned 0x1
	[0078.916] WriteFile (in: hFile=0x5f4, lpBuffer=0x253e288*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253e288*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.916] CloseHandle (hObject=0x5f4) returned 1
	[0078.916] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053", lpFilePart=0x0) returned 0x1a
	[0078.916] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0078.957] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.957] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0078.957] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0078.960] WriteFile (in: hFile=0x5f4, lpBuffer=0x25419ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25419ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.966] WriteFile (in: hFile=0x5f4, lpBuffer=0x25450d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25450d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.967] WriteFile (in: hFile=0x5f4, lpBuffer=0x25487f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25487f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.968] WriteFile (in: hFile=0x5f4, lpBuffer=0x254bf18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254bf18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.969] WriteFile (in: hFile=0x5f4, lpBuffer=0x254f63c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254f63c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.971] WriteFile (in: hFile=0x5f4, lpBuffer=0x2552d60*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2552d60*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.974] WriteFile (in: hFile=0x5f4, lpBuffer=0x2556224*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2556224*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.975] WriteFile (in: hFile=0x5f4, lpBuffer=0x2559768*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2559768*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.991] WriteFile (in: hFile=0x5f4, lpBuffer=0x255ea20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255ea20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.993] WriteFile (in: hFile=0x5f4, lpBuffer=0x256196c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256196c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.995] WriteFile (in: hFile=0x5f4, lpBuffer=0x2564ae8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2564ae8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.996] WriteFile (in: hFile=0x5f4, lpBuffer=0x2567c64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2567c64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.997] WriteFile (in: hFile=0x5f4, lpBuffer=0x256ade0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256ade0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0078.999] WriteFile (in: hFile=0x5f4, lpBuffer=0x256df5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256df5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.001] WriteFile (in: hFile=0x5f4, lpBuffer=0x2570ea8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2570ea8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.002] WriteFile (in: hFile=0x5f4, lpBuffer=0x2574024*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2574024*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.067] WriteFile (in: hFile=0x5f4, lpBuffer=0x25771a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25771a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.069] WriteFile (in: hFile=0x5f4, lpBuffer=0x257a0ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257a0ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.070] WriteFile (in: hFile=0x5f4, lpBuffer=0x257d038*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257d038*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.071] WriteFile (in: hFile=0x5f4, lpBuffer=0x25801b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25801b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.088] WriteFile (in: hFile=0x5f4, lpBuffer=0x25858e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25858e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.090] WriteFile (in: hFile=0x5f4, lpBuffer=0x258882c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258882c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.091] WriteFile (in: hFile=0x5f4, lpBuffer=0x258b9a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258b9a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.093] WriteFile (in: hFile=0x5f4, lpBuffer=0x258e8f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258e8f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.094] WriteFile (in: hFile=0x5f4, lpBuffer=0x2591a70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2591a70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.096] WriteFile (in: hFile=0x5f4, lpBuffer=0x2594bec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2594bec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.098] WriteFile (in: hFile=0x5f4, lpBuffer=0x2597d68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2597d68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.099] WriteFile (in: hFile=0x5f4, lpBuffer=0x259aee4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259aee4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.101] WriteFile (in: hFile=0x5f4, lpBuffer=0x259de30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259de30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.107] WriteFile (in: hFile=0x5f4, lpBuffer=0x25a0d7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a0d7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.110] WriteFile (in: hFile=0x5f4, lpBuffer=0x25a3ef8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a3ef8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.111] WriteFile (in: hFile=0x5f4, lpBuffer=0x25a7074*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a7074*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.113] WriteFile (in: hFile=0x5f4, lpBuffer=0x25aa1f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25aa1f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.114] WriteFile (in: hFile=0x5f4, lpBuffer=0x25ad36c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ad36c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.145] WriteFile (in: hFile=0x5f4, lpBuffer=0x25b04e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b04e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.146] WriteFile (in: hFile=0x5f4, lpBuffer=0x25b3754*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b3754*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.148] WriteFile (in: hFile=0x5f4, lpBuffer=0x25b6868*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b6868*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.149] WriteFile (in: hFile=0x5f4, lpBuffer=0x25b97b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b97b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.151] WriteFile (in: hFile=0x5f4, lpBuffer=0x25bc930*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bc930*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.152] WriteFile (in: hFile=0x5f4, lpBuffer=0x25bf87c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bf87c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.154] WriteFile (in: hFile=0x5f4, lpBuffer=0x25c27c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c27c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.155] WriteFile (in: hFile=0x5f4, lpBuffer=0x25c5ab4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c5ab4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.156] WriteFile (in: hFile=0x5f4, lpBuffer=0x25c8b40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c8b40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.158] WriteFile (in: hFile=0x5f4, lpBuffer=0x25cbcbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cbcbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.159] WriteFile (in: hFile=0x5f4, lpBuffer=0x25cee38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cee38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.161] WriteFile (in: hFile=0x5f4, lpBuffer=0x25d1d84*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d1d84*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.162] WriteFile (in: hFile=0x5f4, lpBuffer=0x25d4f00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d4f00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.164] WriteFile (in: hFile=0x5f4, lpBuffer=0x25d807c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d807c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.165] WriteFile (in: hFile=0x5f4, lpBuffer=0x25db1f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25db1f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.166] WriteFile (in: hFile=0x5f4, lpBuffer=0x25de1d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25de1d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.169] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data", lpFilePart=0x0) returned 0x1f
	[0079.169] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0079.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0079.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0079.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.170] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Decrypt.txt" (normalized: "c:\\programdata\\application data\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.170] GetFileType (hFile=0x5f4) returned 0x1
	[0079.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.171] GetFileType (hFile=0x5f4) returned 0x1
	[0079.171] WriteFile (in: hFile=0x5f4, lpBuffer=0x25e1260*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e1260*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.172] CloseHandle (hObject=0x5f4) returned 1
	[0079.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.172] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Comms", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Comms", lpFilePart=0x0) returned 0x14
	[0079.172] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Comms\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.173] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.173] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.173] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.173] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Comms", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Comms", lpFilePart=0x0) returned 0x14
	[0079.173] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Comms\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0079.173] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.173] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.173] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0079.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Comms\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Comms\\Decrypt.txt", lpFilePart=0x0) returned 0x20
	[0079.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.174] CreateFileW (lpFileName="C:\\ProgramData\\Comms\\Decrypt.txt" (normalized: "c:\\programdata\\comms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.174] GetFileType (hFile=0x5f4) returned 0x1
	[0079.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.174] GetFileType (hFile=0x5f4) returned 0x1
	[0079.174] WriteFile (in: hFile=0x5f4, lpBuffer=0x25e40a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e40a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.175] CloseHandle (hObject=0x5f4) returned 1
	[0079.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.175] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop", lpFilePart=0x0) returned 0x16
	[0079.175] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0079.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0079.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop", lpFilePart=0x0) returned 0x16
	[0079.176] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0079.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0079.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0079.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.178] CreateFileW (lpFileName="C:\\ProgramData\\Desktop\\Decrypt.txt" (normalized: "c:\\programdata\\desktop\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.178] GetFileType (hFile=0x5f4) returned 0x1
	[0079.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.178] GetFileType (hFile=0x5f4) returned 0x1
	[0079.179] WriteFile (in: hFile=0x5f4, lpBuffer=0x25e7010*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e7010*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.179] CloseHandle (hObject=0x5f4) returned 1
	[0079.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.179] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents", lpFilePart=0x0) returned 0x18
	[0079.180] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0079.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0079.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.181] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents", lpFilePart=0x0) returned 0x18
	[0079.181] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0079.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0079.182] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0079.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.182] CreateFileW (lpFileName="C:\\ProgramData\\Documents\\Decrypt.txt" (normalized: "c:\\programdata\\documents\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.185] GetFileType (hFile=0x5f4) returned 0x1
	[0079.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.185] GetFileType (hFile=0x5f4) returned 0x1
	[0079.186] WriteFile (in: hFile=0x5f4, lpBuffer=0x25e9fc4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e9fc4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.186] CloseHandle (hObject=0x5f4) returned 1
	[0079.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.187] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18
	[0079.187] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0079.187] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.187] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppV", cAlternateFileName="")) returned 1
	[0079.187] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1
	[0079.187] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0079.187] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1
	[0079.187] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1
	[0079.187] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1
	[0079.187] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1
	[0079.188] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1
	[0079.188] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0x40368daa, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0079.188] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1
	[0079.188] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1
	[0079.188] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1
	[0079.188] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1
	[0079.188] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1
	[0079.188] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0079.188] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1
	[0079.189] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1
	[0079.189] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1
	[0079.189] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1
	[0079.189] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1
	[0079.189] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1
	[0079.189] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1
	[0079.189] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1
	[0079.189] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1
	[0079.189] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1
	[0079.189] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1
	[0079.190] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0079.190] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0079.190] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1
	[0079.190] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1
	[0079.190] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1
	[0079.190] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1
	[0079.190] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1
	[0079.190] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1
	[0079.190] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.191] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0079.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.191] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18
	[0079.191] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.191] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.191] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppV", cAlternateFileName="")) returned 1
	[0079.191] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1
	[0079.192] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0079.192] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1
	[0079.192] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1
	[0079.192] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1
	[0079.192] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1
	[0079.192] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1
	[0079.192] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0x40368daa, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0079.192] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1
	[0079.193] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1
	[0079.193] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1
	[0079.193] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1
	[0079.193] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1
	[0079.193] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0079.193] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1
	[0079.193] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1
	[0079.193] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1
	[0079.194] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1
	[0079.194] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1
	[0079.194] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1
	[0079.194] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1
	[0079.194] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1
	[0079.194] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1
	[0079.194] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1
	[0079.194] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1
	[0079.195] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0079.195] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0079.195] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1
	[0079.195] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1
	[0079.195] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1
	[0079.195] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1
	[0079.195] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1
	[0079.196] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1
	[0079.196] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0
	[0079.196] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.196] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0079.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.196] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.196] GetFileType (hFile=0x5f4) returned 0x1
	[0079.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.196] GetFileType (hFile=0x5f4) returned 0x1
	[0079.197] WriteFile (in: hFile=0x5f4, lpBuffer=0x25f19c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f19c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.198] CloseHandle (hObject=0x5f4) returned 1
	[0079.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.198] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft OneDrive", lpFilePart=0x0) returned 0x21
	[0079.198] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.199] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.199] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1
	[0079.199] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.199] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.199] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft OneDrive", lpFilePart=0x0) returned 0x21
	[0079.199] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.199] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.199] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1
	[0079.200] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 0
	[0079.200] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.200] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft OneDrive\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0079.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.200] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft OneDrive\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft onedrive\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.200] GetFileType (hFile=0x5f4) returned 0x1
	[0079.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.200] GetFileType (hFile=0x5f4) returned 0x1
	[0079.200] WriteFile (in: hFile=0x5f4, lpBuffer=0x25f4c68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f4c68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.201] CloseHandle (hObject=0x5f4) returned 1
	[0079.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.201] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle", lpFilePart=0x0) returned 0x15
	[0079.201] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.201] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.202] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0079.202] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.202] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.202] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle", lpFilePart=0x0) returned 0x15
	[0079.202] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0079.202] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.202] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0079.202] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0
	[0079.203] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0079.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.203] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Decrypt.txt", lpFilePart=0x0) returned 0x21
	[0079.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.203] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Decrypt.txt" (normalized: "c:\\programdata\\oracle\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.203] GetFileType (hFile=0x5f4) returned 0x1
	[0079.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.203] GetFileType (hFile=0x5f4) returned 0x1
	[0079.204] WriteFile (in: hFile=0x5f4, lpBuffer=0x25f7c70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f7c70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.204] CloseHandle (hObject=0x5f4) returned 1
	[0079.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.205] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache", lpFilePart=0x0) returned 0x1c
	[0079.205] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.206] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.207] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1
	[0079.207] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1
	[0079.208] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1
	[0079.208] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1
	[0079.208] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1
	[0079.208] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1
	[0079.208] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1
	[0079.208] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1
	[0079.209] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1
	[0079.209] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1
	[0079.210] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1
	[0079.210] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1
	[0079.210] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1
	[0079.211] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1
	[0079.211] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1
	[0079.211] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1
	[0079.211] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1
	[0079.211] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1
	[0079.211] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.211] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.212] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache", lpFilePart=0x0) returned 0x1c
	[0079.213] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0079.213] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.214] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1
	[0079.214] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1
	[0079.214] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1
	[0079.214] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1
	[0079.214] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1
	[0079.214] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1
	[0079.215] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1
	[0079.215] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1
	[0079.215] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1
	[0079.215] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1
	[0079.216] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1
	[0079.216] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1
	[0079.216] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1
	[0079.216] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1
	[0079.216] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1
	[0079.216] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1
	[0079.216] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1
	[0079.217] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1
	[0079.217] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0
	[0079.217] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0079.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.218] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0079.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.218] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.219] GetFileType (hFile=0x5f4) returned 0x1
	[0079.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.220] GetFileType (hFile=0x5f4) returned 0x1
	[0079.255] WriteFile (in: hFile=0x5f4, lpBuffer=0x25ff764*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ff764*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.256] CloseHandle (hObject=0x5f4) returned 1
	[0079.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.256] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft", lpFilePart=0x0) returned 0x2a
	[0079.256] FindFirstFileW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.258] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.258] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 1
	[0079.258] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbfefc00, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 1
	[0079.258] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~4.SWI")) returned 1
	[0079.258] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 1
	[0079.258] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 0
	[0079.258] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.259] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft", lpFilePart=0x0) returned 0x2a
	[0079.259] FindFirstFileW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.260] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.260] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 1
	[0079.260] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbfefc00, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 1
	[0079.260] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~4.SWI")) returned 1
	[0079.260] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 1
	[0079.261] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.261] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0079.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.261] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\Decrypt.txt" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.262] GetFileType (hFile=0x5f4) returned 0x1
	[0079.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.262] GetFileType (hFile=0x5f4) returned 0x1
	[0079.262] WriteFile (in: hFile=0x5f4, lpBuffer=0x26041a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26041a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.263] CloseHandle (hObject=0x5f4) returned 1
	[0079.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.263] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\SoftwareDistribution", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\SoftwareDistribution", lpFilePart=0x0) returned 0x23
	[0079.263] FindFirstFileW (in: lpFileName="C:\\ProgramData\\SoftwareDistribution\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0079.263] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.264] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.264] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0079.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\SoftwareDistribution", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\SoftwareDistribution", lpFilePart=0x0) returned 0x23
	[0079.264] FindFirstFileW (in: lpFileName="C:\\ProgramData\\SoftwareDistribution\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0079.264] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.264] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.264] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0079.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\SoftwareDistribution\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\SoftwareDistribution\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0079.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.264] CreateFileW (lpFileName="C:\\ProgramData\\SoftwareDistribution\\Decrypt.txt" (normalized: "c:\\programdata\\softwaredistribution\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.265] GetFileType (hFile=0x5f4) returned 0x1
	[0079.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.265] GetFileType (hFile=0x5f4) returned 0x1
	[0079.265] WriteFile (in: hFile=0x5f4, lpBuffer=0x2607294*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2607294*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.266] CloseHandle (hObject=0x5f4) returned 1
	[0079.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Start Menu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Start Menu", lpFilePart=0x0) returned 0x19
	[0079.266] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Start Menu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0079.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0079.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.267] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Start Menu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Start Menu", lpFilePart=0x0) returned 0x19
	[0079.267] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Start Menu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0079.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0079.268] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Start Menu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Start Menu\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0079.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.268] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Decrypt.txt" (normalized: "c:\\programdata\\start menu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.269] GetFileType (hFile=0x5f4) returned 0x1
	[0079.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.269] GetFileType (hFile=0x5f4) returned 0x1
	[0079.269] WriteFile (in: hFile=0x5f4, lpBuffer=0x260a248*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260a248*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.270] CloseHandle (hObject=0x5f4) returned 1
	[0079.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.270] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates", lpFilePart=0x0) returned 0x18
	[0079.270] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Templates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0079.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0079.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.272] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates", lpFilePart=0x0) returned 0x18
	[0079.272] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Templates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0079.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0079.273] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0079.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.273] CreateFileW (lpFileName="C:\\ProgramData\\Templates\\Decrypt.txt" (normalized: "c:\\programdata\\templates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.273] GetFileType (hFile=0x5f4) returned 0x1
	[0079.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.273] GetFileType (hFile=0x5f4) returned 0x1
	[0079.273] WriteFile (in: hFile=0x5f4, lpBuffer=0x260d1fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260d1fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.274] CloseHandle (hObject=0x5f4) returned 1
	[0079.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.274] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate", lpFilePart=0x0) returned 0x19
	[0079.274] FindFirstFileW (in: lpFileName="C:\\ProgramData\\USOPrivate\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0079.275] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.275] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x668a40e9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 1
	[0079.275] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.275] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0079.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.275] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate", lpFilePart=0x0) returned 0x19
	[0079.275] FindFirstFileW (in: lpFileName="C:\\ProgramData\\USOPrivate\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0079.275] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.275] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x668a40e9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 1
	[0079.276] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x668a40e9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 0
	[0079.276] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0079.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.276] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0079.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.276] CreateFileW (lpFileName="C:\\ProgramData\\USOPrivate\\Decrypt.txt" (normalized: "c:\\programdata\\usoprivate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.279] GetFileType (hFile=0x5f4) returned 0x1
	[0079.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.279] GetFileType (hFile=0x5f4) returned 0x1
	[0079.279] WriteFile (in: hFile=0x5f4, lpBuffer=0x2610398*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2610398*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.280] CloseHandle (hObject=0x5f4) returned 1
	[0079.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared", lpFilePart=0x0) returned 0x18
	[0079.280] FindFirstFileW (in: lpFileName="C:\\ProgramData\\USOShared\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.280] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.280] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x56ec7d41, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x56ec7d41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0079.280] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.280] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared", lpFilePart=0x0) returned 0x18
	[0079.281] FindFirstFileW (in: lpFileName="C:\\ProgramData\\USOShared\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0079.281] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.281] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x56ec7d41, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x56ec7d41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0079.281] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x56ec7d41, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x56ec7d41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 0
	[0079.281] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0079.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.281] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0079.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.282] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Decrypt.txt" (normalized: "c:\\programdata\\usoshared\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.282] GetFileType (hFile=0x5f4) returned 0x1
	[0079.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.282] GetFileType (hFile=0x5f4) returned 0x1
	[0079.282] WriteFile (in: hFile=0x5f4, lpBuffer=0x2613460*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2613460*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.283] CloseHandle (hObject=0x5f4) returned 1
	[0079.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.283] GetFullPathNameW (in: lpFileName="C:\\Recovery\\Logs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\Logs", lpFilePart=0x0) returned 0x10
	[0079.283] FindFirstFileW (in: lpFileName="C:\\Recovery\\Logs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0079.283] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.283] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.283] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0079.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.284] GetFullPathNameW (in: lpFileName="C:\\Recovery\\Logs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\Logs", lpFilePart=0x0) returned 0x10
	[0079.284] FindFirstFileW (in: lpFileName="C:\\Recovery\\Logs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0079.284] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.284] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.284] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0079.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.284] GetFullPathNameW (in: lpFileName="C:\\Recovery\\Logs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\Logs\\Decrypt.txt", lpFilePart=0x0) returned 0x1c
	[0079.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.284] CreateFileW (lpFileName="C:\\Recovery\\Logs\\Decrypt.txt" (normalized: "c:\\recovery\\logs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.285] GetFileType (hFile=0x5f4) returned 0x1
	[0079.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.285] GetFileType (hFile=0x5f4) returned 0x1
	[0079.285] WriteFile (in: hFile=0x5f4, lpBuffer=0x26161e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26161e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.286] CloseHandle (hObject=0x5f4) returned 1
	[0079.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.286] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12
	[0079.286] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x693f3e9c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.286] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x693f3e9c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.287] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0079.287] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0079.287] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1
	[0079.287] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x693f3e9c, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x693f3e9c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x698462e4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0079.287] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0079.287] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0079.287] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0079.287] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1
	[0079.287] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1
	[0079.287] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1
	[0079.288] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1
	[0079.288] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1
	[0079.288] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0079.288] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0079.288] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1
	[0079.288] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1
	[0079.288] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1
	[0079.288] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.288] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.289] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12
	[0079.289] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x693f3e9c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x693f3e9c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0079.289] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x693f3e9c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x693f3e9c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.289] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0079.289] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0079.289] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1
	[0079.289] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x693f3e9c, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x693f3e9c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x698462e4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0079.289] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0079.290] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0079.290] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0079.290] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1
	[0079.290] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1
	[0079.290] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1
	[0079.290] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1
	[0079.290] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1
	[0079.290] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0079.291] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0079.291] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1
	[0079.291] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1
	[0079.291] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1
	[0079.291] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0
	[0079.291] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0079.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.292] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Decrypt.txt", lpFilePart=0x0) returned 0x1e
	[0079.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.292] CreateFileW (lpFileName="C:\\Users\\All Users\\Decrypt.txt" (normalized: "c:\\users\\all users\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.292] GetFileType (hFile=0x5f4) returned 0x1
	[0079.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.292] GetFileType (hFile=0x5f4) returned 0x1
	[0079.293] WriteFile (in: hFile=0x5f4, lpBuffer=0x261b490*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261b490*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.293] CloseHandle (hObject=0x5f4) returned 1
	[0079.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.293] GetFullPathNameW (in: lpFileName="C:\\Users\\Default", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default", lpFilePart=0x0) returned 0x10
	[0079.294] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.294] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.334] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0079.334] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0079.334] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0079.334] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0079.334] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0079.334] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0079.334] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0079.334] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0079.335] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1
	[0079.335] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0079.335] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1
	[0079.335] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1
	[0079.335] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x7a4c27fa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7a4c27fa, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1
	[0079.335] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1
	[0079.335] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1
	[0079.335] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7dab84ff, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855f639a, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1
	[0079.335] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ddd9675, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1
	[0079.336] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de71fdf, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0x855d0141, ftLastAccessTime.dwHighDateTime=0x1d2fa07, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1
	[0079.336] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~2.BLF")) returned 1
	[0079.336] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~3.REG")) returned 1
	[0079.336] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b716935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b716935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~4.REG")) returned 1
	[0079.336] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0079.336] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1
	[0079.336] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0079.336] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1
	[0079.337] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0079.337] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0079.337] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0079.337] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0079.337] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.337] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.337] GetFullPathNameW (in: lpFileName="C:\\Users\\Default", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default", lpFilePart=0x0) returned 0x10
	[0079.337] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.337] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.338] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0079.338] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0079.338] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0079.338] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0079.338] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0079.338] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0079.338] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0079.339] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0079.339] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1
	[0079.339] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0079.339] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1
	[0079.339] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1
	[0079.339] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x7a4c27fa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7a4c27fa, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1
	[0079.339] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1
	[0079.339] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1
	[0079.340] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7dab84ff, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855f639a, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1
	[0079.340] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ddd9675, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1
	[0079.340] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de71fdf, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0x855d0141, ftLastAccessTime.dwHighDateTime=0x1d2fa07, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1
	[0079.340] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~2.BLF")) returned 1
	[0079.340] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~3.REG")) returned 1
	[0079.340] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b716935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b716935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~4.REG")) returned 1
	[0079.340] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0079.340] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1
	[0079.340] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0079.341] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1
	[0079.341] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0079.341] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0079.341] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0079.341] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0079.341] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0
	[0079.341] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.341] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Decrypt.txt", lpFilePart=0x0) returned 0x1c
	[0079.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.341] CreateFileW (lpFileName="C:\\Users\\Default\\Decrypt.txt" (normalized: "c:\\users\\default\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.342] GetFileType (hFile=0x5f4) returned 0x1
	[0079.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.342] GetFileType (hFile=0x5f4) returned 0x1
	[0079.342] WriteFile (in: hFile=0x5f4, lpBuffer=0x2622e7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2622e7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.343] CloseHandle (hObject=0x5f4) returned 1
	[0079.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.343] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User", lpFilePart=0x0) returned 0x15
	[0079.343] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0079.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0079.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.344] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User", lpFilePart=0x0) returned 0x15
	[0079.344] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0079.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0079.346] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User\\Decrypt.txt", lpFilePart=0x0) returned 0x21
	[0079.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.346] CreateFileW (lpFileName="C:\\Users\\Default User\\Decrypt.txt" (normalized: "c:\\users\\default user\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.346] GetFileType (hFile=0x5f4) returned 0x1
	[0079.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.346] GetFileType (hFile=0x5f4) returned 0x1
	[0079.347] WriteFile (in: hFile=0x5f4, lpBuffer=0x2625da0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2625da0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.347] CloseHandle (hObject=0x5f4) returned 1
	[0079.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.347] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated", lpFilePart=0x0) returned 0x19
	[0079.347] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.350] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.350] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0079.350] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0079.350] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.351] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.351] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated", lpFilePart=0x0) returned 0x19
	[0079.351] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0079.352] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.352] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0079.352] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0079.352] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0
	[0079.353] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0079.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.353] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0079.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.353] CreateFileW (lpFileName="C:\\Users\\Default.migrated\\Decrypt.txt" (normalized: "c:\\users\\default.migrated\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.354] GetFileType (hFile=0x5f4) returned 0x1
	[0079.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.354] GetFileType (hFile=0x5f4) returned 0x1
	[0079.354] WriteFile (in: hFile=0x5f4, lpBuffer=0x2629100*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2629100*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.355] CloseHandle (hObject=0x5f4) returned 1
	[0079.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy", lpFilePart=0x0) returned 0xf
	[0079.355] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0079.355] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.356] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0079.356] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0079.356] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1
	[0079.356] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0079.356] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x68ae9cba, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x68ae9cba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0079.356] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d467cfa, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d467cfa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0079.356] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0079.356] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0079.356] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0079.356] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1
	[0079.357] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d4b40a6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d4b40a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0079.357] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1
	[0079.357] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1
	[0079.357] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1
	[0079.357] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1
	[0079.357] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1
	[0079.357] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1
	[0079.357] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1
	[0079.358] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1
	[0079.358] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1
	[0079.358] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1
	[0079.358] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d5e5413, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d5e5413, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0079.358] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1
	[0079.358] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0079.358] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1
	[0079.358] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1
	[0079.358] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0079.359] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0079.359] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0079.359] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d52686b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d52686b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0079.359] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.359] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0079.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.359] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy", lpFilePart=0x0) returned 0xf
	[0079.359] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0079.359] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.359] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0079.360] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0079.360] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1
	[0079.360] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0079.360] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x68ae9cba, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x68ae9cba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0079.360] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d467cfa, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d467cfa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0079.360] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0079.360] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0079.360] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0079.360] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1
	[0079.361] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d4b40a6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d4b40a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0079.361] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1
	[0079.361] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1
	[0079.361] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1
	[0079.361] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1
	[0079.361] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1
	[0079.361] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1
	[0079.361] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1
	[0079.361] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1
	[0079.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1
	[0079.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1
	[0079.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d5e5413, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d5e5413, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0079.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1
	[0079.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0079.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1
	[0079.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1
	[0079.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0079.363] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0079.363] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0079.363] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d52686b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d52686b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0079.363] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d52686b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d52686b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0
	[0079.363] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0079.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.363] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Decrypt.txt", lpFilePart=0x0) returned 0x1b
	[0079.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.363] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.363] GetFileType (hFile=0x5f4) returned 0x1
	[0079.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.363] GetFileType (hFile=0x5f4) returned 0x1
	[0079.364] WriteFile (in: hFile=0x5f4, lpBuffer=0x2630018*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2630018*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.365] CloseHandle (hObject=0x5f4) returned 1
	[0079.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.366] GetFullPathNameW (in: lpFileName="C:\\Users\\Public", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf
	[0079.366] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0079.366] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.366] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1
	[0079.366] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0079.366] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0079.366] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0079.402] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0079.402] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1
	[0079.402] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0079.402] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0079.402] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0079.402] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.403] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0079.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.403] GetFullPathNameW (in: lpFileName="C:\\Users\\Public", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf
	[0079.403] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.403] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.403] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1
	[0079.404] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0079.404] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0079.404] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0079.404] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0079.404] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1
	[0079.404] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0079.404] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0079.404] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0079.405] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0
	[0079.405] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.405] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Decrypt.txt", lpFilePart=0x0) returned 0x1b
	[0079.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.405] CreateFileW (lpFileName="C:\\Users\\Public\\Decrypt.txt" (normalized: "c:\\users\\public\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.405] GetFileType (hFile=0x5f4) returned 0x1
	[0079.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.405] GetFileType (hFile=0x5f4) returned 0x1
	[0079.406] WriteFile (in: hFile=0x5f4, lpBuffer=0x2633d8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2633d8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.406] CloseHandle (hObject=0x5f4) returned 1
	[0079.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.407] GetFullPathNameW (in: lpFileName="C:\\Boot\\Resources\\en-US", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Resources\\en-US", lpFilePart=0x0) returned 0x17
	[0079.407] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0079.407] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.407] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1
	[0079.407] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0
	[0079.407] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0079.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.407] GetFullPathNameW (in: lpFileName="C:\\Boot\\Resources\\en-US", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Resources\\en-US", lpFilePart=0x0) returned 0x17
	[0079.407] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0079.408] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.408] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1
	[0079.408] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.408] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0079.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.408] GetFullPathNameW (in: lpFileName="C:\\Boot\\Resources\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Resources\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x23
	[0079.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.408] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US\\Decrypt.txt" (normalized: "c:\\boot\\resources\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.408] GetFileType (hFile=0x5f4) returned 0x1
	[0079.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.408] GetFileType (hFile=0x5f4) returned 0x1
	[0079.408] WriteFile (in: hFile=0x5f4, lpBuffer=0x2636f08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2636f08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.409] CloseHandle (hObject=0x5f4) returned 1
	[0079.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.409] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM", lpFilePart=0x0) returned 0x18
	[0079.409] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.411] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.411] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1
	[0079.411] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1
	[0079.411] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1
	[0079.411] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.411] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.412] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM", lpFilePart=0x0) returned 0x18
	[0079.412] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0079.413] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.413] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1
	[0079.413] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1
	[0079.413] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1
	[0079.413] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 0
	[0079.414] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0079.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.414] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0079.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.414] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Decrypt.txt" (normalized: "c:\\programdata\\adobe\\arm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.415] GetFileType (hFile=0x5f4) returned 0x1
	[0079.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.415] GetFileType (hFile=0x5f4) returned 0x1
	[0079.415] WriteFile (in: hFile=0x5f4, lpBuffer=0x263a528*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263a528*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.416] CloseHandle (hObject=0x5f4) returned 1
	[0079.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.416] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\AppV", lpFilePart=0x0) returned 0x1d
	[0079.416] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0079.417] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.417] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1
	[0079.417] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.417] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0079.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.417] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\AppV", lpFilePart=0x0) returned 0x1d
	[0079.417] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.417] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.418] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1
	[0079.418] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 0
	[0079.418] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.418] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\AppV\\Decrypt.txt", lpFilePart=0x0) returned 0x29
	[0079.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.418] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\appv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.419] GetFileType (hFile=0x5f4) returned 0x1
	[0079.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.419] GetFileType (hFile=0x5f4) returned 0x1
	[0079.419] WriteFile (in: hFile=0x5f4, lpBuffer=0x263d6f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263d6f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.420] CloseHandle (hObject=0x5f4) returned 1
	[0079.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun", lpFilePart=0x0) returned 0x23
	[0079.420] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0079.420] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.420] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", cAlternateFileName="0D0D4E~1")) returned 1
	[0079.420] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1
	[0079.420] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1
	[0079.420] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1
	[0079.421] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1
	[0079.421] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1
	[0079.421] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1
	[0079.421] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1
	[0079.421] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1
	[0079.421] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1
	[0079.421] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.421] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0079.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.421] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun", lpFilePart=0x0) returned 0x23
	[0079.421] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0079.422] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.422] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", cAlternateFileName="0D0D4E~1")) returned 1
	[0079.422] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1
	[0079.422] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1
	[0079.422] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1
	[0079.422] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1
	[0079.422] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1
	[0079.426] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1
	[0079.427] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1
	[0079.427] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1
	[0079.427] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1
	[0079.427] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0
	[0079.427] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0079.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0079.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.427] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.427] GetFileType (hFile=0x5f4) returned 0x1
	[0079.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.428] GetFileType (hFile=0x5f4) returned 0x1
	[0079.428] WriteFile (in: hFile=0x5f4, lpBuffer=0x24855bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24855bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.428] CloseHandle (hObject=0x5f4) returned 1
	[0079.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f
	[0079.429] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.429] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.429] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1
	[0079.429] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1
	[0079.429] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1
	[0079.429] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0079.429] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1
	[0079.429] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.429] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.430] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f
	[0079.430] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.430] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.430] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1
	[0079.430] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1
	[0079.430] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1
	[0079.430] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0079.431] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1
	[0079.431] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0
	[0079.431] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.431] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0079.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.431] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5f4
	[0079.431] GetFileType (hFile=0x5f4) returned 0x1
	[0079.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.431] GetFileType (hFile=0x5f4) returned 0x1
	[0079.431] WriteFile (in: hFile=0x5f4, lpBuffer=0x248909c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x248909c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.432] CloseHandle (hObject=0x5f4) returned 1
	[0079.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DataMart", lpFilePart=0x0) returned 0x21
	[0079.432] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0079.438] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.438] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1
	[0079.438] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.438] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0079.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.438] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DataMart", lpFilePart=0x0) returned 0x21
	[0079.438] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.438] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.439] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1
	[0079.439] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0
	[0079.439] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.439] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DataMart\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0079.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.439] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\datamart\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.439] GetFileType (hFile=0x2e8) returned 0x1
	[0079.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.439] GetFileType (hFile=0x2e8) returned 0x1
	[0079.439] WriteFile (in: hFile=0x2e8, lpBuffer=0x248c40c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x248c40c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.440] CloseHandle (hObject=0x2e8) returned 1
	[0079.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.443] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25
	[0079.443] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.443] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.443] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1
	[0079.443] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1
	[0079.443] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.444] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.444] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25
	[0079.444] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0079.444] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.444] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1
	[0079.444] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1
	[0079.444] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0
	[0079.444] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0079.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.445] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0079.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.445] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.480] GetFileType (hFile=0x2e8) returned 0x1
	[0079.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.480] GetFileType (hFile=0x2e8) returned 0x1
	[0079.480] WriteFile (in: hFile=0x2e8, lpBuffer=0x248f9d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x248f9d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.481] CloseHandle (hObject=0x2e8) returned 1
	[0079.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x23
	[0079.481] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0079.482] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.482] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.482] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0079.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x23
	[0079.483] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.483] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.483] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.483] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0079.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.483] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\devicesync\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.484] GetFileType (hFile=0x2e8) returned 0x1
	[0079.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.484] GetFileType (hFile=0x2e8) returned 0x1
	[0079.484] WriteFile (in: hFile=0x2e8, lpBuffer=0x2492ac8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2492ac8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.485] CloseHandle (hObject=0x2e8) returned 1
	[0079.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.485] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis", lpFilePart=0x0) returned 0x22
	[0079.485] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0079.486] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.487] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AsimovUploader", cAlternateFileName="ASIMOV~1")) returned 1
	[0079.487] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedScenarios", cAlternateFileName="DOWNLO~1")) returned 1
	[0079.487] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedSettings", cAlternateFileName="DOWNLO~2")) returned 1
	[0079.487] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETLLogs", cAlternateFileName="")) returned 1
	[0079.487] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_CostDeferred.rbs", cAlternateFileName="EVENTS~3.RBS")) returned 1
	[0079.487] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b5e567a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b5e567a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x1000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Normal.rbs", cAlternateFileName="EVENTS~1.RBS")) returned 1
	[0079.487] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_NormalCritical.rbs", cAlternateFileName="EVENTS~2.RBS")) returned 1
	[0079.488] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x333333, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Realtime.rbs", cAlternateFileName="EVENTS~4.RBS")) returned 1
	[0079.488] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalTraceStore", cAlternateFileName="LOCALT~1")) returned 1
	[0079.488] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="osver.txt", cAlternateFileName="")) returned 1
	[0079.488] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="parse.dat", cAlternateFileName="")) returned 1
	[0079.488] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sideload", cAlternateFileName="")) returned 1
	[0079.488] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Siufloc", cAlternateFileName="")) returned 1
	[0079.488] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLanding", cAlternateFileName="SOFTLA~1")) returned 1
	[0079.489] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLandingStage", cAlternateFileName="SOFTLA~2")) returned 1
	[0079.489] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TenantStorage", cAlternateFileName="TENANT~1")) returned 1
	[0079.489] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 1
	[0079.489] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 0
	[0079.489] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0079.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.490] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis", lpFilePart=0x0) returned 0x22
	[0079.490] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0079.491] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.491] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AsimovUploader", cAlternateFileName="ASIMOV~1")) returned 1
	[0079.491] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedScenarios", cAlternateFileName="DOWNLO~1")) returned 1
	[0079.491] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedSettings", cAlternateFileName="DOWNLO~2")) returned 1
	[0079.491] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETLLogs", cAlternateFileName="")) returned 1
	[0079.492] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_CostDeferred.rbs", cAlternateFileName="EVENTS~3.RBS")) returned 1
	[0079.492] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b5e567a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b5e567a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x1000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Normal.rbs", cAlternateFileName="EVENTS~1.RBS")) returned 1
	[0079.492] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_NormalCritical.rbs", cAlternateFileName="EVENTS~2.RBS")) returned 1
	[0079.492] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x333333, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Realtime.rbs", cAlternateFileName="EVENTS~4.RBS")) returned 1
	[0079.492] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalTraceStore", cAlternateFileName="LOCALT~1")) returned 1
	[0079.492] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="osver.txt", cAlternateFileName="")) returned 1
	[0079.492] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="parse.dat", cAlternateFileName="")) returned 1
	[0079.492] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sideload", cAlternateFileName="")) returned 1
	[0079.493] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Siufloc", cAlternateFileName="")) returned 1
	[0079.493] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLanding", cAlternateFileName="SOFTLA~1")) returned 1
	[0079.493] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLandingStage", cAlternateFileName="SOFTLA~2")) returned 1
	[0079.493] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TenantStorage", cAlternateFileName="TENANT~1")) returned 1
	[0079.493] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 1
	[0079.493] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.493] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0079.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.494] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0079.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.494] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.496] GetFileType (hFile=0x2e8) returned 0x1
	[0079.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.496] GetFileType (hFile=0x2e8) returned 0x1
	[0079.496] WriteFile (in: hFile=0x2e8, lpBuffer=0x2498b88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2498b88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.496] CloseHandle (hObject=0x2e8) returned 1
	[0079.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.497] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM", lpFilePart=0x0) returned 0x1c
	[0079.497] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.497] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.497] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1
	[0079.498] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.498] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM", lpFilePart=0x0) returned 0x1c
	[0079.498] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0079.498] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.498] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1
	[0079.498] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0
	[0079.498] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0079.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.499] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0079.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.499] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\drm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.499] GetFileType (hFile=0x2e8) returned 0x1
	[0079.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.499] GetFileType (hFile=0x2e8) returned 0x1
	[0079.499] WriteFile (in: hFile=0x2e8, lpBuffer=0x249bd4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x249bd4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.500] CloseHandle (hObject=0x2e8) returned 1
	[0079.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x25
	[0079.500] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0079.501] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.501] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1
	[0079.501] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.501] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0079.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.501] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x25
	[0079.501] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.502] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.502] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1
	[0079.502] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0
	[0079.502] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.502] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0079.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.502] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\event viewer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.503] GetFileType (hFile=0x2e8) returned 0x1
	[0079.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.503] GetFileType (hFile=0x2e8) returned 0x1
	[0079.503] WriteFile (in: hFile=0x2e8, lpBuffer=0x249f0d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x249f0d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.504] CloseHandle (hObject=0x2e8) returned 1
	[0079.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x24
	[0079.504] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.504] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.504] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INT", cAlternateFileName="")) returned 1
	[0079.504] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 1
	[0079.505] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.505] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x24
	[0079.505] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.505] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.505] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INT", cAlternateFileName="")) returned 1
	[0079.505] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 1
	[0079.506] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 0
	[0079.506] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.506] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0079.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.506] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\identitycrl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.506] GetFileType (hFile=0x2e8) returned 0x1
	[0079.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.506] GetFileType (hFile=0x2e8) returned 0x1
	[0079.506] WriteFile (in: hFile=0x2e8, lpBuffer=0x24a2700*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24a2700*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.507] CloseHandle (hObject=0x2e8) returned 1
	[0079.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.507] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MapData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MapData", lpFilePart=0x0) returned 0x20
	[0079.507] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MapData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.508] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.508] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.508] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.508] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MapData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MapData", lpFilePart=0x0) returned 0x20
	[0079.508] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MapData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0079.508] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.508] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.509] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0079.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.509] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MapData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MapData\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0079.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.509] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MapData\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\mapdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.509] GetFileType (hFile=0x2e8) returned 0x1
	[0079.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.509] GetFileType (hFile=0x2e8) returned 0x1
	[0079.510] WriteFile (in: hFile=0x2e8, lpBuffer=0x24a5784*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24a5784*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.510] CloseHandle (hObject=0x2e8) returned 1
	[0079.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF", lpFilePart=0x0) returned 0x1b
	[0079.511] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.511] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.511] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1
	[0079.511] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1
	[0079.511] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 0
	[0079.512] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.512] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF", lpFilePart=0x0) returned 0x1b
	[0079.512] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0079.512] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.512] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1
	[0079.512] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1
	[0079.512] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.512] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0079.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.512] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Decrypt.txt", lpFilePart=0x0) returned 0x27
	[0079.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.512] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\mf\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.513] GetFileType (hFile=0x2e8) returned 0x1
	[0079.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.513] GetFileType (hFile=0x2e8) returned 0x1
	[0079.513] WriteFile (in: hFile=0x2e8, lpBuffer=0x24a8b50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24a8b50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.514] CloseHandle (hObject=0x2e8) returned 1
	[0079.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x25
	[0079.514] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0079.514] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.514] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1
	[0079.515] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.515] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0079.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x25
	[0079.515] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.515] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.515] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1
	[0079.515] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0
	[0079.515] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0079.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.515] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\netframework\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.516] GetFileType (hFile=0x2e8) returned 0x1
	[0079.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.516] GetFileType (hFile=0x2e8) returned 0x1
	[0079.516] WriteFile (in: hFile=0x2e8, lpBuffer=0x24abfc4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24abfc4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.517] CloseHandle (hObject=0x2e8) returned 1
	[0079.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.517] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network", lpFilePart=0x0) returned 0x20
	[0079.517] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0079.517] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.517] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1
	[0079.517] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1
	[0079.518] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.518] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0079.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.518] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network", lpFilePart=0x0) returned 0x20
	[0079.518] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.518] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.518] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1
	[0079.518] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1
	[0079.518] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0
	[0079.518] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.519] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0079.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.519] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\network\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.519] GetFileType (hFile=0x2e8) returned 0x1
	[0079.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.519] GetFileType (hFile=0x2e8) returned 0x1
	[0079.519] WriteFile (in: hFile=0x2e8, lpBuffer=0x24af590*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24af590*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.520] CloseHandle (hObject=0x2e8) returned 1
	[0079.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.520] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Office", lpFilePart=0x0) returned 0x1f
	[0079.520] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0079.520] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.520] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 1
	[0079.520] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 0
	[0079.520] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0079.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.520] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Office", lpFilePart=0x0) returned 0x1f
	[0079.521] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.521] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.521] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 1
	[0079.521] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.521] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Office\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0079.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.521] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Office\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\office\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.521] GetFileType (hFile=0x2e8) returned 0x1
	[0079.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.521] GetFileType (hFile=0x2e8) returned 0x1
	[0079.521] WriteFile (in: hFile=0x2e8, lpBuffer=0x24b2924*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b2924*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.522] CloseHandle (hObject=0x2e8) returned 1
	[0079.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.522] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning", lpFilePart=0x0) returned 0x25
	[0079.522] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0079.578] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.579] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60aed0fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x60aed0fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x60aed0fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="countrytable.xml", cAlternateFileName="")) returned 1
	[0079.579] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", cAlternateFileName="{18DCF~1")) returned 1
	[0079.579] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1e05dd5d-a022-46c5-963c-b20de341170f}", cAlternateFileName="{1E05D~1")) returned 1
	[0079.579] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{23cb517f-5073-4e96-a202-7fe6122a2271}", cAlternateFileName="{23CB5~1")) returned 1
	[0079.579] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", cAlternateFileName="{268C4~1")) returned 1
	[0079.579] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", cAlternateFileName="{33D78~1")) returned 1
	[0079.579] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", cAlternateFileName="{3742E~1")) returned 1
	[0079.579] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", cAlternateFileName="{7A30A~1")) returned 1
	[0079.579] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", cAlternateFileName="{8D196~1")) returned 1
	[0079.579] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", cAlternateFileName="{8FB7D~1")) returned 1
	[0079.580] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{99b095d8-5959-4820-bea7-7448c8427b4e}", cAlternateFileName="{99B09~1")) returned 1
	[0079.580] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", cAlternateFileName="{9AEC5~1")) returned 1
	[0079.580] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", cAlternateFileName="{9DF6A~1")) returned 1
	[0079.580] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", cAlternateFileName="{B0B91~1")) returned 1
	[0079.580] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c5dc3753-b6c8-4057-b396-bf13d769311c}", cAlternateFileName="{C5DC3~1")) returned 1
	[0079.580] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c8a326e4-f518-4f14-b543-97a57e1a975e}", cAlternateFileName="{C8A32~1")) returned 1
	[0079.580] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ee4aac98-c174-4941-82b1-d121e493e4fb}", cAlternateFileName="{EE4AA~1")) returned 1
	[0079.580] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", cAlternateFileName="{F1189~1")) returned 1
	[0079.580] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 1
	[0079.580] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.580] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0079.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.581] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning", lpFilePart=0x0) returned 0x25
	[0079.581] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.585] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.585] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60aed0fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x60aed0fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x60aed0fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="countrytable.xml", cAlternateFileName="")) returned 1
	[0079.585] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", cAlternateFileName="{18DCF~1")) returned 1
	[0079.585] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1e05dd5d-a022-46c5-963c-b20de341170f}", cAlternateFileName="{1E05D~1")) returned 1
	[0079.585] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{23cb517f-5073-4e96-a202-7fe6122a2271}", cAlternateFileName="{23CB5~1")) returned 1
	[0079.585] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", cAlternateFileName="{268C4~1")) returned 1
	[0079.585] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", cAlternateFileName="{33D78~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", cAlternateFileName="{3742E~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", cAlternateFileName="{7A30A~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", cAlternateFileName="{8D196~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", cAlternateFileName="{8FB7D~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{99b095d8-5959-4820-bea7-7448c8427b4e}", cAlternateFileName="{99B09~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", cAlternateFileName="{9AEC5~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", cAlternateFileName="{9DF6A~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", cAlternateFileName="{B0B91~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c5dc3753-b6c8-4057-b396-bf13d769311c}", cAlternateFileName="{C5DC3~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c8a326e4-f518-4f14-b543-97a57e1a975e}", cAlternateFileName="{C8A32~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ee4aac98-c174-4941-82b1-d121e493e4fb}", cAlternateFileName="{EE4AA~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", cAlternateFileName="{F1189~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 1
	[0079.586] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 0
	[0079.586] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.587] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0079.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.587] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e8
	[0079.588] GetFileType (hFile=0x2e8) returned 0x1
	[0079.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.588] GetFileType (hFile=0x2e8) returned 0x1
	[0079.588] WriteFile (in: hFile=0x2e8, lpBuffer=0x24c520c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c520c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.590] CloseHandle (hObject=0x2e8) returned 1
	[0079.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.590] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search", lpFilePart=0x0) returned 0x1f
	[0079.590] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0079.591] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.591] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0079.591] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.591] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0079.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search", lpFilePart=0x0) returned 0x1f
	[0079.591] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0079.591] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.591] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0079.591] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0
	[0079.591] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0079.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0079.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.591] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.702] GetFileType (hFile=0x2fc) returned 0x1
	[0079.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.702] GetFileType (hFile=0x2fc) returned 0x1
	[0079.712] WriteFile (in: hFile=0x2fc, lpBuffer=0x24ca884*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ca884*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.713] CloseHandle (hObject=0x2fc) returned 1
	[0079.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Settings", lpFilePart=0x0) returned 0x21
	[0079.761] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.761] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.761] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="")) returned 1
	[0079.761] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.762] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Settings", lpFilePart=0x0) returned 0x21
	[0079.762] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.762] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.762] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="")) returned 1
	[0079.762] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="")) returned 0
	[0079.762] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0079.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.762] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Settings\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.762] GetFileType (hFile=0x2fc) returned 0x1
	[0079.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.763] GetFileType (hFile=0x2fc) returned 0x1
	[0079.763] WriteFile (in: hFile=0x2fc, lpBuffer=0x24cdb64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24cdb64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.763] CloseHandle (hObject=0x2fc) returned 1
	[0079.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter", lpFilePart=0x0) returned 0x22
	[0079.764] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.764] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.764] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dcfea0a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1b408c4a, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x1b408c4a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageStore", cAlternateFileName="MESSAG~1")) returned 1
	[0079.764] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.764] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter", lpFilePart=0x0) returned 0x22
	[0079.764] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0079.764] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.764] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dcfea0a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1b408c4a, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x1b408c4a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageStore", cAlternateFileName="MESSAG~1")) returned 1
	[0079.764] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dcfea0a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1b408c4a, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x1b408c4a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageStore", cAlternateFileName="MESSAG~1")) returned 0
	[0079.764] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0079.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.765] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0079.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.765] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\smsrouter\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0079.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511db20) returned 1
	[0079.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.767] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Spectrum", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Spectrum", lpFilePart=0x0) returned 0x21
	[0079.767] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Spectrum\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0079.767] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.767] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.767] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0079.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.767] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Spectrum", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Spectrum", lpFilePart=0x0) returned 0x21
	[0079.767] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Spectrum\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0079.768] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.768] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.768] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0079.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.768] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Spectrum\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Spectrum\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0079.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.768] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Spectrum\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\spectrum\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.768] GetFileType (hFile=0x2fc) returned 0x1
	[0079.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.768] GetFileType (hFile=0x2fc) returned 0x1
	[0079.769] WriteFile (in: hFile=0x2fc, lpBuffer=0x24d1e98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d1e98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.769] CloseHandle (hObject=0x2fc) returned 1
	[0079.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.769] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Speech_OneCore", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Speech_OneCore", lpFilePart=0x0) returned 0x27
	[0079.770] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Speech_OneCore\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0079.770] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.770] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.771] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0079.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.771] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Speech_OneCore", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Speech_OneCore", lpFilePart=0x0) returned 0x27
	[0079.771] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Speech_OneCore\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0079.771] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.771] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.771] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0079.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.771] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Speech_OneCore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Speech_OneCore\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0079.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.771] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Speech_OneCore\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\speech_onecore\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.772] GetFileType (hFile=0x2fc) returned 0x1
	[0079.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.772] GetFileType (hFile=0x2fc) returned 0x1
	[0079.772] WriteFile (in: hFile=0x2fc, lpBuffer=0x24d504c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d504c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.773] CloseHandle (hObject=0x2fc) returned 1
	[0079.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.773] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Storage Health", lpFilePart=0x0) returned 0x27
	[0079.773] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.774] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.774] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4dcad0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x2ab8b28d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x1571, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageEventsArchive.dat", cAlternateFileName="STORAG~1.DAT")) returned 1
	[0079.774] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 1
	[0079.774] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 0
	[0079.774] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.774] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Storage Health", lpFilePart=0x0) returned 0x27
	[0079.774] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.774] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.775] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4dcad0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x2ab8b28d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x1571, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageEventsArchive.dat", cAlternateFileName="STORAG~1.DAT")) returned 1
	[0079.775] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 1
	[0079.775] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.775] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.775] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Storage Health\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0079.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.775] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\storage health\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.777] GetFileType (hFile=0x2fc) returned 0x1
	[0079.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.777] GetFileType (hFile=0x2fc) returned 0x1
	[0079.778] WriteFile (in: hFile=0x2fc, lpBuffer=0x24d88b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d88b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.779] CloseHandle (hObject=0x2fc) returned 1
	[0079.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.779] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV", lpFilePart=0x0) returned 0x1c
	[0079.779] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0079.779] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.779] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InboxTemplates", cAlternateFileName="INBOXT~1")) returned 1
	[0079.779] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scripts", cAlternateFileName="")) returned 1
	[0079.780] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0079.780] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.780] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0079.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.780] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV", lpFilePart=0x0) returned 0x1c
	[0079.780] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0079.780] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.780] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InboxTemplates", cAlternateFileName="INBOXT~1")) returned 1
	[0079.780] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scripts", cAlternateFileName="")) returned 1
	[0079.781] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0079.781] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0
	[0079.781] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0079.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.781] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0079.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.781] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\uev\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.781] GetFileType (hFile=0x2fc) returned 0x1
	[0079.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.781] GetFileType (hFile=0x2fc) returned 0x1
	[0079.781] WriteFile (in: hFile=0x2fc, lpBuffer=0x24dbf98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24dbf98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.782] CloseHandle (hObject=0x2fc) returned 1
	[0079.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.782] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x2e
	[0079.782] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0079.783] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.783] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecc15f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa4ecc15f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa4ecc15f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x930d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default User.dat", cAlternateFileName="DEFAUL~1.DAT")) returned 1
	[0079.783] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37896d36, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37896d36, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37896d36, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy.dat", cAlternateFileName="")) returned 1
	[0079.783] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1
	[0079.783] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.png", cAlternateFileName="")) returned 1
	[0079.783] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-192.png", cAlternateFileName="")) returned 1
	[0079.784] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-32.png", cAlternateFileName="")) returned 1
	[0079.784] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-40.png", cAlternateFileName="")) returned 1
	[0079.784] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-48.png", cAlternateFileName="")) returned 1
	[0079.784] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1
	[0079.784] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png", cAlternateFileName="")) returned 1
	[0079.784] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png", cAlternateFileName="")) returned 0
	[0079.785] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0079.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.785] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x2e
	[0079.785] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0079.785] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.785] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecc15f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa4ecc15f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa4ecc15f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x930d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default User.dat", cAlternateFileName="DEFAUL~1.DAT")) returned 1
	[0079.785] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37896d36, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37896d36, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37896d36, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy.dat", cAlternateFileName="")) returned 1
	[0079.785] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1
	[0079.786] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.png", cAlternateFileName="")) returned 1
	[0079.786] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-192.png", cAlternateFileName="")) returned 1
	[0079.786] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-32.png", cAlternateFileName="")) returned 1
	[0079.786] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-40.png", cAlternateFileName="")) returned 1
	[0079.786] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-48.png", cAlternateFileName="")) returned 1
	[0079.786] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1
	[0079.786] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png", cAlternateFileName="")) returned 1
	[0079.786] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.786] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0079.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.787] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0079.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.787] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\user account pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.789] GetFileType (hFile=0x2fc) returned 0x1
	[0079.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.789] GetFileType (hFile=0x2fc) returned 0x1
	[0079.789] WriteFile (in: hFile=0x2fc, lpBuffer=0x24e0ec8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e0ec8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.790] CloseHandle (hObject=0x2fc) returned 1
	[0079.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.790] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault", lpFilePart=0x0) returned 0x1e
	[0079.791] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.791] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.791] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 1
	[0079.791] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.791] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.797] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault", lpFilePart=0x0) returned 0x1e
	[0079.797] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0079.798] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.798] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 1
	[0079.798] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 0
	[0079.798] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0079.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.798] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\Decrypt.txt", lpFilePart=0x0) returned 0x2a
	[0079.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.798] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\vault\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.799] GetFileType (hFile=0x2fc) returned 0x1
	[0079.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.799] GetFileType (hFile=0x2fc) returned 0x1
	[0079.799] WriteFile (in: hFile=0x2fc, lpBuffer=0x24e4300*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e4300*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.799] CloseHandle (hObject=0x2fc) returned 1
	[0079.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.800] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WDF", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WDF", lpFilePart=0x0) returned 0x1c
	[0079.800] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WDF\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.800] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.800] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.800] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.800] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WDF", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WDF", lpFilePart=0x0) returned 0x1c
	[0079.801] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WDF\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.801] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.801] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.801] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WDF\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WDF\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0079.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.801] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WDF\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\wdf\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.808] GetFileType (hFile=0x2fc) returned 0x1
	[0079.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.808] GetFileType (hFile=0x2fc) returned 0x1
	[0079.924] WriteFile (in: hFile=0x2fc, lpBuffer=0x2484d5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2484d5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.925] CloseHandle (hObject=0x2fc) returned 1
	[0079.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.925] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WinMSIPC", lpFilePart=0x0) returned 0x21
	[0079.925] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0079.926] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.926] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1
	[0079.926] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.926] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0079.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WinMSIPC", lpFilePart=0x0) returned 0x21
	[0079.927] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0079.927] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.927] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1
	[0079.927] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0
	[0079.927] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0079.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WinMSIPC\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0079.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.928] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\winmsipc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.928] GetFileType (hFile=0x2fc) returned 0x1
	[0079.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.928] GetFileType (hFile=0x2fc) returned 0x1
	[0079.928] WriteFile (in: hFile=0x2fc, lpBuffer=0x2488408*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2488408*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.929] CloseHandle (hObject=0x2fc) returned 1
	[0079.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x20
	[0079.929] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0079.929] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.930] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMProfiles", cAlternateFileName="DMPROF~1")) returned 1
	[0079.930] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0079.930] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.930] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0079.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.930] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x20
	[0079.930] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0079.930] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.930] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMProfiles", cAlternateFileName="DMPROF~1")) returned 1
	[0079.931] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0079.931] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0
	[0079.931] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0079.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.931] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0079.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.931] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\wwansvc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.931] GetFileType (hFile=0x2fc) returned 0x1
	[0079.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.931] GetFileType (hFile=0x2fc) returned 0x1
	[0079.931] WriteFile (in: hFile=0x2fc, lpBuffer=0x248bb10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x248bb10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.932] CloseHandle (hObject=0x2fc) returned 1
	[0079.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.932] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft OneDrive\\setup", lpFilePart=0x0) returned 0x27
	[0079.933] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0079.933] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.933] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 1
	[0079.933] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 0
	[0079.933] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0079.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.933] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft OneDrive\\setup", lpFilePart=0x0) returned 0x27
	[0079.934] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0079.934] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.934] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 1
	[0079.934] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.934] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0079.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.934] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft OneDrive\\setup\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0079.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.934] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft onedrive\\setup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.934] GetFileType (hFile=0x2fc) returned 0x1
	[0079.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.935] GetFileType (hFile=0x2fc) returned 0x1
	[0079.935] WriteFile (in: hFile=0x2fc, lpBuffer=0x248f0ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x248f0ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.935] CloseHandle (hObject=0x2fc) returned 1
	[0079.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.936] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java", lpFilePart=0x0) returned 0x1a
	[0079.936] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0079.937] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.937] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".oracle_jre_usage", cAlternateFileName="ORACLE~1")) returned 1
	[0079.937] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="installcache_x64", cAlternateFileName="INSTAL~1")) returned 1
	[0079.937] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath", cAlternateFileName="")) returned 1
	[0079.937] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1
	[0079.937] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.937] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0079.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.938] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java", lpFilePart=0x0) returned 0x1a
	[0079.938] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0079.939] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.939] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".oracle_jre_usage", cAlternateFileName="ORACLE~1")) returned 1
	[0079.940] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="installcache_x64", cAlternateFileName="INSTAL~1")) returned 1
	[0079.940] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath", cAlternateFileName="")) returned 1
	[0079.940] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1
	[0079.940] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 0
	[0079.940] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0079.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.941] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0079.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.941] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\Decrypt.txt" (normalized: "c:\\programdata\\oracle\\java\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.942] GetFileType (hFile=0x2fc) returned 0x1
	[0079.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.942] GetFileType (hFile=0x2fc) returned 0x1
	[0079.942] WriteFile (in: hFile=0x2fc, lpBuffer=0x2492a78*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2492a78*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.943] CloseHandle (hObject=0x2fc) returned 1
	[0079.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.943] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0079.943] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0079.944] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.944] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0079.944] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.944] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0079.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.944] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0079.944] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0079.945] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.945] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0079.945] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0079.945] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0079.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.945] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0079.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.945] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.946] GetFileType (hFile=0x2fc) returned 0x1
	[0079.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.946] GetFileType (hFile=0x2fc) returned 0x1
	[0079.946] WriteFile (in: hFile=0x2fc, lpBuffer=0x24980bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24980bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.948] CloseHandle (hObject=0x2fc) returned 1
	[0079.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.948] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x43
	[0079.948] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0079.949] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.949] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x354d9570, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0079.949] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0079.949] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0079.949] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0079.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.949] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x43
	[0079.949] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0079.949] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.950] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x354d9570, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0079.950] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0079.950] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.950] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0079.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.950] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0079.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0079.950] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.951] GetFileType (hFile=0x2fc) returned 0x1
	[0079.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0079.951] GetFileType (hFile=0x2fc) returned 0x1
	[0079.951] WriteFile (in: hFile=0x2fc, lpBuffer=0x249c000*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x249c000*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.952] CloseHandle (hObject=0x2fc) returned 1
	[0079.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0079.952] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0079.953] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.953] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0079.953] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.953] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0079.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0079.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0079.953] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0079.953] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0079.953] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.954] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0079.954] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0079.954] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0079.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0079.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0079.954] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.954] GetFileType (hFile=0x2fc) returned 0x1
	[0079.954] GetFileType (hFile=0x2fc) returned 0x1
	[0079.954] WriteFile (in: hFile=0x2fc, lpBuffer=0x24a0858*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24a0858*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.955] CloseHandle (hObject=0x2fc) returned 1
	[0079.956] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpFilePart=0x0) returned 0x43
	[0079.956] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0079.956] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.957] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3639a1f2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0079.957] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0079.957] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0079.957] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0079.957] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpFilePart=0x0) returned 0x43
	[0079.957] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0079.957] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.957] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3639a1f2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0079.957] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0079.958] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.958] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0079.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0079.958] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0079.958] GetFileType (hFile=0x2fc) returned 0x1
	[0079.958] GetFileType (hFile=0x2fc) returned 0x1
	[0079.958] WriteFile (in: hFile=0x2fc, lpBuffer=0x24a46d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24a46d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0079.959] CloseHandle (hObject=0x2fc) returned 1
	[0079.959] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0079.960] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.097] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.097] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.097] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.097] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.098] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0080.098] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0080.098] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.098] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.098] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0080.098] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0080.098] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0080.098] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.099] GetFileType (hFile=0x2fc) returned 0x1
	[0080.099] GetFileType (hFile=0x2fc) returned 0x1
	[0080.099] WriteFile (in: hFile=0x2fc, lpBuffer=0x24aa1b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24aa1b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.100] CloseHandle (hObject=0x2fc) returned 1
	[0080.100] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0080.100] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.101] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.101] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.101] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.101] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.101] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0080.101] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0080.101] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.101] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.101] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0080.102] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0080.102] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0080.102] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.102] GetFileType (hFile=0x2fc) returned 0x1
	[0080.102] GetFileType (hFile=0x2fc) returned 0x1
	[0080.102] WriteFile (in: hFile=0x2fc, lpBuffer=0x24ae338*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ae338*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.103] CloseHandle (hObject=0x2fc) returned 1
	[0080.103] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0080.103] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0080.109] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.109] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.109] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.109] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0080.109] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0080.109] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0080.110] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.110] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.110] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0080.110] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0080.110] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0080.110] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.110] GetFileType (hFile=0x2fc) returned 0x1
	[0080.110] GetFileType (hFile=0x2fc) returned 0x1
	[0080.111] WriteFile (in: hFile=0x2fc, lpBuffer=0x24b2678*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b2678*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.111] CloseHandle (hObject=0x2fc) returned 1
	[0080.112] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0080.112] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.112] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.113] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.113] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.113] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0080.113] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0080.113] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.113] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.113] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0080.113] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0080.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0080.113] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.114] GetFileType (hFile=0x2fc) returned 0x1
	[0080.114] GetFileType (hFile=0x2fc) returned 0x1
	[0080.114] WriteFile (in: hFile=0x2fc, lpBuffer=0x24b6348*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b6348*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.115] CloseHandle (hObject=0x2fc) returned 1
	[0080.115] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0080.115] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0080.116] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.116] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.116] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.116] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0080.116] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0080.116] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.117] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.117] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.117] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0080.117] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.117] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0080.117] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.117] GetFileType (hFile=0x2fc) returned 0x1
	[0080.117] GetFileType (hFile=0x2fc) returned 0x1
	[0080.118] WriteFile (in: hFile=0x2fc, lpBuffer=0x24ba018*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ba018*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.118] CloseHandle (hObject=0x2fc) returned 1
	[0080.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0080.119] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0080.136] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.136] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.136] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.136] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0080.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0080.137] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0080.137] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.137] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.137] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0080.137] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0080.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0080.137] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.138] GetFileType (hFile=0x2fc) returned 0x1
	[0080.138] GetFileType (hFile=0x2fc) returned 0x1
	[0080.138] WriteFile (in: hFile=0x2fc, lpBuffer=0x24c18f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c18f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.139] CloseHandle (hObject=0x2fc) returned 1
	[0080.139] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0080.139] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.140] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.140] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.140] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.140] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0080.140] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0080.140] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.140] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.140] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0080.140] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0080.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0080.140] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.141] GetFileType (hFile=0x2fc) returned 0x1
	[0080.141] GetFileType (hFile=0x2fc) returned 0x1
	[0080.141] WriteFile (in: hFile=0x2fc, lpBuffer=0x24c7008*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c7008*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.142] CloseHandle (hObject=0x2fc) returned 1
	[0080.142] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpFilePart=0x0) returned 0x43
	[0080.142] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.142] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.142] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x359ea6b6, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0080.142] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0080.142] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0080.143] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpFilePart=0x0) returned 0x43
	[0080.143] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0080.143] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.143] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x359ea6b6, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0080.143] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0080.143] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.143] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0080.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0080.143] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.143] GetFileType (hFile=0x2fc) returned 0x1
	[0080.143] GetFileType (hFile=0x2fc) returned 0x1
	[0080.144] WriteFile (in: hFile=0x2fc, lpBuffer=0x24cca5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24cca5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.144] CloseHandle (hObject=0x2fc) returned 1
	[0080.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0080.145] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0080.145] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.145] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.145] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.145] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0080.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0080.145] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0080.146] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.146] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.146] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0080.146] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0080.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0080.146] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.147] GetFileType (hFile=0x2fc) returned 0x1
	[0080.147] GetFileType (hFile=0x2fc) returned 0x1
	[0080.147] WriteFile (in: hFile=0x2fc, lpBuffer=0x24d122c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d122c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.148] CloseHandle (hObject=0x2fc) returned 1
	[0080.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0080.148] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.148] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.148] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.148] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.148] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0080.148] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0080.148] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.149] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.149] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0080.149] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0080.149] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0080.149] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.149] GetFileType (hFile=0x2fc) returned 0x1
	[0080.149] GetFileType (hFile=0x2fc) returned 0x1
	[0080.149] WriteFile (in: hFile=0x2fc, lpBuffer=0x24d4f1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d4f1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.150] CloseHandle (hObject=0x2fc) returned 1
	[0080.150] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", lpFilePart=0x0) returned 0x43
	[0080.150] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0080.150] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.150] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x37687158, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0080.151] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1
	[0080.151] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0
	[0080.151] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0080.151] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", lpFilePart=0x0) returned 0x43
	[0080.151] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0080.151] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.151] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x37687158, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0080.217] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1
	[0080.217] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.217] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0080.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0080.217] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.217] GetFileType (hFile=0x2fc) returned 0x1
	[0080.217] GetFileType (hFile=0x2fc) returned 0x1
	[0080.217] WriteFile (in: hFile=0x2fc, lpBuffer=0x24da0d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24da0d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.218] CloseHandle (hObject=0x2fc) returned 1
	[0080.218] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x43
	[0080.219] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0080.219] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.219] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x35efb7db, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0080.219] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0080.219] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0080.219] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0080.219] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x43
	[0080.219] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0080.220] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.220] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x35efb7db, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0080.220] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0080.220] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.220] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0080.220] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0080.220] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.220] GetFileType (hFile=0x2fc) returned 0x1
	[0080.221] GetFileType (hFile=0x2fc) returned 0x1
	[0080.221] WriteFile (in: hFile=0x2fc, lpBuffer=0x24df7b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24df7b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.221] CloseHandle (hObject=0x2fc) returned 1
	[0080.222] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x43
	[0080.222] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0080.222] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.222] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3714fdce, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0080.222] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1
	[0080.222] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0
	[0080.222] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0080.222] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x43
	[0080.222] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0080.223] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.223] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3714fdce, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0080.223] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1
	[0080.223] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.223] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0080.223] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0080.223] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.223] GetFileType (hFile=0x2fc) returned 0x1
	[0080.223] GetFileType (hFile=0x2fc) returned 0x1
	[0080.223] WriteFile (in: hFile=0x2fc, lpBuffer=0x24e3900*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e3900*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.224] CloseHandle (hObject=0x2fc) returned 1
	[0080.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0080.224] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.225] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.225] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.225] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.225] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.225] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0080.225] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.225] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.226] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0080.226] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0080.226] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.226] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0080.226] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.226] GetFileType (hFile=0x2fc) returned 0x1
	[0080.226] GetFileType (hFile=0x2fc) returned 0x1
	[0080.226] WriteFile (in: hFile=0x2fc, lpBuffer=0x24e8e24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e8e24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.227] CloseHandle (hObject=0x2fc) returned 1
	[0080.227] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore", lpFilePart=0x0) returned 0x25
	[0080.227] FindFirstFileW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x668a40e9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0080.227] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x668a40e9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.227] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9086d4, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdc9086d4, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xdc9086d4, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateCspStore.xml", cAlternateFileName="UPDATE~2.XML")) returned 1
	[0080.227] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66857b30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 1
	[0080.227] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66857b30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 0
	[0080.227] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0080.227] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore", lpFilePart=0x0) returned 0x25
	[0080.228] FindFirstFileW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x668a40e9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0080.228] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x668a40e9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.228] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9086d4, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdc9086d4, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xdc9086d4, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateCspStore.xml", cAlternateFileName="UPDATE~2.XML")) returned 1
	[0080.228] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66857b30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 1
	[0080.228] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.228] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0080.228] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0080.228] CreateFileW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\Decrypt.txt" (normalized: "c:\\programdata\\usoprivate\\updatestore\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.229] GetFileType (hFile=0x2fc) returned 0x1
	[0080.229] GetFileType (hFile=0x2fc) returned 0x1
	[0080.229] WriteFile (in: hFile=0x2fc, lpBuffer=0x24ec7c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ec7c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.230] CloseHandle (hObject=0x2fc) returned 1
	[0080.230] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs", lpFilePart=0x0) returned 0x1d
	[0080.230] FindFirstFileW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x56ec7d41, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x56ec7d41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0080.230] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x56ec7d41, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x56ec7d41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x58d51fd9, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x597705f5, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUx.001.etl", cAlternateFileName="NOBE5B~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7cf76e0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x852e502, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUx.002.etl", cAlternateFileName="NOTIFI~2.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2d822f20, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2efd472c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.001.etl", cAlternateFileName="NO604C~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfe554d51, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0xfe782447, ftLastWriteTime.dwHighDateTime=0x1d3375a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.002.etl", cAlternateFileName="NO8BA4~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfdf01be1, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfdfc06a7, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.003.etl", cAlternateFileName="NO3670~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x588b3c6a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x59ae67c8, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.004.etl", cAlternateFileName="NO2FB3~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xb4b94410, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0xb50917ed, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.005.etl", cAlternateFileName="NO74F7~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x86d6bb14, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x8728eea2, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.006.etl", cAlternateFileName="NOC92C~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe7f77c60, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xebc8ba4e, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.007.etl", cAlternateFileName="NOAEB3~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe1017621, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe10d621a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.008.etl", cAlternateFileName="NO6494~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2fb7ebe4, ftLastAccessTime.dwHighDateTime=0x1d327d1, ftLastWriteTime.dwLowDateTime=0x2fc89ca0, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.009.etl", cAlternateFileName="NO492C~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xd855139b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd87b395e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.010.etl", cAlternateFileName="NO0EF1~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x1ff683d6, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x20000d39, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.011.etl", cAlternateFileName="NOC3D2~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x46e2de3d, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x46eecb64, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.012.etl", cAlternateFileName="NOA86A~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x235d058f, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x23917bad, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.013.etl", cAlternateFileName="NO3128~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x8f69453d, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0x8f779518, ftLastWriteTime.dwHighDateTime=0x1d327b9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.014.etl", cAlternateFileName="NO43D2~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7fb3688d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7fc1b6b8, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.015.etl", cAlternateFileName="NOTIFI~4.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb502d29, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb5c1a4e, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.016.etl", cAlternateFileName="NOTIFI~3.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7b53cfc, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x8be7d51, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.017.etl", cAlternateFileName="NOTIFI~1.ETL")) returned 1
	[0080.231] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x56ec7d41, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x56ec7d41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.001.etl", cAlternateFileName="UP2DAF~1.ETL")) returned 1
	[0080.232] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xde371631, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x2bb800e, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.002.etl", cAlternateFileName="UP3884~1.ETL")) returned 1
	[0080.232] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2a522d7b, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x4e6dab1f, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.003.etl", cAlternateFileName="UP8247~1.ETL")) returned 1
	[0080.232] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2cbb43aa, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x5454d5b0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.004.etl", cAlternateFileName="UPD2FC~1.ETL")) returned 1
	[0080.232] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x60de6047, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x60de6047, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.005.etl", cAlternateFileName="UPB784~1.ETL")) returned 1
	[0080.232] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa72ae253, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xcb3f3780, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.006.etl", cAlternateFileName="UP7D55~1.ETL")) returned 1
	[0080.232] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x5ca8efbc, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x8784f695, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.007.etl", cAlternateFileName="UP52FC~1.ETL")) returned 1
	[0080.232] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4346f4fe, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4346f4fe, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.008.etl", cAlternateFileName="UPA721~1.ETL")) returned 1
	[0080.232] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x745a10f, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0x318cac0d, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.009.etl", cAlternateFileName="UPFC55~1.ETL")) returned 1
	[0080.236] WriteFile (in: hFile=0x2fc, lpBuffer=0x24fa400*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24fa400*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.238] WriteFile (in: hFile=0x2fc, lpBuffer=0x24fd6f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24fd6f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data", lpFilePart=0x0) returned 0x23
	[0080.241] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.242] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0080.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.242] CreateFileW (lpFileName="C:\\Users\\All Users\\Application Data\\Decrypt.txt" (normalized: "c:\\users\\all users\\application data\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.243] GetFileType (hFile=0x2fc) returned 0x1
	[0080.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.243] GetFileType (hFile=0x2fc) returned 0x1
	[0080.243] WriteFile (in: hFile=0x2fc, lpBuffer=0x2500814*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2500814*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.244] CloseHandle (hObject=0x2fc) returned 1
	[0080.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.244] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Comms", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Comms", lpFilePart=0x0) returned 0x18
	[0080.244] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Comms\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x698462e4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0080.245] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x698462e4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.245] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698462e4, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x698462e4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x698462e4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.245] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698462e4, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x698462e4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x698462e4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0080.245] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0080.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.245] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Comms", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Comms", lpFilePart=0x0) returned 0x18
	[0080.245] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Comms\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x698462e4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x698462e4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0080.246] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x698462e4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x698462e4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.246] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698462e4, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x698462e4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x698462e4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.246] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.246] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0080.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.246] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Comms\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Comms\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0080.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.246] CreateFileW (lpFileName="C:\\Users\\All Users\\Comms\\Decrypt.txt" (normalized: "c:\\users\\all users\\comms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.247] GetFileType (hFile=0x2fc) returned 0x1
	[0080.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.247] GetFileType (hFile=0x2fc) returned 0x1
	[0080.247] WriteFile (in: hFile=0x2fc, lpBuffer=0x2503940*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2503940*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.248] CloseHandle (hObject=0x2fc) returned 1
	[0080.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.248] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop", lpFilePart=0x0) returned 0x1a
	[0080.248] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.250] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop", lpFilePart=0x0) returned 0x1a
	[0080.250] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.251] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0080.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.251] CreateFileW (lpFileName="C:\\Users\\All Users\\Desktop\\Decrypt.txt" (normalized: "c:\\users\\all users\\desktop\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.252] GetFileType (hFile=0x2fc) returned 0x1
	[0080.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.252] GetFileType (hFile=0x2fc) returned 0x1
	[0080.252] WriteFile (in: hFile=0x2fc, lpBuffer=0x250693c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250693c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.253] CloseHandle (hObject=0x2fc) returned 1
	[0080.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.253] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents", lpFilePart=0x0) returned 0x1c
	[0080.253] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.254] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents", lpFilePart=0x0) returned 0x1c
	[0080.254] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.256] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0080.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.256] CreateFileW (lpFileName="C:\\Users\\All Users\\Documents\\Decrypt.txt" (normalized: "c:\\users\\all users\\documents\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.256] GetFileType (hFile=0x2fc) returned 0x1
	[0080.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.257] GetFileType (hFile=0x2fc) returned 0x1
	[0080.257] WriteFile (in: hFile=0x2fc, lpBuffer=0x2509980*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2509980*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.257] CloseHandle (hObject=0x2fc) returned 1
	[0080.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.257] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c
	[0080.258] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0080.258] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.258] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppV", cAlternateFileName="")) returned 1
	[0080.258] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1
	[0080.258] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0080.258] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1
	[0080.258] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69892805, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69892805, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.259] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1
	[0080.259] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1
	[0080.259] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1
	[0080.259] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1
	[0080.259] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0080.259] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1
	[0080.259] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1
	[0080.259] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1
	[0080.259] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1
	[0080.259] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1
	[0080.260] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0080.260] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1
	[0080.260] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1
	[0080.260] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1
	[0080.260] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1
	[0080.260] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1
	[0080.260] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1
	[0080.260] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1
	[0080.260] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1
	[0080.261] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1
	[0080.342] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1
	[0080.342] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1
	[0080.342] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0080.343] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0080.343] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1
	[0080.343] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1
	[0080.343] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1
	[0080.343] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1
	[0080.343] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1
	[0080.343] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1
	[0080.343] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.343] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0080.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.344] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c
	[0080.344] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69892805, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0080.344] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69892805, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.344] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppV", cAlternateFileName="")) returned 1
	[0080.344] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1
	[0080.344] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0080.344] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1
	[0080.345] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69892805, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69892805, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.345] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1
	[0080.345] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1
	[0080.345] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1
	[0080.345] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1
	[0080.345] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0080.345] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1
	[0080.345] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1
	[0080.346] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1
	[0080.346] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1
	[0080.346] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1
	[0080.346] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0080.346] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1
	[0080.346] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1
	[0080.346] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1
	[0080.347] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1
	[0080.347] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1
	[0080.347] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1
	[0080.347] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1
	[0080.347] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1
	[0080.347] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1
	[0080.347] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1
	[0080.347] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1
	[0080.348] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0080.348] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0080.348] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1
	[0080.348] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1
	[0080.348] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1
	[0080.348] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1
	[0080.348] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1
	[0080.348] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1
	[0080.349] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0
	[0080.349] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0080.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.349] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0080.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.349] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.350] GetFileType (hFile=0x2fc) returned 0x1
	[0080.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.350] GetFileType (hFile=0x2fc) returned 0x1
	[0080.350] WriteFile (in: hFile=0x2fc, lpBuffer=0x2511ac8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2511ac8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.351] CloseHandle (hObject=0x2fc) returned 1
	[0080.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.351] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft OneDrive", lpFilePart=0x0) returned 0x25
	[0080.351] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0080.351] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.351] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69892805, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69892805, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.351] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1
	[0080.351] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.351] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0080.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.352] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft OneDrive", lpFilePart=0x0) returned 0x25
	[0080.352] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69892805, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0080.352] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69892805, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.352] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69892805, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69892805, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.352] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1
	[0080.352] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 0
	[0080.352] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0080.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.352] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft OneDrive\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0080.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.353] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft onedrive\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.353] GetFileType (hFile=0x2fc) returned 0x1
	[0080.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.353] GetFileType (hFile=0x2fc) returned 0x1
	[0080.353] WriteFile (in: hFile=0x2fc, lpBuffer=0x25150dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25150dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.354] CloseHandle (hObject=0x2fc) returned 1
	[0080.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.355] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle", lpFilePart=0x0) returned 0x19
	[0080.355] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0080.355] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.355] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69892805, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69892805, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.355] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0080.355] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.355] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0080.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.355] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle", lpFilePart=0x0) returned 0x19
	[0080.355] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x69892805, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0080.356] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x69892805, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.356] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69892805, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69892805, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69892805, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.356] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0080.356] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0
	[0080.356] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0080.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.356] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0080.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.356] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Decrypt.txt" (normalized: "c:\\users\\all users\\oracle\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.357] GetFileType (hFile=0x2fc) returned 0x1
	[0080.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.357] GetFileType (hFile=0x2fc) returned 0x1
	[0080.357] WriteFile (in: hFile=0x2fc, lpBuffer=0x25183f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25183f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.358] CloseHandle (hObject=0x2fc) returned 1
	[0080.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.358] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache", lpFilePart=0x0) returned 0x20
	[0080.358] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x698d7997, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0080.358] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x698d7997, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.358] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x698d7997, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x698d7997, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.359] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1
	[0080.359] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1
	[0080.359] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1
	[0080.359] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1
	[0080.359] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1
	[0080.359] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1
	[0080.359] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1
	[0080.359] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1
	[0080.360] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1
	[0080.360] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1
	[0080.360] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1
	[0080.360] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1
	[0080.360] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1
	[0080.360] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1
	[0080.360] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1
	[0080.360] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1
	[0080.360] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1
	[0080.360] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1
	[0080.361] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.361] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0080.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.361] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache", lpFilePart=0x0) returned 0x20
	[0080.361] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x698d7997, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x698d7997, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0080.361] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x698d7997, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x698d7997, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.361] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x698d7997, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x698d7997, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.361] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1
	[0080.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1
	[0080.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1
	[0080.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1
	[0080.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1
	[0080.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1
	[0080.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1
	[0080.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1
	[0080.362] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1
	[0080.363] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1
	[0080.363] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1
	[0080.363] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1
	[0080.363] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1
	[0080.363] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1
	[0080.363] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1
	[0080.363] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1
	[0080.363] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1
	[0080.364] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1
	[0080.364] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0
	[0080.364] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0080.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.364] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0080.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.364] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.365] GetFileType (hFile=0x2fc) returned 0x1
	[0080.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.365] GetFileType (hFile=0x2fc) returned 0x1
	[0080.365] WriteFile (in: hFile=0x2fc, lpBuffer=0x2520450*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2520450*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.366] CloseHandle (hObject=0x2fc) returned 1
	[0080.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.366] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\regid.1991-06.com.microsoft", lpFilePart=0x0) returned 0x2e
	[0080.366] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0080.366] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.367] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6992ec67, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6992ec67, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.367] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 1
	[0080.367] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbfefc00, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 1
	[0080.367] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~4.SWI")) returned 1
	[0080.367] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 1
	[0080.367] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 0
	[0080.367] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0080.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.367] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\regid.1991-06.com.microsoft", lpFilePart=0x0) returned 0x2e
	[0080.367] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6992ec67, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0080.368] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6992ec67, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.368] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6992ec67, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6992ec67, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.368] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 1
	[0080.368] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbfefc00, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 1
	[0080.368] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~4.SWI")) returned 1
	[0080.368] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 1
	[0080.368] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.368] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0080.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.368] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0080.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.368] CreateFileW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\Decrypt.txt" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.369] GetFileType (hFile=0x2fc) returned 0x1
	[0080.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.369] GetFileType (hFile=0x2fc) returned 0x1
	[0080.369] WriteFile (in: hFile=0x2fc, lpBuffer=0x25252b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25252b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.370] CloseHandle (hObject=0x2fc) returned 1
	[0080.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.370] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\SoftwareDistribution", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\SoftwareDistribution", lpFilePart=0x0) returned 0x27
	[0080.370] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\SoftwareDistribution\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0080.371] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.371] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6992ec67, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6992ec67, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.371] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6992ec67, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6992ec67, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0080.371] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0080.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.371] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\SoftwareDistribution", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\SoftwareDistribution", lpFilePart=0x0) returned 0x27
	[0080.371] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\SoftwareDistribution\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6992ec67, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.371] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6992ec67, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.371] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6992ec67, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6992ec67, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6992ec67, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.371] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.371] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.372] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\SoftwareDistribution\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\SoftwareDistribution\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0080.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.372] CreateFileW (lpFileName="C:\\Users\\All Users\\SoftwareDistribution\\Decrypt.txt" (normalized: "c:\\users\\all users\\softwaredistribution\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2fc
	[0080.372] GetFileType (hFile=0x2fc) returned 0x1
	[0080.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.372] GetFileType (hFile=0x2fc) returned 0x1
	[0080.373] WriteFile (in: hFile=0x2fc, lpBuffer=0x2528704*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2528704*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.373] CloseHandle (hObject=0x2fc) returned 1
	[0080.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.373] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Start Menu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Start Menu", lpFilePart=0x0) returned 0x1d
	[0080.373] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.375] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Start Menu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Start Menu", lpFilePart=0x0) returned 0x1d
	[0080.375] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.376] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Start Menu\\Decrypt.txt", lpFilePart=0x0) returned 0x29
	[0080.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.376] CreateFileW (lpFileName="C:\\Users\\All Users\\Start Menu\\Decrypt.txt" (normalized: "c:\\users\\all users\\start menu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.465] GetFileType (hFile=0x5dc) returned 0x1
	[0080.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.465] GetFileType (hFile=0x5dc) returned 0x1
	[0080.465] WriteFile (in: hFile=0x5dc, lpBuffer=0x252b748*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x252b748*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.466] CloseHandle (hObject=0x5dc) returned 1
	[0080.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.566] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates", lpFilePart=0x0) returned 0x1c
	[0080.566] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.568] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates", lpFilePart=0x0) returned 0x1c
	[0080.568] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0080.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.569] CreateFileW (lpFileName="C:\\Users\\All Users\\Templates\\Decrypt.txt" (normalized: "c:\\users\\all users\\templates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.570] GetFileType (hFile=0x5dc) returned 0x1
	[0080.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.570] GetFileType (hFile=0x5dc) returned 0x1
	[0080.570] WriteFile (in: hFile=0x5dc, lpBuffer=0x252e900*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x252e900*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.571] CloseHandle (hObject=0x5dc) returned 1
	[0080.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.571] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOPrivate", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOPrivate", lpFilePart=0x0) returned 0x1d
	[0080.571] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69954fc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0080.571] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69954fc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.572] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69954fc9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69954fc9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69954fc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.572] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x668a40e9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 1
	[0080.572] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.572] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0080.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.572] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOPrivate", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOPrivate", lpFilePart=0x0) returned 0x1d
	[0080.572] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69954fc9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69954fc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0080.572] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69954fc9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69954fc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.573] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69954fc9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69954fc9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69954fc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.573] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x668a40e9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 1
	[0080.573] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x668a40e9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 0
	[0080.573] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0080.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.573] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOPrivate\\Decrypt.txt", lpFilePart=0x0) returned 0x29
	[0080.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.573] CreateFileW (lpFileName="C:\\Users\\All Users\\USOPrivate\\Decrypt.txt" (normalized: "c:\\users\\all users\\usoprivate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.574] GetFileType (hFile=0x5dc) returned 0x1
	[0080.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.574] GetFileType (hFile=0x5dc) returned 0x1
	[0080.575] WriteFile (in: hFile=0x5dc, lpBuffer=0x2531dc8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2531dc8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.575] CloseHandle (hObject=0x5dc) returned 1
	[0080.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.576] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared", lpFilePart=0x0) returned 0x1c
	[0080.576] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOShared\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69954fc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.576] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69954fc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.576] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69954fc9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69954fc9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69954fc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.576] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x56ec7d41, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x56ec7d41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0080.576] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.576] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.577] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared", lpFilePart=0x0) returned 0x1c
	[0080.577] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOShared\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69954fc9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69954fc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0080.577] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69954fc9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69954fc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.577] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69954fc9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69954fc9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69954fc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0080.577] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x56ec7d41, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x56ec7d41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0080.577] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x56ec7d41, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x56ec7d41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 0
	[0080.577] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0080.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.577] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0080.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.577] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Decrypt.txt" (normalized: "c:\\users\\all users\\usoshared\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.578] GetFileType (hFile=0x5dc) returned 0x1
	[0080.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.578] GetFileType (hFile=0x5dc) returned 0x1
	[0080.578] WriteFile (in: hFile=0x5dc, lpBuffer=0x25351bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25351bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.579] CloseHandle (hObject=0x5dc) returned 1
	[0080.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.579] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData", lpFilePart=0x0) returned 0x18
	[0080.579] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0080.580] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.580] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0080.580] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1
	[0080.580] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.580] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0080.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.580] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData", lpFilePart=0x0) returned 0x18
	[0080.580] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0080.580] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.581] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0080.581] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1
	[0080.581] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0
	[0080.581] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0080.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.581] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0080.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.581] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.581] GetFileType (hFile=0x5dc) returned 0x1
	[0080.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.581] GetFileType (hFile=0x5dc) returned 0x1
	[0080.581] WriteFile (in: hFile=0x5dc, lpBuffer=0x2538478*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2538478*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.582] CloseHandle (hObject=0x5dc) returned 1
	[0080.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.582] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Application Data", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Application Data", lpFilePart=0x0) returned 0x21
	[0080.582] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.584] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Application Data", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Application Data", lpFilePart=0x0) returned 0x21
	[0080.584] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.585] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Application Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Application Data\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0080.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.585] CreateFileW (lpFileName="C:\\Users\\Default\\Application Data\\Decrypt.txt" (normalized: "c:\\users\\default\\application data\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.586] GetFileType (hFile=0x5dc) returned 0x1
	[0080.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.586] GetFileType (hFile=0x5dc) returned 0x1
	[0080.586] WriteFile (in: hFile=0x5dc, lpBuffer=0x253b54c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253b54c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.623] CloseHandle (hObject=0x5dc) returned 1
	[0080.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.623] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Cookies", lpFilePart=0x0) returned 0x18
	[0080.623] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.624] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Cookies", lpFilePart=0x0) returned 0x18
	[0080.624] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.625] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Cookies\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Cookies\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0080.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.626] CreateFileW (lpFileName="C:\\Users\\Default\\Cookies\\Decrypt.txt" (normalized: "c:\\users\\default\\cookies\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.634] GetFileType (hFile=0x5dc) returned 0x1
	[0080.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.634] GetFileType (hFile=0x5dc) returned 0x1
	[0080.635] WriteFile (in: hFile=0x5dc, lpBuffer=0x253e500*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253e500*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.636] CloseHandle (hObject=0x5dc) returned 1
	[0080.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.636] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Desktop", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop", lpFilePart=0x0) returned 0x18
	[0080.636] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0080.636] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.637] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.637] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0080.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.637] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Desktop", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop", lpFilePart=0x0) returned 0x18
	[0080.637] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.637] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.637] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.638] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.638] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Desktop\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0080.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.638] CreateFileW (lpFileName="C:\\Users\\Default\\Desktop\\Decrypt.txt" (normalized: "c:\\users\\default\\desktop\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.638] GetFileType (hFile=0x5dc) returned 0x1
	[0080.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.638] GetFileType (hFile=0x5dc) returned 0x1
	[0080.638] WriteFile (in: hFile=0x5dc, lpBuffer=0x2541404*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2541404*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.640] CloseHandle (hObject=0x5dc) returned 1
	[0080.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.640] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents", lpFilePart=0x0) returned 0x1a
	[0080.640] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0080.693] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.694] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0080.694] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0080.729] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0080.730] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.730] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0080.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.731] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents", lpFilePart=0x0) returned 0x1a
	[0080.731] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0080.731] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.732] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0080.732] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0080.732] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0080.732] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0
	[0080.732] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0080.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.733] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0080.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.733] CreateFileW (lpFileName="C:\\Users\\Default\\Documents\\Decrypt.txt" (normalized: "c:\\users\\default\\documents\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.735] GetFileType (hFile=0x5dc) returned 0x1
	[0080.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.736] GetFileType (hFile=0x5dc) returned 0x1
	[0080.736] WriteFile (in: hFile=0x5dc, lpBuffer=0x2544b3c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2544b3c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.736] CloseHandle (hObject=0x5dc) returned 1
	[0080.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.737] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Downloads", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads", lpFilePart=0x0) returned 0x1a
	[0080.737] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0080.737] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.737] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.737] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0080.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.737] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Downloads", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads", lpFilePart=0x0) returned 0x1a
	[0080.737] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0080.738] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.738] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.738] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0080.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.738] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Downloads\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0080.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.738] CreateFileW (lpFileName="C:\\Users\\Default\\Downloads\\Decrypt.txt" (normalized: "c:\\users\\default\\downloads\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.738] GetFileType (hFile=0x5dc) returned 0x1
	[0080.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.738] GetFileType (hFile=0x5dc) returned 0x1
	[0080.738] WriteFile (in: hFile=0x5dc, lpBuffer=0x2547aa0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2547aa0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.739] CloseHandle (hObject=0x5dc) returned 1
	[0080.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.739] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites", lpFilePart=0x0) returned 0x1a
	[0080.739] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0080.740] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.740] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.740] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0080.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.740] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites", lpFilePart=0x0) returned 0x1a
	[0080.740] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0080.741] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.741] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.741] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0080.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.741] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0080.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.741] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Decrypt.txt" (normalized: "c:\\users\\default\\favorites\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.741] GetFileType (hFile=0x5dc) returned 0x1
	[0080.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.741] GetFileType (hFile=0x5dc) returned 0x1
	[0080.741] WriteFile (in: hFile=0x5dc, lpBuffer=0x254aa04*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254aa04*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.742] CloseHandle (hObject=0x5dc) returned 1
	[0080.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.742] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Links", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links", lpFilePart=0x0) returned 0x16
	[0080.742] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0080.743] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.743] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.743] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0080.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.743] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Links", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links", lpFilePart=0x0) returned 0x16
	[0080.743] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0080.743] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.744] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.744] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0080.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.744] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Links\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0080.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.744] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Decrypt.txt" (normalized: "c:\\users\\default\\links\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.744] GetFileType (hFile=0x5dc) returned 0x1
	[0080.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.745] GetFileType (hFile=0x5dc) returned 0x1
	[0080.745] WriteFile (in: hFile=0x5dc, lpBuffer=0x254d8a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254d8a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.746] CloseHandle (hObject=0x5dc) returned 1
	[0080.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.746] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Local Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Local Settings", lpFilePart=0x0) returned 0x1f
	[0080.746] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.747] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Local Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Local Settings", lpFilePart=0x0) returned 0x1f
	[0080.747] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.748] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Local Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Local Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0080.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.748] CreateFileW (lpFileName="C:\\Users\\Default\\Local Settings\\Decrypt.txt" (normalized: "c:\\users\\default\\local settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.749] GetFileType (hFile=0x5dc) returned 0x1
	[0080.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.749] GetFileType (hFile=0x5dc) returned 0x1
	[0080.749] WriteFile (in: hFile=0x5dc, lpBuffer=0x2550934*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2550934*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.750] CloseHandle (hObject=0x5dc) returned 1
	[0080.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.750] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music", lpFilePart=0x0) returned 0x16
	[0080.750] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0080.751] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.751] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.751] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0080.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.751] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music", lpFilePart=0x0) returned 0x16
	[0080.751] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0080.751] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.752] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.752] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0080.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.752] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0080.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.752] CreateFileW (lpFileName="C:\\Users\\Default\\Music\\Decrypt.txt" (normalized: "c:\\users\\default\\music\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.752] GetFileType (hFile=0x5dc) returned 0x1
	[0080.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.752] GetFileType (hFile=0x5dc) returned 0x1
	[0080.752] WriteFile (in: hFile=0x5dc, lpBuffer=0x25537d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25537d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.753] CloseHandle (hObject=0x5dc) returned 1
	[0080.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.753] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\My Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\My Documents", lpFilePart=0x0) returned 0x1d
	[0080.753] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.754] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\My Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\My Documents", lpFilePart=0x0) returned 0x1d
	[0080.754] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.755] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\My Documents\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\My Documents\\Decrypt.txt", lpFilePart=0x0) returned 0x29
	[0080.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.756] CreateFileW (lpFileName="C:\\Users\\Default\\My Documents\\Decrypt.txt" (normalized: "c:\\users\\default\\my documents\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.756] GetFileType (hFile=0x5dc) returned 0x1
	[0080.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.756] GetFileType (hFile=0x5dc) returned 0x1
	[0080.756] WriteFile (in: hFile=0x5dc, lpBuffer=0x255681c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255681c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.757] CloseHandle (hObject=0x5dc) returned 1
	[0080.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.757] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NetHood", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NetHood", lpFilePart=0x0) returned 0x18
	[0080.757] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.758] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NetHood", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NetHood", lpFilePart=0x0) returned 0x18
	[0080.759] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.760] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NetHood\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NetHood\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0080.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.760] CreateFileW (lpFileName="C:\\Users\\Default\\NetHood\\Decrypt.txt" (normalized: "c:\\users\\default\\nethood\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.772] GetFileType (hFile=0x5dc) returned 0x1
	[0080.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.772] GetFileType (hFile=0x5dc) returned 0x1
	[0080.772] WriteFile (in: hFile=0x5dc, lpBuffer=0x25597d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25597d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.773] CloseHandle (hObject=0x5dc) returned 1
	[0080.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.773] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures", lpFilePart=0x0) returned 0x19
	[0080.773] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0080.774] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.774] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.774] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0080.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.774] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures", lpFilePart=0x0) returned 0x19
	[0080.774] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0080.774] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.774] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.774] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0080.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.775] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0080.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.775] CreateFileW (lpFileName="C:\\Users\\Default\\Pictures\\Decrypt.txt" (normalized: "c:\\users\\default\\pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.775] GetFileType (hFile=0x5dc) returned 0x1
	[0080.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.775] GetFileType (hFile=0x5dc) returned 0x1
	[0080.775] WriteFile (in: hFile=0x5dc, lpBuffer=0x255c6e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255c6e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.776] CloseHandle (hObject=0x5dc) returned 1
	[0080.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.776] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\PrintHood", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\PrintHood", lpFilePart=0x0) returned 0x1a
	[0080.776] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.779] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\PrintHood", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\PrintHood", lpFilePart=0x0) returned 0x1a
	[0080.779] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.780] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\PrintHood\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\PrintHood\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0080.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.780] CreateFileW (lpFileName="C:\\Users\\Default\\PrintHood\\Decrypt.txt" (normalized: "c:\\users\\default\\printhood\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.780] GetFileType (hFile=0x5dc) returned 0x1
	[0080.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.780] GetFileType (hFile=0x5dc) returned 0x1
	[0080.780] WriteFile (in: hFile=0x5dc, lpBuffer=0x255f6e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255f6e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.781] CloseHandle (hObject=0x5dc) returned 1
	[0080.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.781] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent", lpFilePart=0x0) returned 0x17
	[0080.781] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.782] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent", lpFilePart=0x0) returned 0x17
	[0080.783] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.784] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent\\Decrypt.txt", lpFilePart=0x0) returned 0x23
	[0080.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.784] CreateFileW (lpFileName="C:\\Users\\Default\\Recent\\Decrypt.txt" (normalized: "c:\\users\\default\\recent\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.785] GetFileType (hFile=0x5dc) returned 0x1
	[0080.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.785] GetFileType (hFile=0x5dc) returned 0x1
	[0080.785] WriteFile (in: hFile=0x5dc, lpBuffer=0x256264c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256264c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.786] CloseHandle (hObject=0x5dc) returned 1
	[0080.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.786] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games", lpFilePart=0x0) returned 0x1c
	[0080.786] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0080.786] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.787] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.787] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0080.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.787] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games", lpFilePart=0x0) returned 0x1c
	[0080.787] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0080.787] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.787] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.787] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0080.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.787] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0080.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.788] CreateFileW (lpFileName="C:\\Users\\Default\\Saved Games\\Decrypt.txt" (normalized: "c:\\users\\default\\saved games\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.788] GetFileType (hFile=0x5dc) returned 0x1
	[0080.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.788] GetFileType (hFile=0x5dc) returned 0x1
	[0080.788] WriteFile (in: hFile=0x5dc, lpBuffer=0x2565610*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2565610*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.789] CloseHandle (hObject=0x5dc) returned 1
	[0080.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.789] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\SendTo", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\SendTo", lpFilePart=0x0) returned 0x17
	[0080.789] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.790] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\SendTo", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\SendTo", lpFilePart=0x0) returned 0x17
	[0080.790] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.791] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\SendTo\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\SendTo\\Decrypt.txt", lpFilePart=0x0) returned 0x23
	[0080.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.791] CreateFileW (lpFileName="C:\\Users\\Default\\SendTo\\Decrypt.txt" (normalized: "c:\\users\\default\\sendto\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.875] GetFileType (hFile=0x5dc) returned 0x1
	[0080.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.875] GetFileType (hFile=0x5dc) returned 0x1
	[0080.875] WriteFile (in: hFile=0x5dc, lpBuffer=0x25686f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25686f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.876] CloseHandle (hObject=0x5dc) returned 1
	[0080.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.876] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Start Menu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Start Menu", lpFilePart=0x0) returned 0x1b
	[0080.876] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.878] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Start Menu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Start Menu", lpFilePart=0x0) returned 0x1b
	[0080.878] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.879] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Start Menu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Start Menu\\Decrypt.txt", lpFilePart=0x0) returned 0x27
	[0080.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.879] CreateFileW (lpFileName="C:\\Users\\Default\\Start Menu\\Decrypt.txt" (normalized: "c:\\users\\default\\start menu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.880] GetFileType (hFile=0x5dc) returned 0x1
	[0080.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.880] GetFileType (hFile=0x5dc) returned 0x1
	[0080.880] WriteFile (in: hFile=0x5dc, lpBuffer=0x256b6ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256b6ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.881] CloseHandle (hObject=0x5dc) returned 1
	[0080.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.881] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Templates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Templates", lpFilePart=0x0) returned 0x1a
	[0080.881] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.883] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Templates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Templates", lpFilePart=0x0) returned 0x1a
	[0080.883] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0080.884] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0080.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.884] CreateFileW (lpFileName="C:\\Users\\Default\\Templates\\Decrypt.txt" (normalized: "c:\\users\\default\\templates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.886] GetFileType (hFile=0x5dc) returned 0x1
	[0080.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.886] GetFileType (hFile=0x5dc) returned 0x1
	[0080.886] WriteFile (in: hFile=0x5dc, lpBuffer=0x256e6e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256e6e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.887] CloseHandle (hObject=0x5dc) returned 1
	[0080.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.887] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos", lpFilePart=0x0) returned 0x17
	[0080.887] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0080.888] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.888] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.888] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0080.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.888] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos", lpFilePart=0x0) returned 0x17
	[0080.888] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0080.888] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.888] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.888] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0080.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.889] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\Decrypt.txt", lpFilePart=0x0) returned 0x23
	[0080.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.889] CreateFileW (lpFileName="C:\\Users\\Default\\Videos\\Decrypt.txt" (normalized: "c:\\users\\default\\videos\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.889] GetFileType (hFile=0x5dc) returned 0x1
	[0080.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.889] GetFileType (hFile=0x5dc) returned 0x1
	[0080.889] WriteFile (in: hFile=0x5dc, lpBuffer=0x257159c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257159c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.890] CloseHandle (hObject=0x5dc) returned 1
	[0080.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.890] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData", lpFilePart=0x0) returned 0x21
	[0080.890] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0080.890] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.890] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0080.891] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.891] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0080.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.891] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData", lpFilePart=0x0) returned 0x21
	[0080.891] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0080.891] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.891] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0080.891] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0
	[0080.892] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0080.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0080.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0080.892] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0080.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0080.892] CreateFileW (lpFileName="C:\\Users\\Default.migrated\\AppData\\Decrypt.txt" (normalized: "c:\\users\\default.migrated\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.892] GetFileType (hFile=0x5dc) returned 0x1
	[0080.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0080.892] GetFileType (hFile=0x5dc) returned 0x1
	[0080.892] WriteFile (in: hFile=0x5dc, lpBuffer=0x2574844*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2574844*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.893] CloseHandle (hObject=0x5dc) returned 1
	[0080.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.893] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents", lpFilePart=0x0) returned 0x23
	[0080.893] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0080.895] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.895] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99a3d0f, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99a3d0f, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99a3d0f, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0080.896] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0080.896] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0080.896] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.896] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0080.897] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents", lpFilePart=0x0) returned 0x23
	[0080.897] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0080.898] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.898] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99a3d0f, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99a3d0f, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99a3d0f, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0080.898] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0080.898] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0080.899] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0
	[0080.899] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0080.899] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0080.899] CreateFileW (lpFileName="C:\\Users\\Default.migrated\\Documents\\Decrypt.txt" (normalized: "c:\\users\\default.migrated\\documents\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.900] GetFileType (hFile=0x5dc) returned 0x1
	[0080.900] GetFileType (hFile=0x5dc) returned 0x1
	[0080.900] WriteFile (in: hFile=0x5dc, lpBuffer=0x257811c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257811c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.902] CloseHandle (hObject=0x5dc) returned 1
	[0080.902] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData", lpFilePart=0x0) returned 0x17
	[0080.902] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0080.902] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.903] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0080.903] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1
	[0080.903] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3d67de40, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d67de40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1
	[0080.903] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.903] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0080.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData", lpFilePart=0x0) returned 0x17
	[0080.903] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0080.904] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.904] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0080.904] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1
	[0080.904] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3d67de40, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d67de40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1
	[0080.904] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3d67de40, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d67de40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0
	[0080.904] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0080.904] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x23
	[0080.904] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0080.905] GetFileType (hFile=0x5dc) returned 0x1
	[0080.905] GetFileType (hFile=0x5dc) returned 0x1
	[0080.905] WriteFile (in: hFile=0x5dc, lpBuffer=0x257b550*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257b550*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0080.914] CloseHandle (hObject=0x5dc) returned 1
	[0080.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Application Data", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Application Data", lpFilePart=0x0) returned 0x20
	[0080.914] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Application Data\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0080.916] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Application Data", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Application Data", lpFilePart=0x0) returned 0x20
	[0080.916] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Application Data\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0080.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.085] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Application Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Application Data\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0081.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.085] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Application Data\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\application data\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.086] GetFileType (hFile=0x5dc) returned 0x1
	[0081.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.086] GetFileType (hFile=0x5dc) returned 0x1
	[0081.086] WriteFile (in: hFile=0x5dc, lpBuffer=0x257e6e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257e6e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.087] CloseHandle (hObject=0x5dc) returned 1
	[0081.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.087] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts", lpFilePart=0x0) returned 0x18
	[0081.087] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0081.087] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.087] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.087] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0081.088] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0081.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts", lpFilePart=0x0) returned 0x18
	[0081.088] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0081.088] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.088] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.088] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0081.088] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0081.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0081.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.088] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Contacts\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\contacts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.089] GetFileType (hFile=0x5dc) returned 0x1
	[0081.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.089] GetFileType (hFile=0x5dc) returned 0x1
	[0081.089] WriteFile (in: hFile=0x5dc, lpBuffer=0x2581810*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2581810*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.090] CloseHandle (hObject=0x5dc) returned 1
	[0081.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.090] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Cookies", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Cookies", lpFilePart=0x0) returned 0x17
	[0081.090] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Cookies\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.091] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Cookies", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Cookies", lpFilePart=0x0) returned 0x17
	[0081.091] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Cookies\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.092] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Cookies\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Cookies\\Decrypt.txt", lpFilePart=0x0) returned 0x23
	[0081.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.092] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Cookies\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\cookies\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.093] GetFileType (hFile=0x5dc) returned 0x1
	[0081.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.093] GetFileType (hFile=0x5dc) returned 0x1
	[0081.093] WriteFile (in: hFile=0x5dc, lpBuffer=0x258477c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258477c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.094] CloseHandle (hObject=0x5dc) returned 1
	[0081.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17
	[0081.094] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x68ae9cba, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x68ae9cba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0081.095] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x68ae9cba, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x68ae9cba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.095] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff0f2840, ftCreationTime.dwHighDateTime=0x1d4ce61, ftLastAccessTime.dwLowDateTime=0x24e06720, ftLastAccessTime.dwHighDateTime=0x1d4c695, ftLastWriteTime.dwLowDateTime=0x24e06720, ftLastWriteTime.dwHighDateTime=0x1d4c695, nFileSizeHigh=0x0, nFileSizeLow=0x13fce, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Fd4.jpg", cAlternateFileName="")) returned 1
	[0081.095] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c226fc0, ftCreationTime.dwHighDateTime=0x1d4c587, ftLastAccessTime.dwLowDateTime=0xc6458b00, ftLastAccessTime.dwHighDateTime=0x1d4c6df, ftLastWriteTime.dwLowDateTime=0xc6458b00, ftLastWriteTime.dwHighDateTime=0x1d4c6df, nFileSizeHigh=0x0, nFileSizeLow=0x7936, dwReserved0=0x0, dwReserved1=0x0, cFileName="1jyyCyb1J0US8YYH.odp", cAlternateFileName="1JYYCY~1.ODP")) returned 1
	[0081.095] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f519bf0, ftCreationTime.dwHighDateTime=0x1d4cfae, ftLastAccessTime.dwLowDateTime=0xdeef630, ftLastAccessTime.dwHighDateTime=0x1d4cb9f, ftLastWriteTime.dwLowDateTime=0xdeef630, ftLastWriteTime.dwHighDateTime=0x1d4cb9f, nFileSizeHigh=0x0, nFileSizeLow=0xdda7, dwReserved0=0x0, dwReserved1=0x0, cFileName="3aRfQcCqfFVV7a3Vj_l.pdf", cAlternateFileName="3ARFQC~1.PDF")) returned 1
	[0081.095] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914ea0c0, ftCreationTime.dwHighDateTime=0x1d4ca0a, ftLastAccessTime.dwLowDateTime=0xe59de980, ftLastAccessTime.dwHighDateTime=0x1d4cdf5, ftLastWriteTime.dwLowDateTime=0xe59de980, ftLastWriteTime.dwHighDateTime=0x1d4cdf5, nFileSizeHigh=0x0, nFileSizeLow=0x2cf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="4T98.bmp", cAlternateFileName="")) returned 1
	[0081.095] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4499fe0, ftCreationTime.dwHighDateTime=0x1d4cc01, ftLastAccessTime.dwLowDateTime=0xc452dc20, ftLastAccessTime.dwHighDateTime=0x1d4cec9, ftLastWriteTime.dwLowDateTime=0xc452dc20, ftLastWriteTime.dwHighDateTime=0x1d4cec9, nFileSizeHigh=0x0, nFileSizeLow=0xed63, dwReserved0=0x0, dwReserved1=0x0, cFileName="5k9Won_0Uoz.mp3", cAlternateFileName="5K9WON~1.MP3")) returned 1
	[0081.095] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe836fc60, ftCreationTime.dwHighDateTime=0x1d4cbaf, ftLastAccessTime.dwLowDateTime=0xee7816b0, ftLastAccessTime.dwHighDateTime=0x1d4ca7c, ftLastWriteTime.dwLowDateTime=0xee7816b0, ftLastWriteTime.dwHighDateTime=0x1d4ca7c, nFileSizeHigh=0x0, nFileSizeLow=0x98f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="6khbqV.mkv", cAlternateFileName="")) returned 1
	[0081.096] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf7730, ftCreationTime.dwHighDateTime=0x1d4cd38, ftLastAccessTime.dwLowDateTime=0x51cda410, ftLastAccessTime.dwHighDateTime=0x1d4cc48, ftLastWriteTime.dwLowDateTime=0x51cda410, ftLastWriteTime.dwHighDateTime=0x1d4cc48, nFileSizeHigh=0x0, nFileSizeLow=0x108e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="7jKTglHESAR.pdf", cAlternateFileName="7JKTGL~1.PDF")) returned 1
	[0081.096] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfdf06c0, ftCreationTime.dwHighDateTime=0x1d4c643, ftLastAccessTime.dwLowDateTime=0xe19e3270, ftLastAccessTime.dwHighDateTime=0x1d4c87f, ftLastWriteTime.dwLowDateTime=0xe19e3270, ftLastWriteTime.dwHighDateTime=0x1d4c87f, nFileSizeHigh=0x0, nFileSizeLow=0xcf41, dwReserved0=0x0, dwReserved1=0x0, cFileName="7LU2JGBdHQCis7U.ods", cAlternateFileName="7LU2JG~1.ODS")) returned 1
	[0081.096] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd5753d0, ftCreationTime.dwHighDateTime=0x1d4cba8, ftLastAccessTime.dwLowDateTime=0xeaf29620, ftLastAccessTime.dwHighDateTime=0x1d4d353, ftLastWriteTime.dwLowDateTime=0xeaf29620, ftLastWriteTime.dwHighDateTime=0x1d4d353, nFileSizeHigh=0x0, nFileSizeLow=0x15769, dwReserved0=0x0, dwReserved1=0x0, cFileName="96gW8USB HTonl.m4a", cAlternateFileName="96GW8U~1.M4A")) returned 1
	[0081.096] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fd6c00, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x39960280, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3438b800, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConsoleApp1.exe", cAlternateFileName="CONSOL~1.EXE")) returned 1
	[0081.096] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49eee6f0, ftCreationTime.dwHighDateTime=0x1d4c7f7, ftLastAccessTime.dwLowDateTime=0xa58cee60, ftLastAccessTime.dwHighDateTime=0x1d4cdad, ftLastWriteTime.dwLowDateTime=0xa58cee60, ftLastWriteTime.dwHighDateTime=0x1d4cdad, nFileSizeHigh=0x0, nFileSizeLow=0x8b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cQEkAMxQKtM-svsehDa.jpg", cAlternateFileName="CQEKAM~1.JPG")) returned 1
	[0081.096] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.096] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb95d5750, ftCreationTime.dwHighDateTime=0x1d4cdd4, ftLastAccessTime.dwLowDateTime=0x78307ba0, ftLastAccessTime.dwHighDateTime=0x1d4cabd, ftLastWriteTime.dwLowDateTime=0x78307ba0, ftLastWriteTime.dwHighDateTime=0x1d4cabd, nFileSizeHigh=0x0, nFileSizeLow=0x7f53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fe4GZlNGOX.bmp", cAlternateFileName="FE4GZL~1.BMP")) returned 1
	[0081.096] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd714940, ftCreationTime.dwHighDateTime=0x1d4d203, ftLastAccessTime.dwLowDateTime=0xecf5f850, ftLastAccessTime.dwHighDateTime=0x1d4c6ff, ftLastWriteTime.dwLowDateTime=0xecf5f850, ftLastWriteTime.dwHighDateTime=0x1d4c6ff, nFileSizeHigh=0x0, nFileSizeLow=0x11dad, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrcQWnKHPKeGPUJM.xlsx", cAlternateFileName="FRCQWN~1.XLS")) returned 1
	[0081.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2210740, ftCreationTime.dwHighDateTime=0x1d4cc39, ftLastAccessTime.dwLowDateTime=0x9448d50, ftLastAccessTime.dwHighDateTime=0x1d4d2b8, ftLastWriteTime.dwLowDateTime=0x9448d50, ftLastWriteTime.dwHighDateTime=0x1d4d2b8, nFileSizeHigh=0x0, nFileSizeLow=0x434b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hO2Z9_0A6mYFb.mp3", cAlternateFileName="HO2Z9_~1.MP3")) returned 1
	[0081.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c0bb170, ftCreationTime.dwHighDateTime=0x1d4c772, ftLastAccessTime.dwLowDateTime=0x594775b0, ftLastAccessTime.dwHighDateTime=0x1d4c755, ftLastWriteTime.dwLowDateTime=0x594775b0, ftLastWriteTime.dwHighDateTime=0x1d4c755, nFileSizeHigh=0x0, nFileSizeLow=0x43bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="icQK5B2A00F9_ZXOr.jpg", cAlternateFileName="ICQK5B~1.JPG")) returned 1
	[0081.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e534060, ftCreationTime.dwHighDateTime=0x1d4d3bb, ftLastAccessTime.dwLowDateTime=0x60d71ac0, ftLastAccessTime.dwHighDateTime=0x1d4d4a1, ftLastWriteTime.dwLowDateTime=0x60d71ac0, ftLastWriteTime.dwHighDateTime=0x1d4d4a1, nFileSizeHigh=0x0, nFileSizeLow=0x702b, dwReserved0=0x0, dwReserved1=0x0, cFileName="IV5ALBjbsW7-YByVU.flv", cAlternateFileName="IV5ALB~1.FLV")) returned 1
	[0081.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65ef5270, ftCreationTime.dwHighDateTime=0x1d4d550, ftLastAccessTime.dwLowDateTime=0x170ba110, ftLastAccessTime.dwHighDateTime=0x1d4ccfc, ftLastWriteTime.dwLowDateTime=0x170ba110, ftLastWriteTime.dwHighDateTime=0x1d4ccfc, nFileSizeHigh=0x0, nFileSizeLow=0xe199, dwReserved0=0x0, dwReserved1=0x0, cFileName="j 69tU.avi", cAlternateFileName="J69TU~1.AVI")) returned 1
	[0081.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x539ed80, ftCreationTime.dwHighDateTime=0x1d4cd05, ftLastAccessTime.dwLowDateTime=0x4814820, ftLastAccessTime.dwHighDateTime=0x1d4d3e5, ftLastWriteTime.dwLowDateTime=0x4814820, ftLastWriteTime.dwHighDateTime=0x1d4d3e5, nFileSizeHigh=0x0, nFileSizeLow=0x3929, dwReserved0=0x0, dwReserved1=0x0, cFileName="j IUnUdt48.mp3", cAlternateFileName="JIUNUD~1.MP3")) returned 1
	[0081.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25d97f50, ftCreationTime.dwHighDateTime=0x1d4c865, ftLastAccessTime.dwLowDateTime=0xd6797250, ftLastAccessTime.dwHighDateTime=0x1d4cae2, ftLastWriteTime.dwLowDateTime=0xd6797250, ftLastWriteTime.dwHighDateTime=0x1d4cae2, nFileSizeHigh=0x0, nFileSizeLow=0x11c32, dwReserved0=0x0, dwReserved1=0x0, cFileName="J-1OVxTZq4djuzTyM.flv", cAlternateFileName="J-1OVX~1.FLV")) returned 1
	[0081.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb673d820, ftCreationTime.dwHighDateTime=0x1d4cfe6, ftLastAccessTime.dwLowDateTime=0xb2abaa20, ftLastAccessTime.dwHighDateTime=0x1d4cb94, ftLastWriteTime.dwLowDateTime=0xb2abaa20, ftLastWriteTime.dwHighDateTime=0x1d4cb94, nFileSizeHigh=0x0, nFileSizeLow=0x6156, dwReserved0=0x0, dwReserved1=0x0, cFileName="jCr9qMg8.png", cAlternateFileName="")) returned 1
	[0081.098] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78965270, ftCreationTime.dwHighDateTime=0x1d4cfd8, ftLastAccessTime.dwLowDateTime=0xa8d2b680, ftLastAccessTime.dwHighDateTime=0x1d4c7fa, ftLastWriteTime.dwLowDateTime=0xa8d2b680, ftLastWriteTime.dwHighDateTime=0x1d4c7fa, nFileSizeHigh=0x0, nFileSizeLow=0x10a0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="KmA2QeehMp.jpg", cAlternateFileName="KMA2QE~1.JPG")) returned 1
	[0081.098] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8bff70, ftCreationTime.dwHighDateTime=0x1d4d0f9, ftLastAccessTime.dwLowDateTime=0x56f45510, ftLastAccessTime.dwHighDateTime=0x1d4cff4, ftLastWriteTime.dwLowDateTime=0x56f45510, ftLastWriteTime.dwHighDateTime=0x1d4cff4, nFileSizeHigh=0x0, nFileSizeLow=0x176eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="mFFKQCIs7xI7UoP9.gif", cAlternateFileName="MFFKQC~1.GIF")) returned 1
	[0081.098] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2110e0, ftCreationTime.dwHighDateTime=0x1d4d13f, ftLastAccessTime.dwLowDateTime=0xfc15c000, ftLastAccessTime.dwHighDateTime=0x1d4c91f, ftLastWriteTime.dwLowDateTime=0xfc15c000, ftLastWriteTime.dwHighDateTime=0x1d4c91f, nFileSizeHigh=0x0, nFileSizeLow=0x4b46, dwReserved0=0x0, dwReserved1=0x0, cFileName="NJEVRlFHJT.mp4", cAlternateFileName="NJEVRL~1.MP4")) returned 1
	[0081.098] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce4d0c0, ftCreationTime.dwHighDateTime=0x1d4cd82, ftLastAccessTime.dwLowDateTime=0xfa99f760, ftLastAccessTime.dwHighDateTime=0x1d4cc3e, ftLastWriteTime.dwLowDateTime=0xfa99f760, ftLastWriteTime.dwHighDateTime=0x1d4cc3e, nFileSizeHigh=0x0, nFileSizeLow=0x18142, dwReserved0=0x0, dwReserved1=0x0, cFileName="nNDS9aIIq6eXBAU8bY6s.mp4", cAlternateFileName="NNDS9A~1.MP4")) returned 1
	[0081.098] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62912120, ftCreationTime.dwHighDateTime=0x1d4ce9e, ftLastAccessTime.dwLowDateTime=0xa9602790, ftLastAccessTime.dwHighDateTime=0x1d4cddb, ftLastWriteTime.dwLowDateTime=0xa9602790, ftLastWriteTime.dwHighDateTime=0x1d4cddb, nFileSizeHigh=0x0, nFileSizeLow=0x5731, dwReserved0=0x0, dwReserved1=0x0, cFileName="P5Oynb9TbD0-AZqdu.doc", cAlternateFileName="P5OYNB~1.DOC")) returned 1
	[0081.098] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ae9cba, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x68ae9cba, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x68ae9cba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="passwordd!.txt", cAlternateFileName="PASSWO~1.TXT")) returned 1
	[0081.098] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4d5e80, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0xd65c8c40, ftLastAccessTime.dwHighDateTime=0x1d4d108, ftLastWriteTime.dwLowDateTime=0xd65c8c40, ftLastWriteTime.dwHighDateTime=0x1d4d108, nFileSizeHigh=0x0, nFileSizeLow=0xcf92, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlQRcrXn.jpg", cAlternateFileName="")) returned 1
	[0081.098] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd71f8b0, ftCreationTime.dwHighDateTime=0x1d4c82f, ftLastAccessTime.dwLowDateTime=0xa5e54150, ftLastAccessTime.dwHighDateTime=0x1d4d370, ftLastWriteTime.dwLowDateTime=0xa5e54150, ftLastWriteTime.dwHighDateTime=0x1d4d370, nFileSizeHigh=0x0, nFileSizeLow=0x79ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="q RnkHVqD-PJ-8-IAN.pptx", cAlternateFileName="QRNKHV~1.PPT")) returned 1
	[0081.099] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4a1330, ftCreationTime.dwHighDateTime=0x1d4d15c, ftLastAccessTime.dwLowDateTime=0x3e11f730, ftLastAccessTime.dwHighDateTime=0x1d4c7e5, ftLastWriteTime.dwLowDateTime=0x3e11f730, ftLastWriteTime.dwHighDateTime=0x1d4c7e5, nFileSizeHigh=0x0, nFileSizeLow=0xbc34, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rcn2Wdp_6NKQcFN.jpg", cAlternateFileName="RCN2WD~1.JPG")) returned 1
	[0081.099] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1cd88e0, ftCreationTime.dwHighDateTime=0x1d4d2f1, ftLastAccessTime.dwLowDateTime=0x7e8caba0, ftLastAccessTime.dwHighDateTime=0x1d4d228, ftLastWriteTime.dwLowDateTime=0x7e8caba0, ftLastWriteTime.dwHighDateTime=0x1d4d228, nFileSizeHigh=0x0, nFileSizeLow=0x10863, dwReserved0=0x0, dwReserved1=0x0, cFileName="t9mkgiTy88iN.pdf", cAlternateFileName="T9MKGI~1.PDF")) returned 1
	[0081.099] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319897c0, ftCreationTime.dwHighDateTime=0x1d4caf1, ftLastAccessTime.dwLowDateTime=0x69694d70, ftLastAccessTime.dwHighDateTime=0x1d4ce3e, ftLastWriteTime.dwLowDateTime=0x69694d70, ftLastWriteTime.dwHighDateTime=0x1d4ce3e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tD103ArYxJ", cAlternateFileName="TD103A~1")) returned 1
	[0081.099] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9356b80, ftCreationTime.dwHighDateTime=0x1d4ce45, ftLastAccessTime.dwLowDateTime=0x95fdfef0, ftLastAccessTime.dwHighDateTime=0x1d4c59f, ftLastWriteTime.dwLowDateTime=0x95fdfef0, ftLastWriteTime.dwHighDateTime=0x1d4c59f, nFileSizeHigh=0x0, nFileSizeLow=0xd604, dwReserved0=0x0, dwReserved1=0x0, cFileName="V11_Sl6n U.flv", cAlternateFileName="V11_SL~1.FLV")) returned 1
	[0081.099] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54558ff0, ftCreationTime.dwHighDateTime=0x1d4cd23, ftLastAccessTime.dwLowDateTime=0x1e86bce0, ftLastAccessTime.dwHighDateTime=0x1d4c8a6, ftLastWriteTime.dwLowDateTime=0x1e86bce0, ftLastWriteTime.dwHighDateTime=0x1d4c8a6, nFileSizeHigh=0x0, nFileSizeLow=0x540a, dwReserved0=0x0, dwReserved1=0x0, cFileName="vAulzytKJ-2U 18tRT_x.m4a", cAlternateFileName="VAULZY~1.M4A")) returned 1
	[0081.099] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf48142a0, ftCreationTime.dwHighDateTime=0x1d4cddf, ftLastAccessTime.dwLowDateTime=0x83304100, ftLastAccessTime.dwHighDateTime=0x1d4c93e, ftLastWriteTime.dwLowDateTime=0x83304100, ftLastWriteTime.dwHighDateTime=0x1d4c93e, nFileSizeHigh=0x0, nFileSizeLow=0x1365c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wt0-IknGkIU5.m4a", cAlternateFileName="WT0-IK~1.M4A")) returned 1
	[0081.099] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24d5b20, ftCreationTime.dwHighDateTime=0x1d4cb87, ftLastAccessTime.dwLowDateTime=0x135f0900, ftLastAccessTime.dwHighDateTime=0x1d4cb29, ftLastWriteTime.dwLowDateTime=0x135f0900, ftLastWriteTime.dwHighDateTime=0x1d4cb29, nFileSizeHigh=0x0, nFileSizeLow=0xc4bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="x1qatAk.avi", cAlternateFileName="")) returned 1
	[0081.100] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58028100, ftCreationTime.dwHighDateTime=0x1d4cd94, ftLastAccessTime.dwLowDateTime=0x6253efb0, ftLastAccessTime.dwHighDateTime=0x1d4c97d, ftLastWriteTime.dwLowDateTime=0x6253efb0, ftLastWriteTime.dwHighDateTime=0x1d4c97d, nFileSizeHigh=0x0, nFileSizeLow=0x3aeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y-YLwAUI.wav", cAlternateFileName="")) returned 1
	[0081.100] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c28c80, ftCreationTime.dwHighDateTime=0x1d4cf1f, ftLastAccessTime.dwLowDateTime=0x976acdb0, ftLastAccessTime.dwHighDateTime=0x1d4d0c9, ftLastWriteTime.dwLowDateTime=0x976acdb0, ftLastWriteTime.dwHighDateTime=0x1d4d0c9, nFileSizeHigh=0x0, nFileSizeLow=0x865c, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ihN8mXrQKyt.mp3", cAlternateFileName="_IHN8M~1.MP3")) returned 1
	[0081.100] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c28c80, ftCreationTime.dwHighDateTime=0x1d4cf1f, ftLastAccessTime.dwLowDateTime=0x976acdb0, ftLastAccessTime.dwHighDateTime=0x1d4d0c9, ftLastWriteTime.dwLowDateTime=0x976acdb0, ftLastWriteTime.dwHighDateTime=0x1d4d0c9, nFileSizeHigh=0x0, nFileSizeLow=0x865c, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ihN8mXrQKyt.mp3", cAlternateFileName="_IHN8M~1.MP3")) returned 0
	[0081.100] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0081.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17
	[0081.100] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x68ae9cba, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x68ae9cba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0081.100] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x68ae9cba, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x68ae9cba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.100] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff0f2840, ftCreationTime.dwHighDateTime=0x1d4ce61, ftLastAccessTime.dwLowDateTime=0x24e06720, ftLastAccessTime.dwHighDateTime=0x1d4c695, ftLastWriteTime.dwLowDateTime=0x24e06720, ftLastWriteTime.dwHighDateTime=0x1d4c695, nFileSizeHigh=0x0, nFileSizeLow=0x13fce, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Fd4.jpg", cAlternateFileName="")) returned 1
	[0081.101] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c226fc0, ftCreationTime.dwHighDateTime=0x1d4c587, ftLastAccessTime.dwLowDateTime=0xc6458b00, ftLastAccessTime.dwHighDateTime=0x1d4c6df, ftLastWriteTime.dwLowDateTime=0xc6458b00, ftLastWriteTime.dwHighDateTime=0x1d4c6df, nFileSizeHigh=0x0, nFileSizeLow=0x7936, dwReserved0=0x0, dwReserved1=0x0, cFileName="1jyyCyb1J0US8YYH.odp", cAlternateFileName="1JYYCY~1.ODP")) returned 1
	[0081.101] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f519bf0, ftCreationTime.dwHighDateTime=0x1d4cfae, ftLastAccessTime.dwLowDateTime=0xdeef630, ftLastAccessTime.dwHighDateTime=0x1d4cb9f, ftLastWriteTime.dwLowDateTime=0xdeef630, ftLastWriteTime.dwHighDateTime=0x1d4cb9f, nFileSizeHigh=0x0, nFileSizeLow=0xdda7, dwReserved0=0x0, dwReserved1=0x0, cFileName="3aRfQcCqfFVV7a3Vj_l.pdf", cAlternateFileName="3ARFQC~1.PDF")) returned 1
	[0081.101] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914ea0c0, ftCreationTime.dwHighDateTime=0x1d4ca0a, ftLastAccessTime.dwLowDateTime=0xe59de980, ftLastAccessTime.dwHighDateTime=0x1d4cdf5, ftLastWriteTime.dwLowDateTime=0xe59de980, ftLastWriteTime.dwHighDateTime=0x1d4cdf5, nFileSizeHigh=0x0, nFileSizeLow=0x2cf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="4T98.bmp", cAlternateFileName="")) returned 1
	[0081.101] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4499fe0, ftCreationTime.dwHighDateTime=0x1d4cc01, ftLastAccessTime.dwLowDateTime=0xc452dc20, ftLastAccessTime.dwHighDateTime=0x1d4cec9, ftLastWriteTime.dwLowDateTime=0xc452dc20, ftLastWriteTime.dwHighDateTime=0x1d4cec9, nFileSizeHigh=0x0, nFileSizeLow=0xed63, dwReserved0=0x0, dwReserved1=0x0, cFileName="5k9Won_0Uoz.mp3", cAlternateFileName="5K9WON~1.MP3")) returned 1
	[0081.101] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe836fc60, ftCreationTime.dwHighDateTime=0x1d4cbaf, ftLastAccessTime.dwLowDateTime=0xee7816b0, ftLastAccessTime.dwHighDateTime=0x1d4ca7c, ftLastWriteTime.dwLowDateTime=0xee7816b0, ftLastWriteTime.dwHighDateTime=0x1d4ca7c, nFileSizeHigh=0x0, nFileSizeLow=0x98f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="6khbqV.mkv", cAlternateFileName="")) returned 1
	[0081.101] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf7730, ftCreationTime.dwHighDateTime=0x1d4cd38, ftLastAccessTime.dwLowDateTime=0x51cda410, ftLastAccessTime.dwHighDateTime=0x1d4cc48, ftLastWriteTime.dwLowDateTime=0x51cda410, ftLastWriteTime.dwHighDateTime=0x1d4cc48, nFileSizeHigh=0x0, nFileSizeLow=0x108e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="7jKTglHESAR.pdf", cAlternateFileName="7JKTGL~1.PDF")) returned 1
	[0081.101] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfdf06c0, ftCreationTime.dwHighDateTime=0x1d4c643, ftLastAccessTime.dwLowDateTime=0xe19e3270, ftLastAccessTime.dwHighDateTime=0x1d4c87f, ftLastWriteTime.dwLowDateTime=0xe19e3270, ftLastWriteTime.dwHighDateTime=0x1d4c87f, nFileSizeHigh=0x0, nFileSizeLow=0xcf41, dwReserved0=0x0, dwReserved1=0x0, cFileName="7LU2JGBdHQCis7U.ods", cAlternateFileName="7LU2JG~1.ODS")) returned 1
	[0081.101] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd5753d0, ftCreationTime.dwHighDateTime=0x1d4cba8, ftLastAccessTime.dwLowDateTime=0xeaf29620, ftLastAccessTime.dwHighDateTime=0x1d4d353, ftLastWriteTime.dwLowDateTime=0xeaf29620, ftLastWriteTime.dwHighDateTime=0x1d4d353, nFileSizeHigh=0x0, nFileSizeLow=0x15769, dwReserved0=0x0, dwReserved1=0x0, cFileName="96gW8USB HTonl.m4a", cAlternateFileName="96GW8U~1.M4A")) returned 1
	[0081.101] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fd6c00, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x39960280, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3438b800, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConsoleApp1.exe", cAlternateFileName="CONSOL~1.EXE")) returned 1
	[0081.101] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49eee6f0, ftCreationTime.dwHighDateTime=0x1d4c7f7, ftLastAccessTime.dwLowDateTime=0xa58cee60, ftLastAccessTime.dwHighDateTime=0x1d4cdad, ftLastWriteTime.dwLowDateTime=0xa58cee60, ftLastWriteTime.dwHighDateTime=0x1d4cdad, nFileSizeHigh=0x0, nFileSizeLow=0x8b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cQEkAMxQKtM-svsehDa.jpg", cAlternateFileName="CQEKAM~1.JPG")) returned 1
	[0081.102] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.102] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb95d5750, ftCreationTime.dwHighDateTime=0x1d4cdd4, ftLastAccessTime.dwLowDateTime=0x78307ba0, ftLastAccessTime.dwHighDateTime=0x1d4cabd, ftLastWriteTime.dwLowDateTime=0x78307ba0, ftLastWriteTime.dwHighDateTime=0x1d4cabd, nFileSizeHigh=0x0, nFileSizeLow=0x7f53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fe4GZlNGOX.bmp", cAlternateFileName="FE4GZL~1.BMP")) returned 1
	[0081.102] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd714940, ftCreationTime.dwHighDateTime=0x1d4d203, ftLastAccessTime.dwLowDateTime=0xecf5f850, ftLastAccessTime.dwHighDateTime=0x1d4c6ff, ftLastWriteTime.dwLowDateTime=0xecf5f850, ftLastWriteTime.dwHighDateTime=0x1d4c6ff, nFileSizeHigh=0x0, nFileSizeLow=0x11dad, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrcQWnKHPKeGPUJM.xlsx", cAlternateFileName="FRCQWN~1.XLS")) returned 1
	[0081.102] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2210740, ftCreationTime.dwHighDateTime=0x1d4cc39, ftLastAccessTime.dwLowDateTime=0x9448d50, ftLastAccessTime.dwHighDateTime=0x1d4d2b8, ftLastWriteTime.dwLowDateTime=0x9448d50, ftLastWriteTime.dwHighDateTime=0x1d4d2b8, nFileSizeHigh=0x0, nFileSizeLow=0x434b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hO2Z9_0A6mYFb.mp3", cAlternateFileName="HO2Z9_~1.MP3")) returned 1
	[0081.102] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c0bb170, ftCreationTime.dwHighDateTime=0x1d4c772, ftLastAccessTime.dwLowDateTime=0x594775b0, ftLastAccessTime.dwHighDateTime=0x1d4c755, ftLastWriteTime.dwLowDateTime=0x594775b0, ftLastWriteTime.dwHighDateTime=0x1d4c755, nFileSizeHigh=0x0, nFileSizeLow=0x43bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="icQK5B2A00F9_ZXOr.jpg", cAlternateFileName="ICQK5B~1.JPG")) returned 1
	[0081.102] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e534060, ftCreationTime.dwHighDateTime=0x1d4d3bb, ftLastAccessTime.dwLowDateTime=0x60d71ac0, ftLastAccessTime.dwHighDateTime=0x1d4d4a1, ftLastWriteTime.dwLowDateTime=0x60d71ac0, ftLastWriteTime.dwHighDateTime=0x1d4d4a1, nFileSizeHigh=0x0, nFileSizeLow=0x702b, dwReserved0=0x0, dwReserved1=0x0, cFileName="IV5ALBjbsW7-YByVU.flv", cAlternateFileName="IV5ALB~1.FLV")) returned 1
	[0081.102] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65ef5270, ftCreationTime.dwHighDateTime=0x1d4d550, ftLastAccessTime.dwLowDateTime=0x170ba110, ftLastAccessTime.dwHighDateTime=0x1d4ccfc, ftLastWriteTime.dwLowDateTime=0x170ba110, ftLastWriteTime.dwHighDateTime=0x1d4ccfc, nFileSizeHigh=0x0, nFileSizeLow=0xe199, dwReserved0=0x0, dwReserved1=0x0, cFileName="j 69tU.avi", cAlternateFileName="J69TU~1.AVI")) returned 1
	[0081.102] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x539ed80, ftCreationTime.dwHighDateTime=0x1d4cd05, ftLastAccessTime.dwLowDateTime=0x4814820, ftLastAccessTime.dwHighDateTime=0x1d4d3e5, ftLastWriteTime.dwLowDateTime=0x4814820, ftLastWriteTime.dwHighDateTime=0x1d4d3e5, nFileSizeHigh=0x0, nFileSizeLow=0x3929, dwReserved0=0x0, dwReserved1=0x0, cFileName="j IUnUdt48.mp3", cAlternateFileName="JIUNUD~1.MP3")) returned 1
	[0081.102] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25d97f50, ftCreationTime.dwHighDateTime=0x1d4c865, ftLastAccessTime.dwLowDateTime=0xd6797250, ftLastAccessTime.dwHighDateTime=0x1d4cae2, ftLastWriteTime.dwLowDateTime=0xd6797250, ftLastWriteTime.dwHighDateTime=0x1d4cae2, nFileSizeHigh=0x0, nFileSizeLow=0x11c32, dwReserved0=0x0, dwReserved1=0x0, cFileName="J-1OVxTZq4djuzTyM.flv", cAlternateFileName="J-1OVX~1.FLV")) returned 1
	[0081.103] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb673d820, ftCreationTime.dwHighDateTime=0x1d4cfe6, ftLastAccessTime.dwLowDateTime=0xb2abaa20, ftLastAccessTime.dwHighDateTime=0x1d4cb94, ftLastWriteTime.dwLowDateTime=0xb2abaa20, ftLastWriteTime.dwHighDateTime=0x1d4cb94, nFileSizeHigh=0x0, nFileSizeLow=0x6156, dwReserved0=0x0, dwReserved1=0x0, cFileName="jCr9qMg8.png", cAlternateFileName="")) returned 1
	[0081.103] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78965270, ftCreationTime.dwHighDateTime=0x1d4cfd8, ftLastAccessTime.dwLowDateTime=0xa8d2b680, ftLastAccessTime.dwHighDateTime=0x1d4c7fa, ftLastWriteTime.dwLowDateTime=0xa8d2b680, ftLastWriteTime.dwHighDateTime=0x1d4c7fa, nFileSizeHigh=0x0, nFileSizeLow=0x10a0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="KmA2QeehMp.jpg", cAlternateFileName="KMA2QE~1.JPG")) returned 1
	[0081.103] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8bff70, ftCreationTime.dwHighDateTime=0x1d4d0f9, ftLastAccessTime.dwLowDateTime=0x56f45510, ftLastAccessTime.dwHighDateTime=0x1d4cff4, ftLastWriteTime.dwLowDateTime=0x56f45510, ftLastWriteTime.dwHighDateTime=0x1d4cff4, nFileSizeHigh=0x0, nFileSizeLow=0x176eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="mFFKQCIs7xI7UoP9.gif", cAlternateFileName="MFFKQC~1.GIF")) returned 1
	[0081.103] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2110e0, ftCreationTime.dwHighDateTime=0x1d4d13f, ftLastAccessTime.dwLowDateTime=0xfc15c000, ftLastAccessTime.dwHighDateTime=0x1d4c91f, ftLastWriteTime.dwLowDateTime=0xfc15c000, ftLastWriteTime.dwHighDateTime=0x1d4c91f, nFileSizeHigh=0x0, nFileSizeLow=0x4b46, dwReserved0=0x0, dwReserved1=0x0, cFileName="NJEVRlFHJT.mp4", cAlternateFileName="NJEVRL~1.MP4")) returned 1
	[0081.103] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce4d0c0, ftCreationTime.dwHighDateTime=0x1d4cd82, ftLastAccessTime.dwLowDateTime=0xfa99f760, ftLastAccessTime.dwHighDateTime=0x1d4cc3e, ftLastWriteTime.dwLowDateTime=0xfa99f760, ftLastWriteTime.dwHighDateTime=0x1d4cc3e, nFileSizeHigh=0x0, nFileSizeLow=0x18142, dwReserved0=0x0, dwReserved1=0x0, cFileName="nNDS9aIIq6eXBAU8bY6s.mp4", cAlternateFileName="NNDS9A~1.MP4")) returned 1
	[0081.103] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62912120, ftCreationTime.dwHighDateTime=0x1d4ce9e, ftLastAccessTime.dwLowDateTime=0xa9602790, ftLastAccessTime.dwHighDateTime=0x1d4cddb, ftLastWriteTime.dwLowDateTime=0xa9602790, ftLastWriteTime.dwHighDateTime=0x1d4cddb, nFileSizeHigh=0x0, nFileSizeLow=0x5731, dwReserved0=0x0, dwReserved1=0x0, cFileName="P5Oynb9TbD0-AZqdu.doc", cAlternateFileName="P5OYNB~1.DOC")) returned 1
	[0081.103] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ae9cba, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x68ae9cba, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x68ae9cba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="passwordd!.txt", cAlternateFileName="PASSWO~1.TXT")) returned 1
	[0081.103] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4d5e80, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0xd65c8c40, ftLastAccessTime.dwHighDateTime=0x1d4d108, ftLastWriteTime.dwLowDateTime=0xd65c8c40, ftLastWriteTime.dwHighDateTime=0x1d4d108, nFileSizeHigh=0x0, nFileSizeLow=0xcf92, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlQRcrXn.jpg", cAlternateFileName="")) returned 1
	[0081.103] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd71f8b0, ftCreationTime.dwHighDateTime=0x1d4c82f, ftLastAccessTime.dwLowDateTime=0xa5e54150, ftLastAccessTime.dwHighDateTime=0x1d4d370, ftLastWriteTime.dwLowDateTime=0xa5e54150, ftLastWriteTime.dwHighDateTime=0x1d4d370, nFileSizeHigh=0x0, nFileSizeLow=0x79ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="q RnkHVqD-PJ-8-IAN.pptx", cAlternateFileName="QRNKHV~1.PPT")) returned 1
	[0081.103] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4a1330, ftCreationTime.dwHighDateTime=0x1d4d15c, ftLastAccessTime.dwLowDateTime=0x3e11f730, ftLastAccessTime.dwHighDateTime=0x1d4c7e5, ftLastWriteTime.dwLowDateTime=0x3e11f730, ftLastWriteTime.dwHighDateTime=0x1d4c7e5, nFileSizeHigh=0x0, nFileSizeLow=0xbc34, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rcn2Wdp_6NKQcFN.jpg", cAlternateFileName="RCN2WD~1.JPG")) returned 1
	[0081.104] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1cd88e0, ftCreationTime.dwHighDateTime=0x1d4d2f1, ftLastAccessTime.dwLowDateTime=0x7e8caba0, ftLastAccessTime.dwHighDateTime=0x1d4d228, ftLastWriteTime.dwLowDateTime=0x7e8caba0, ftLastWriteTime.dwHighDateTime=0x1d4d228, nFileSizeHigh=0x0, nFileSizeLow=0x10863, dwReserved0=0x0, dwReserved1=0x0, cFileName="t9mkgiTy88iN.pdf", cAlternateFileName="T9MKGI~1.PDF")) returned 1
	[0081.104] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319897c0, ftCreationTime.dwHighDateTime=0x1d4caf1, ftLastAccessTime.dwLowDateTime=0x69694d70, ftLastAccessTime.dwHighDateTime=0x1d4ce3e, ftLastWriteTime.dwLowDateTime=0x69694d70, ftLastWriteTime.dwHighDateTime=0x1d4ce3e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tD103ArYxJ", cAlternateFileName="TD103A~1")) returned 1
	[0081.104] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9356b80, ftCreationTime.dwHighDateTime=0x1d4ce45, ftLastAccessTime.dwLowDateTime=0x95fdfef0, ftLastAccessTime.dwHighDateTime=0x1d4c59f, ftLastWriteTime.dwLowDateTime=0x95fdfef0, ftLastWriteTime.dwHighDateTime=0x1d4c59f, nFileSizeHigh=0x0, nFileSizeLow=0xd604, dwReserved0=0x0, dwReserved1=0x0, cFileName="V11_Sl6n U.flv", cAlternateFileName="V11_SL~1.FLV")) returned 1
	[0081.104] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54558ff0, ftCreationTime.dwHighDateTime=0x1d4cd23, ftLastAccessTime.dwLowDateTime=0x1e86bce0, ftLastAccessTime.dwHighDateTime=0x1d4c8a6, ftLastWriteTime.dwLowDateTime=0x1e86bce0, ftLastWriteTime.dwHighDateTime=0x1d4c8a6, nFileSizeHigh=0x0, nFileSizeLow=0x540a, dwReserved0=0x0, dwReserved1=0x0, cFileName="vAulzytKJ-2U 18tRT_x.m4a", cAlternateFileName="VAULZY~1.M4A")) returned 1
	[0081.104] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf48142a0, ftCreationTime.dwHighDateTime=0x1d4cddf, ftLastAccessTime.dwLowDateTime=0x83304100, ftLastAccessTime.dwHighDateTime=0x1d4c93e, ftLastWriteTime.dwLowDateTime=0x83304100, ftLastWriteTime.dwHighDateTime=0x1d4c93e, nFileSizeHigh=0x0, nFileSizeLow=0x1365c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wt0-IknGkIU5.m4a", cAlternateFileName="WT0-IK~1.M4A")) returned 1
	[0081.104] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24d5b20, ftCreationTime.dwHighDateTime=0x1d4cb87, ftLastAccessTime.dwLowDateTime=0x135f0900, ftLastAccessTime.dwHighDateTime=0x1d4cb29, ftLastWriteTime.dwLowDateTime=0x135f0900, ftLastWriteTime.dwHighDateTime=0x1d4cb29, nFileSizeHigh=0x0, nFileSizeLow=0xc4bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="x1qatAk.avi", cAlternateFileName="")) returned 1
	[0081.104] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58028100, ftCreationTime.dwHighDateTime=0x1d4cd94, ftLastAccessTime.dwLowDateTime=0x6253efb0, ftLastAccessTime.dwHighDateTime=0x1d4c97d, ftLastWriteTime.dwLowDateTime=0x6253efb0, ftLastWriteTime.dwHighDateTime=0x1d4c97d, nFileSizeHigh=0x0, nFileSizeLow=0x3aeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y-YLwAUI.wav", cAlternateFileName="")) returned 1
	[0081.110] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c28c80, ftCreationTime.dwHighDateTime=0x1d4cf1f, ftLastAccessTime.dwLowDateTime=0x976acdb0, ftLastAccessTime.dwHighDateTime=0x1d4d0c9, ftLastWriteTime.dwLowDateTime=0x976acdb0, ftLastWriteTime.dwHighDateTime=0x1d4d0c9, nFileSizeHigh=0x0, nFileSizeLow=0x865c, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ihN8mXrQKyt.mp3", cAlternateFileName="_IHN8M~1.MP3")) returned 1
	[0081.110] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0081.110] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0081.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.110] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Decrypt.txt", lpFilePart=0x0) returned 0x23
	[0081.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.110] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.111] GetFileType (hFile=0x5dc) returned 0x1
	[0081.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.111] GetFileType (hFile=0x5dc) returned 0x1
	[0081.111] WriteFile (in: hFile=0x5dc, lpBuffer=0x258d840*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258d840*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.112] CloseHandle (hObject=0x5dc) returned 1
	[0081.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19
	[0081.112] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d467cfa, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d467cfa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0081.112] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d467cfa, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d467cfa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.112] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdd06280, ftCreationTime.dwHighDateTime=0x1d4f292, ftLastAccessTime.dwLowDateTime=0x40571150, ftLastAccessTime.dwHighDateTime=0x1d4d961, ftLastWriteTime.dwLowDateTime=0x40571150, ftLastWriteTime.dwHighDateTime=0x1d4d961, nFileSizeHigh=0x0, nFileSizeLow=0x7711, dwReserved0=0x0, dwReserved1=0x0, cFileName="1UtPUV.docx", cAlternateFileName="1UTPUV~1.DOC")) returned 1
	[0081.112] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc306d20, ftCreationTime.dwHighDateTime=0x1d514a4, ftLastAccessTime.dwLowDateTime=0xab460030, ftLastAccessTime.dwHighDateTime=0x1d4a189, ftLastWriteTime.dwLowDateTime=0xab460030, ftLastWriteTime.dwHighDateTime=0x1d4a189, nFileSizeHigh=0x0, nFileSizeLow=0x2895, dwReserved0=0x0, dwReserved1=0x0, cFileName="2KbiYwfbbFh7sv4.pptx", cAlternateFileName="2KBIYW~1.PPT")) returned 1
	[0081.113] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf60d220, ftCreationTime.dwHighDateTime=0x1d4c388, ftLastAccessTime.dwLowDateTime=0xc006c210, ftLastAccessTime.dwHighDateTime=0x1d4fd01, ftLastWriteTime.dwLowDateTime=0xc006c210, ftLastWriteTime.dwHighDateTime=0x1d4fd01, nFileSizeHigh=0x0, nFileSizeLow=0xe128, dwReserved0=0x0, dwReserved1=0x0, cFileName="479_NSIE.xlsx", cAlternateFileName="479_NS~1.XLS")) returned 1
	[0081.113] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1
	[0081.113] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.113] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4642ae20, ftCreationTime.dwHighDateTime=0x1d4c8c3, ftLastAccessTime.dwLowDateTime=0x767607a0, ftLastAccessTime.dwHighDateTime=0x1d4ff45, ftLastWriteTime.dwLowDateTime=0x767607a0, ftLastWriteTime.dwHighDateTime=0x1d4ff45, nFileSizeHigh=0x0, nFileSizeLow=0x181ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAEbB.pptx", cAlternateFileName="EAEBB~1.PPT")) returned 1
	[0081.113] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ca01d0, ftCreationTime.dwHighDateTime=0x1d4aa02, ftLastAccessTime.dwLowDateTime=0xa76b3100, ftLastAccessTime.dwHighDateTime=0x1d4fc20, ftLastWriteTime.dwLowDateTime=0xa76b3100, ftLastWriteTime.dwHighDateTime=0x1d4fc20, nFileSizeHigh=0x0, nFileSizeLow=0x15215, dwReserved0=0x0, dwReserved1=0x0, cFileName="et6GcwOh.pptx", cAlternateFileName="ET6GCW~1.PPT")) returned 1
	[0081.113] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69abff90, ftCreationTime.dwHighDateTime=0x1d4edaa, ftLastAccessTime.dwLowDateTime=0x4625d5e0, ftLastAccessTime.dwHighDateTime=0x1d4d30c, ftLastWriteTime.dwLowDateTime=0x4625d5e0, ftLastWriteTime.dwHighDateTime=0x1d4d30c, nFileSizeHigh=0x0, nFileSizeLow=0xf72a, dwReserved0=0x0, dwReserved1=0x0, cFileName="gGwVHZSJ4QTsUYRg9.xlsx", cAlternateFileName="GGWVHZ~1.XLS")) returned 1
	[0081.113] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22cf82b0, ftCreationTime.dwHighDateTime=0x1d50676, ftLastAccessTime.dwLowDateTime=0x83e10c90, ftLastAccessTime.dwHighDateTime=0x1d4b257, ftLastWriteTime.dwLowDateTime=0x83e10c90, ftLastWriteTime.dwHighDateTime=0x1d4b257, nFileSizeHigh=0x0, nFileSizeLow=0x15cbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="H9gxc2Tns2wUu7-r.docx", cAlternateFileName="H9GXC2~1.DOC")) returned 1
	[0081.113] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173cf440, ftCreationTime.dwHighDateTime=0x1d4ceff, ftLastAccessTime.dwLowDateTime=0x3b5d8ef0, ftLastAccessTime.dwHighDateTime=0x1d4d190, ftLastWriteTime.dwLowDateTime=0x3b5d8ef0, ftLastWriteTime.dwHighDateTime=0x1d4d190, nFileSizeHigh=0x0, nFileSizeLow=0xf0c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J2cnjGjRQSehqu.csv", cAlternateFileName="J2CNJG~1.CSV")) returned 1
	[0081.114] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3ab5c70, ftCreationTime.dwHighDateTime=0x1d48d50, ftLastAccessTime.dwLowDateTime=0x1c26c300, ftLastAccessTime.dwHighDateTime=0x1d50000, ftLastWriteTime.dwLowDateTime=0x1c26c300, ftLastWriteTime.dwHighDateTime=0x1d50000, nFileSizeHigh=0x0, nFileSizeLow=0x5c47, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfjYE.docx", cAlternateFileName="JFJYE~1.DOC")) returned 1
	[0081.114] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd581650, ftCreationTime.dwHighDateTime=0x1d4d045, ftLastAccessTime.dwLowDateTime=0x9a89a20, ftLastAccessTime.dwHighDateTime=0x1d50b3e, ftLastWriteTime.dwLowDateTime=0x9a89a20, ftLastWriteTime.dwHighDateTime=0x1d50b3e, nFileSizeHigh=0x0, nFileSizeLow=0x3949, dwReserved0=0x0, dwReserved1=0x0, cFileName="KgrFcG.xlsx", cAlternateFileName="KGRFCG~1.XLS")) returned 1
	[0081.114] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ddef90, ftCreationTime.dwHighDateTime=0x1d49d7e, ftLastAccessTime.dwLowDateTime=0xb2c6e150, ftLastAccessTime.dwHighDateTime=0x1d4f146, ftLastWriteTime.dwLowDateTime=0xb2c6e150, ftLastWriteTime.dwHighDateTime=0x1d4f146, nFileSizeHigh=0x0, nFileSizeLow=0xdd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="KXkz3cwapbMzQiyzh.pptx", cAlternateFileName="KXKZ3C~1.PPT")) returned 1
	[0081.114] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b33aa70, ftCreationTime.dwHighDateTime=0x1d490de, ftLastAccessTime.dwLowDateTime=0x6e072910, ftLastAccessTime.dwHighDateTime=0x1d4dca3, ftLastWriteTime.dwLowDateTime=0x6e072910, ftLastWriteTime.dwHighDateTime=0x1d4dca3, nFileSizeHigh=0x0, nFileSizeLow=0x10510, dwReserved0=0x0, dwReserved1=0x0, cFileName="meDZqT1lw115RV-Rt.xlsx", cAlternateFileName="MEDZQT~1.XLS")) returned 1
	[0081.114] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0081.114] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0081.114] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1
	[0081.114] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0081.115] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1
	[0081.115] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fa7eca0, ftCreationTime.dwHighDateTime=0x1d506da, ftLastAccessTime.dwLowDateTime=0x263f1480, ftLastAccessTime.dwHighDateTime=0x1d4ce2f, ftLastWriteTime.dwLowDateTime=0x263f1480, ftLastWriteTime.dwHighDateTime=0x1d4ce2f, nFileSizeHigh=0x0, nFileSizeLow=0x10158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SlbAII0GlcT.docx", cAlternateFileName="SLBAII~1.DOC")) returned 1
	[0081.115] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c692970, ftCreationTime.dwHighDateTime=0x1d50401, ftLastAccessTime.dwLowDateTime=0x3d1555a0, ftLastAccessTime.dwHighDateTime=0x1d4fdc5, ftLastWriteTime.dwLowDateTime=0x3d1555a0, ftLastWriteTime.dwHighDateTime=0x1d4fdc5, nFileSizeHigh=0x0, nFileSizeLow=0x10932, dwReserved0=0x0, dwReserved1=0x0, cFileName="ulD9-9KJ pJF2.xlsx", cAlternateFileName="ULD9-9~1.XLS")) returned 1
	[0081.115] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f0b6ff0, ftCreationTime.dwHighDateTime=0x1d4e8ce, ftLastAccessTime.dwLowDateTime=0x8a774be0, ftLastAccessTime.dwHighDateTime=0x1d4bbd1, ftLastWriteTime.dwLowDateTime=0x8a774be0, ftLastWriteTime.dwHighDateTime=0x1d4bbd1, nFileSizeHigh=0x0, nFileSizeLow=0x87b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="v 8fp6DZf.pptx", cAlternateFileName="V8FP6D~1.PPT")) returned 1
	[0081.115] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb7d6fc0, ftCreationTime.dwHighDateTime=0x1d4ca60, ftLastAccessTime.dwLowDateTime=0x4de81550, ftLastAccessTime.dwHighDateTime=0x1d4c83e, ftLastWriteTime.dwLowDateTime=0x4de81550, ftLastWriteTime.dwHighDateTime=0x1d4c83e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF xk8r", cAlternateFileName="VFXK8R~1")) returned 1
	[0081.115] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3ad30, ftCreationTime.dwHighDateTime=0x1d4b8a4, ftLastAccessTime.dwLowDateTime=0xa4cc0, ftLastAccessTime.dwHighDateTime=0x1d4fa36, ftLastWriteTime.dwLowDateTime=0xa4cc0, ftLastWriteTime.dwHighDateTime=0x1d4fa36, nFileSizeHigh=0x0, nFileSizeLow=0xbb41, dwReserved0=0x0, dwReserved1=0x0, cFileName="_vvYCj6.docx", cAlternateFileName="_VVYCJ~1.DOC")) returned 1
	[0081.115] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3ad30, ftCreationTime.dwHighDateTime=0x1d4b8a4, ftLastAccessTime.dwLowDateTime=0xa4cc0, ftLastAccessTime.dwHighDateTime=0x1d4fa36, ftLastWriteTime.dwLowDateTime=0xa4cc0, ftLastWriteTime.dwHighDateTime=0x1d4fa36, nFileSizeHigh=0x0, nFileSizeLow=0xbb41, dwReserved0=0x0, dwReserved1=0x0, cFileName="_vvYCj6.docx", cAlternateFileName="_VVYCJ~1.DOC")) returned 0
	[0081.115] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0081.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.116] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19
	[0081.116] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d467cfa, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d467cfa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0081.116] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d467cfa, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d467cfa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.116] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdd06280, ftCreationTime.dwHighDateTime=0x1d4f292, ftLastAccessTime.dwLowDateTime=0x40571150, ftLastAccessTime.dwHighDateTime=0x1d4d961, ftLastWriteTime.dwLowDateTime=0x40571150, ftLastWriteTime.dwHighDateTime=0x1d4d961, nFileSizeHigh=0x0, nFileSizeLow=0x7711, dwReserved0=0x0, dwReserved1=0x0, cFileName="1UtPUV.docx", cAlternateFileName="1UTPUV~1.DOC")) returned 1
	[0081.116] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc306d20, ftCreationTime.dwHighDateTime=0x1d514a4, ftLastAccessTime.dwLowDateTime=0xab460030, ftLastAccessTime.dwHighDateTime=0x1d4a189, ftLastWriteTime.dwLowDateTime=0xab460030, ftLastWriteTime.dwHighDateTime=0x1d4a189, nFileSizeHigh=0x0, nFileSizeLow=0x2895, dwReserved0=0x0, dwReserved1=0x0, cFileName="2KbiYwfbbFh7sv4.pptx", cAlternateFileName="2KBIYW~1.PPT")) returned 1
	[0081.116] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf60d220, ftCreationTime.dwHighDateTime=0x1d4c388, ftLastAccessTime.dwLowDateTime=0xc006c210, ftLastAccessTime.dwHighDateTime=0x1d4fd01, ftLastWriteTime.dwLowDateTime=0xc006c210, ftLastWriteTime.dwHighDateTime=0x1d4fd01, nFileSizeHigh=0x0, nFileSizeLow=0xe128, dwReserved0=0x0, dwReserved1=0x0, cFileName="479_NSIE.xlsx", cAlternateFileName="479_NS~1.XLS")) returned 1
	[0081.116] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1
	[0081.116] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.116] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4642ae20, ftCreationTime.dwHighDateTime=0x1d4c8c3, ftLastAccessTime.dwLowDateTime=0x767607a0, ftLastAccessTime.dwHighDateTime=0x1d4ff45, ftLastWriteTime.dwLowDateTime=0x767607a0, ftLastWriteTime.dwHighDateTime=0x1d4ff45, nFileSizeHigh=0x0, nFileSizeLow=0x181ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAEbB.pptx", cAlternateFileName="EAEBB~1.PPT")) returned 1
	[0081.117] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ca01d0, ftCreationTime.dwHighDateTime=0x1d4aa02, ftLastAccessTime.dwLowDateTime=0xa76b3100, ftLastAccessTime.dwHighDateTime=0x1d4fc20, ftLastWriteTime.dwLowDateTime=0xa76b3100, ftLastWriteTime.dwHighDateTime=0x1d4fc20, nFileSizeHigh=0x0, nFileSizeLow=0x15215, dwReserved0=0x0, dwReserved1=0x0, cFileName="et6GcwOh.pptx", cAlternateFileName="ET6GCW~1.PPT")) returned 1
	[0081.117] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69abff90, ftCreationTime.dwHighDateTime=0x1d4edaa, ftLastAccessTime.dwLowDateTime=0x4625d5e0, ftLastAccessTime.dwHighDateTime=0x1d4d30c, ftLastWriteTime.dwLowDateTime=0x4625d5e0, ftLastWriteTime.dwHighDateTime=0x1d4d30c, nFileSizeHigh=0x0, nFileSizeLow=0xf72a, dwReserved0=0x0, dwReserved1=0x0, cFileName="gGwVHZSJ4QTsUYRg9.xlsx", cAlternateFileName="GGWVHZ~1.XLS")) returned 1
	[0081.117] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22cf82b0, ftCreationTime.dwHighDateTime=0x1d50676, ftLastAccessTime.dwLowDateTime=0x83e10c90, ftLastAccessTime.dwHighDateTime=0x1d4b257, ftLastWriteTime.dwLowDateTime=0x83e10c90, ftLastWriteTime.dwHighDateTime=0x1d4b257, nFileSizeHigh=0x0, nFileSizeLow=0x15cbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="H9gxc2Tns2wUu7-r.docx", cAlternateFileName="H9GXC2~1.DOC")) returned 1
	[0081.117] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173cf440, ftCreationTime.dwHighDateTime=0x1d4ceff, ftLastAccessTime.dwLowDateTime=0x3b5d8ef0, ftLastAccessTime.dwHighDateTime=0x1d4d190, ftLastWriteTime.dwLowDateTime=0x3b5d8ef0, ftLastWriteTime.dwHighDateTime=0x1d4d190, nFileSizeHigh=0x0, nFileSizeLow=0xf0c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J2cnjGjRQSehqu.csv", cAlternateFileName="J2CNJG~1.CSV")) returned 1
	[0081.117] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3ab5c70, ftCreationTime.dwHighDateTime=0x1d48d50, ftLastAccessTime.dwLowDateTime=0x1c26c300, ftLastAccessTime.dwHighDateTime=0x1d50000, ftLastWriteTime.dwLowDateTime=0x1c26c300, ftLastWriteTime.dwHighDateTime=0x1d50000, nFileSizeHigh=0x0, nFileSizeLow=0x5c47, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfjYE.docx", cAlternateFileName="JFJYE~1.DOC")) returned 1
	[0081.117] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd581650, ftCreationTime.dwHighDateTime=0x1d4d045, ftLastAccessTime.dwLowDateTime=0x9a89a20, ftLastAccessTime.dwHighDateTime=0x1d50b3e, ftLastWriteTime.dwLowDateTime=0x9a89a20, ftLastWriteTime.dwHighDateTime=0x1d50b3e, nFileSizeHigh=0x0, nFileSizeLow=0x3949, dwReserved0=0x0, dwReserved1=0x0, cFileName="KgrFcG.xlsx", cAlternateFileName="KGRFCG~1.XLS")) returned 1
	[0081.117] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ddef90, ftCreationTime.dwHighDateTime=0x1d49d7e, ftLastAccessTime.dwLowDateTime=0xb2c6e150, ftLastAccessTime.dwHighDateTime=0x1d4f146, ftLastWriteTime.dwLowDateTime=0xb2c6e150, ftLastWriteTime.dwHighDateTime=0x1d4f146, nFileSizeHigh=0x0, nFileSizeLow=0xdd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="KXkz3cwapbMzQiyzh.pptx", cAlternateFileName="KXKZ3C~1.PPT")) returned 1
	[0081.117] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b33aa70, ftCreationTime.dwHighDateTime=0x1d490de, ftLastAccessTime.dwLowDateTime=0x6e072910, ftLastAccessTime.dwHighDateTime=0x1d4dca3, ftLastWriteTime.dwLowDateTime=0x6e072910, ftLastWriteTime.dwHighDateTime=0x1d4dca3, nFileSizeHigh=0x0, nFileSizeLow=0x10510, dwReserved0=0x0, dwReserved1=0x0, cFileName="meDZqT1lw115RV-Rt.xlsx", cAlternateFileName="MEDZQT~1.XLS")) returned 1
	[0081.117] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0081.117] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0081.118] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1
	[0081.118] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0081.118] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1
	[0081.118] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fa7eca0, ftCreationTime.dwHighDateTime=0x1d506da, ftLastAccessTime.dwLowDateTime=0x263f1480, ftLastAccessTime.dwHighDateTime=0x1d4ce2f, ftLastWriteTime.dwLowDateTime=0x263f1480, ftLastWriteTime.dwHighDateTime=0x1d4ce2f, nFileSizeHigh=0x0, nFileSizeLow=0x10158, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SlbAII0GlcT.docx", cAlternateFileName="SLBAII~1.DOC")) returned 1
	[0081.118] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c692970, ftCreationTime.dwHighDateTime=0x1d50401, ftLastAccessTime.dwLowDateTime=0x3d1555a0, ftLastAccessTime.dwHighDateTime=0x1d4fdc5, ftLastWriteTime.dwLowDateTime=0x3d1555a0, ftLastWriteTime.dwHighDateTime=0x1d4fdc5, nFileSizeHigh=0x0, nFileSizeLow=0x10932, dwReserved0=0x0, dwReserved1=0x0, cFileName="ulD9-9KJ pJF2.xlsx", cAlternateFileName="ULD9-9~1.XLS")) returned 1
	[0081.118] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f0b6ff0, ftCreationTime.dwHighDateTime=0x1d4e8ce, ftLastAccessTime.dwLowDateTime=0x8a774be0, ftLastAccessTime.dwHighDateTime=0x1d4bbd1, ftLastWriteTime.dwLowDateTime=0x8a774be0, ftLastWriteTime.dwHighDateTime=0x1d4bbd1, nFileSizeHigh=0x0, nFileSizeLow=0x87b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="v 8fp6DZf.pptx", cAlternateFileName="V8FP6D~1.PPT")) returned 1
	[0081.118] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb7d6fc0, ftCreationTime.dwHighDateTime=0x1d4ca60, ftLastAccessTime.dwLowDateTime=0x4de81550, ftLastAccessTime.dwHighDateTime=0x1d4c83e, ftLastWriteTime.dwLowDateTime=0x4de81550, ftLastWriteTime.dwHighDateTime=0x1d4c83e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF xk8r", cAlternateFileName="VFXK8R~1")) returned 1
	[0081.118] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3ad30, ftCreationTime.dwHighDateTime=0x1d4b8a4, ftLastAccessTime.dwLowDateTime=0xa4cc0, ftLastAccessTime.dwHighDateTime=0x1d4fa36, ftLastWriteTime.dwLowDateTime=0xa4cc0, ftLastWriteTime.dwHighDateTime=0x1d4fa36, nFileSizeHigh=0x0, nFileSizeLow=0xbb41, dwReserved0=0x0, dwReserved1=0x0, cFileName="_vvYCj6.docx", cAlternateFileName="_VVYCJ~1.DOC")) returned 1
	[0081.118] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0081.118] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0081.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.119] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0081.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.119] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\documents\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.119] GetFileType (hFile=0x5dc) returned 0x1
	[0081.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.119] GetFileType (hFile=0x5dc) returned 0x1
	[0081.119] WriteFile (in: hFile=0x5dc, lpBuffer=0x2594514*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2594514*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.120] CloseHandle (hObject=0x5dc) returned 1
	[0081.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.120] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19
	[0081.120] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0081.121] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.121] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.121] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0081.121] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0081.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.121] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19
	[0081.121] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0081.121] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.121] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.122] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0081.122] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0081.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.122] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0081.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.122] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.122] GetFileType (hFile=0x5dc) returned 0x1
	[0081.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.122] GetFileType (hFile=0x5dc) returned 0x1
	[0081.122] WriteFile (in: hFile=0x5dc, lpBuffer=0x2597650*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2597650*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.123] CloseHandle (hObject=0x5dc) returned 1
	[0081.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.123] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19
	[0081.123] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0081.123] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.123] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1
	[0081.123] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.123] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0081.124] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0081.124] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0081.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.124] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19
	[0081.124] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0081.124] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.124] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1
	[0081.124] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.124] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0081.124] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0
	[0081.124] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0081.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.124] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0081.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.124] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\favorites\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.211] GetFileType (hFile=0x5dc) returned 0x1
	[0081.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.211] GetFileType (hFile=0x5dc) returned 0x1
	[0081.211] WriteFile (in: hFile=0x5dc, lpBuffer=0x259ab5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259ab5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.212] CloseHandle (hObject=0x5dc) returned 1
	[0081.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15
	[0081.212] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0081.212] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.212] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.212] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1
	[0081.212] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1
	[0081.212] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1
	[0081.213] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0
	[0081.213] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0081.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15
	[0081.213] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0081.213] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.213] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.213] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1
	[0081.213] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1
	[0081.213] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1
	[0081.213] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0081.213] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0081.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Decrypt.txt", lpFilePart=0x0) returned 0x21
	[0081.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.214] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\links\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.214] GetFileType (hFile=0x5dc) returned 0x1
	[0081.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.214] GetFileType (hFile=0x5dc) returned 0x1
	[0081.214] WriteFile (in: hFile=0x5dc, lpBuffer=0x259e20c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259e20c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.215] CloseHandle (hObject=0x5dc) returned 1
	[0081.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.215] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Local Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Local Settings", lpFilePart=0x0) returned 0x1e
	[0081.215] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Local Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.216] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Local Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Local Settings", lpFilePart=0x0) returned 0x1e
	[0081.216] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Local Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.217] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Local Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Local Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x2a
	[0081.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.218] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Local Settings\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\local settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.218] GetFileType (hFile=0x5dc) returned 0x1
	[0081.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.218] GetFileType (hFile=0x5dc) returned 0x1
	[0081.218] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a1298*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a1298*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.219] CloseHandle (hObject=0x5dc) returned 1
	[0081.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.219] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15
	[0081.219] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d4b40a6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d4b40a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0081.219] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d4b40a6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d4b40a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.219] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb6ae10, ftCreationTime.dwHighDateTime=0x1d4cbfe, ftLastAccessTime.dwLowDateTime=0xd296fce0, ftLastAccessTime.dwHighDateTime=0x1d4ca72, ftLastWriteTime.dwLowDateTime=0xd296fce0, ftLastWriteTime.dwHighDateTime=0x1d4ca72, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="6V6hCB-lOnsKGcwNZWQF.wav", cAlternateFileName="6V6HCB~1.WAV")) returned 1
	[0081.219] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bef70e0, ftCreationTime.dwHighDateTime=0x1d4c7db, ftLastAccessTime.dwLowDateTime=0xe04b9a60, ftLastAccessTime.dwHighDateTime=0x1d4c5c4, ftLastWriteTime.dwLowDateTime=0xe04b9a60, ftLastWriteTime.dwHighDateTime=0x1d4c5c4, nFileSizeHigh=0x0, nFileSizeLow=0x16bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="bXH qJF.wav", cAlternateFileName="BXHQJF~1.WAV")) returned 1
	[0081.219] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.220] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x344455d0, ftCreationTime.dwHighDateTime=0x1d4cd6d, ftLastAccessTime.dwLowDateTime=0xd1719b0, ftLastAccessTime.dwHighDateTime=0x1d4c963, ftLastWriteTime.dwLowDateTime=0xd1719b0, ftLastWriteTime.dwHighDateTime=0x1d4c963, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nCaY_RHIYTRM2m91L", cAlternateFileName="NCAY_R~1")) returned 1
	[0081.220] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d28f520, ftCreationTime.dwHighDateTime=0x1d4c908, ftLastAccessTime.dwLowDateTime=0x6f3dfb80, ftLastAccessTime.dwHighDateTime=0x1d4d157, ftLastWriteTime.dwLowDateTime=0x6f3dfb80, ftLastWriteTime.dwHighDateTime=0x1d4d157, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q Wq-DMID", cAlternateFileName="QWQ-DM~1")) returned 1
	[0081.220] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ccbb310, ftCreationTime.dwHighDateTime=0x1d4cef9, ftLastAccessTime.dwLowDateTime=0x54972f0, ftLastAccessTime.dwHighDateTime=0x1d4cf2b, ftLastWriteTime.dwLowDateTime=0x54972f0, ftLastWriteTime.dwHighDateTime=0x1d4cf2b, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sJo78JJMGHrLZ.mp3", cAlternateFileName="SJO78J~1.MP3")) returned 1
	[0081.220] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8908ca90, ftCreationTime.dwHighDateTime=0x1d4d184, ftLastAccessTime.dwLowDateTime=0xbc245600, ftLastAccessTime.dwHighDateTime=0x1d4ce15, ftLastWriteTime.dwLowDateTime=0xbc245600, ftLastWriteTime.dwHighDateTime=0x1d4ce15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uI54EJtX8q8Aq9o", cAlternateFileName="UI54EJ~1")) returned 1
	[0081.220] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3165bf0, ftCreationTime.dwHighDateTime=0x1d4d1c0, ftLastAccessTime.dwLowDateTime=0xfffa1f30, ftLastAccessTime.dwHighDateTime=0x1d4cb19, ftLastWriteTime.dwLowDateTime=0xfffa1f30, ftLastWriteTime.dwHighDateTime=0x1d4cb19, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wi16N", cAlternateFileName="")) returned 1
	[0081.220] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0081.220] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0081.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.220] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15
	[0081.220] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d4b40a6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d4b40a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0081.221] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d4b40a6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d4b40a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.221] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb6ae10, ftCreationTime.dwHighDateTime=0x1d4cbfe, ftLastAccessTime.dwLowDateTime=0xd296fce0, ftLastAccessTime.dwHighDateTime=0x1d4ca72, ftLastWriteTime.dwLowDateTime=0xd296fce0, ftLastWriteTime.dwHighDateTime=0x1d4ca72, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="6V6hCB-lOnsKGcwNZWQF.wav", cAlternateFileName="6V6HCB~1.WAV")) returned 1
	[0081.221] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bef70e0, ftCreationTime.dwHighDateTime=0x1d4c7db, ftLastAccessTime.dwLowDateTime=0xe04b9a60, ftLastAccessTime.dwHighDateTime=0x1d4c5c4, ftLastWriteTime.dwLowDateTime=0xe04b9a60, ftLastWriteTime.dwHighDateTime=0x1d4c5c4, nFileSizeHigh=0x0, nFileSizeLow=0x16bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="bXH qJF.wav", cAlternateFileName="BXHQJF~1.WAV")) returned 1
	[0081.221] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.221] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x344455d0, ftCreationTime.dwHighDateTime=0x1d4cd6d, ftLastAccessTime.dwLowDateTime=0xd1719b0, ftLastAccessTime.dwHighDateTime=0x1d4c963, ftLastWriteTime.dwLowDateTime=0xd1719b0, ftLastWriteTime.dwHighDateTime=0x1d4c963, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nCaY_RHIYTRM2m91L", cAlternateFileName="NCAY_R~1")) returned 1
	[0081.221] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d28f520, ftCreationTime.dwHighDateTime=0x1d4c908, ftLastAccessTime.dwLowDateTime=0x6f3dfb80, ftLastAccessTime.dwHighDateTime=0x1d4d157, ftLastWriteTime.dwLowDateTime=0x6f3dfb80, ftLastWriteTime.dwHighDateTime=0x1d4d157, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q Wq-DMID", cAlternateFileName="QWQ-DM~1")) returned 1
	[0081.221] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ccbb310, ftCreationTime.dwHighDateTime=0x1d4cef9, ftLastAccessTime.dwLowDateTime=0x54972f0, ftLastAccessTime.dwHighDateTime=0x1d4cf2b, ftLastWriteTime.dwLowDateTime=0x54972f0, ftLastWriteTime.dwHighDateTime=0x1d4cf2b, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sJo78JJMGHrLZ.mp3", cAlternateFileName="SJO78J~1.MP3")) returned 1
	[0081.221] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8908ca90, ftCreationTime.dwHighDateTime=0x1d4d184, ftLastAccessTime.dwLowDateTime=0xbc245600, ftLastAccessTime.dwHighDateTime=0x1d4ce15, ftLastWriteTime.dwLowDateTime=0xbc245600, ftLastWriteTime.dwHighDateTime=0x1d4ce15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uI54EJtX8q8Aq9o", cAlternateFileName="UI54EJ~1")) returned 1
	[0081.222] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3165bf0, ftCreationTime.dwHighDateTime=0x1d4d1c0, ftLastAccessTime.dwLowDateTime=0xfffa1f30, ftLastAccessTime.dwHighDateTime=0x1d4cb19, ftLastWriteTime.dwLowDateTime=0xfffa1f30, ftLastWriteTime.dwHighDateTime=0x1d4cb19, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wi16N", cAlternateFileName="")) returned 1
	[0081.222] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3165bf0, ftCreationTime.dwHighDateTime=0x1d4d1c0, ftLastAccessTime.dwLowDateTime=0xfffa1f30, ftLastAccessTime.dwHighDateTime=0x1d4cb19, ftLastWriteTime.dwLowDateTime=0xfffa1f30, ftLastWriteTime.dwHighDateTime=0x1d4cb19, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wi16N", cAlternateFileName="")) returned 0
	[0081.222] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0081.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.222] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Decrypt.txt", lpFilePart=0x0) returned 0x21
	[0081.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.222] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\music\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.222] GetFileType (hFile=0x5dc) returned 0x1
	[0081.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.222] GetFileType (hFile=0x5dc) returned 0x1
	[0081.222] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a534c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a534c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.223] CloseHandle (hObject=0x5dc) returned 1
	[0081.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.223] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\My Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\My Documents", lpFilePart=0x0) returned 0x1c
	[0081.223] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\My Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.225] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\My Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\My Documents", lpFilePart=0x0) returned 0x1c
	[0081.225] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\My Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.226] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\My Documents\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\My Documents\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0081.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.226] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\My Documents\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\my documents\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.227] GetFileType (hFile=0x5dc) returned 0x1
	[0081.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.227] GetFileType (hFile=0x5dc) returned 0x1
	[0081.227] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a8390*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a8390*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.227] CloseHandle (hObject=0x5dc) returned 1
	[0081.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.228] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\NetHood", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\NetHood", lpFilePart=0x0) returned 0x17
	[0081.228] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\NetHood\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.229] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\NetHood", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\NetHood", lpFilePart=0x0) returned 0x17
	[0081.229] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\NetHood\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.230] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\NetHood\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\NetHood\\Decrypt.txt", lpFilePart=0x0) returned 0x23
	[0081.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.230] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NetHood\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\nethood\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.231] GetFileType (hFile=0x5dc) returned 0x1
	[0081.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.231] GetFileType (hFile=0x5dc) returned 0x1
	[0081.231] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ab2fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ab2fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.232] CloseHandle (hObject=0x5dc) returned 1
	[0081.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.232] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18
	[0081.232] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0081.232] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.232] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.233] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0081.233] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0081.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18
	[0081.233] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0081.233] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.233] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.233] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0081.233] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0081.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.234] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0081.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.234] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\onedrive\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.234] GetFileType (hFile=0x5dc) returned 0x1
	[0081.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.234] GetFileType (hFile=0x5dc) returned 0x1
	[0081.234] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ae428*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ae428*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.235] CloseHandle (hObject=0x5dc) returned 1
	[0081.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.235] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18
	[0081.235] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d5e5413, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d5e5413, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0081.235] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d5e5413, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d5e5413, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.235] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7232b90, ftCreationTime.dwHighDateTime=0x1d4c5cd, ftLastAccessTime.dwLowDateTime=0x2c306e40, ftLastAccessTime.dwHighDateTime=0x1d4cfc7, ftLastWriteTime.dwLowDateTime=0x2c306e40, ftLastWriteTime.dwHighDateTime=0x1d4cfc7, nFileSizeHigh=0x0, nFileSizeLow=0x355a, dwReserved0=0x0, dwReserved1=0x0, cFileName="5qJGIHqRkn_7.jpg", cAlternateFileName="5QJGIH~1.JPG")) returned 1
	[0081.236] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26e10, ftCreationTime.dwHighDateTime=0x1d4ce6f, ftLastAccessTime.dwLowDateTime=0x49188940, ftLastAccessTime.dwHighDateTime=0x1d4c638, ftLastWriteTime.dwLowDateTime=0x49188940, ftLastWriteTime.dwHighDateTime=0x1d4c638, nFileSizeHigh=0x0, nFileSizeLow=0x8677, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Fz86lnEj.png", cAlternateFileName="9FZ86L~1.PNG")) returned 1
	[0081.236] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfeb5cd0, ftCreationTime.dwHighDateTime=0x1d4d308, ftLastAccessTime.dwLowDateTime=0xdce35510, ftLastAccessTime.dwHighDateTime=0x1d4c9d5, ftLastWriteTime.dwLowDateTime=0xdce35510, ftLastWriteTime.dwHighDateTime=0x1d4c9d5, nFileSizeHigh=0x0, nFileSizeLow=0x102b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c491ojXkX.gif", cAlternateFileName="C491OJ~1.GIF")) returned 1
	[0081.236] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1
	[0081.236] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7068ad0, ftCreationTime.dwHighDateTime=0x1d4d492, ftLastAccessTime.dwLowDateTime=0xc01df60, ftLastAccessTime.dwHighDateTime=0x1d4d4b7, ftLastWriteTime.dwLowDateTime=0xc01df60, ftLastWriteTime.dwHighDateTime=0x1d4d4b7, nFileSizeHigh=0x0, nFileSizeLow=0x14b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPbP l3.jpg", cAlternateFileName="CPBPL3~1.JPG")) returned 1
	[0081.236] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.236] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x464ef1a0, ftCreationTime.dwHighDateTime=0x1d4d591, ftLastAccessTime.dwLowDateTime=0xd6897db0, ftLastAccessTime.dwHighDateTime=0x1d4ca7b, ftLastWriteTime.dwLowDateTime=0xd6897db0, ftLastWriteTime.dwHighDateTime=0x1d4ca7b, nFileSizeHigh=0x0, nFileSizeLow=0xfec5, dwReserved0=0x0, dwReserved1=0x0, cFileName="e7jrLUSkcu.bmp", cAlternateFileName="E7JRLU~1.BMP")) returned 1
	[0081.236] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d060890, ftCreationTime.dwHighDateTime=0x1d4d334, ftLastAccessTime.dwLowDateTime=0x604ce5a0, ftLastAccessTime.dwHighDateTime=0x1d4d300, ftLastWriteTime.dwLowDateTime=0x604ce5a0, ftLastWriteTime.dwHighDateTime=0x1d4d300, nFileSizeHigh=0x0, nFileSizeLow=0x13dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Etp9d.png", cAlternateFileName="")) returned 1
	[0081.236] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62d69e50, ftCreationTime.dwHighDateTime=0x1d4c73a, ftLastAccessTime.dwLowDateTime=0x4f2d7b70, ftLastAccessTime.dwHighDateTime=0x1d4cdc1, ftLastWriteTime.dwLowDateTime=0x4f2d7b70, ftLastWriteTime.dwHighDateTime=0x1d4cdc1, nFileSizeHigh=0x0, nFileSizeLow=0x3cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="feK6eZdtcihugZTGOdx.jpg", cAlternateFileName="FEK6EZ~1.JPG")) returned 1
	[0081.237] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec452800, ftCreationTime.dwHighDateTime=0x1d4ced8, ftLastAccessTime.dwLowDateTime=0x9ade9ef0, ftLastAccessTime.dwHighDateTime=0x1d4c88a, ftLastWriteTime.dwLowDateTime=0x9ade9ef0, ftLastWriteTime.dwHighDateTime=0x1d4c88a, nFileSizeHigh=0x0, nFileSizeLow=0x1314d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HZg79A8F_.bmp", cAlternateFileName="HZG79A~1.BMP")) returned 1
	[0081.237] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce137420, ftCreationTime.dwHighDateTime=0x1d4d484, ftLastAccessTime.dwLowDateTime=0x86e5d760, ftLastAccessTime.dwHighDateTime=0x1d4c86c, ftLastWriteTime.dwLowDateTime=0x86e5d760, ftLastWriteTime.dwHighDateTime=0x1d4c86c, nFileSizeHigh=0x0, nFileSizeLow=0xf734, dwReserved0=0x0, dwReserved1=0x0, cFileName="I2pBbseix4zH9h0O.png", cAlternateFileName="I2PBBS~1.PNG")) returned 1
	[0081.237] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28ef2ee0, ftCreationTime.dwHighDateTime=0x1d4cb46, ftLastAccessTime.dwLowDateTime=0xe1d1a40, ftLastAccessTime.dwHighDateTime=0x1d4cd90, ftLastWriteTime.dwLowDateTime=0xe1d1a40, ftLastWriteTime.dwHighDateTime=0x1d4cd90, nFileSizeHigh=0x0, nFileSizeLow=0xf682, dwReserved0=0x0, dwReserved1=0x0, cFileName="IGHtIf.jpg", cAlternateFileName="")) returned 1
	[0081.237] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76358d60, ftCreationTime.dwHighDateTime=0x1d4d52e, ftLastAccessTime.dwLowDateTime=0xc9785a00, ftLastAccessTime.dwHighDateTime=0x1d4d288, ftLastWriteTime.dwLowDateTime=0xc9785a00, ftLastWriteTime.dwHighDateTime=0x1d4d288, nFileSizeHigh=0x0, nFileSizeLow=0xac49, dwReserved0=0x0, dwReserved1=0x0, cFileName="IWZ I6.jpg", cAlternateFileName="IWZI6~1.JPG")) returned 1
	[0081.237] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4732f0, ftCreationTime.dwHighDateTime=0x1d4d1bc, ftLastAccessTime.dwLowDateTime=0xddc7ee40, ftLastAccessTime.dwHighDateTime=0x1d4ca0d, ftLastWriteTime.dwLowDateTime=0xddc7ee40, ftLastWriteTime.dwHighDateTime=0x1d4ca0d, nFileSizeHigh=0x0, nFileSizeLow=0x161b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="jFSAbdgB9yYH.png", cAlternateFileName="JFSABD~1.PNG")) returned 1
	[0081.237] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c22930, ftCreationTime.dwHighDateTime=0x1d4cfa7, ftLastAccessTime.dwLowDateTime=0x9ee9dcd0, ftLastAccessTime.dwHighDateTime=0x1d4d073, ftLastWriteTime.dwLowDateTime=0x9ee9dcd0, ftLastWriteTime.dwHighDateTime=0x1d4d073, nFileSizeHigh=0x0, nFileSizeLow=0x6fb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqgFIqnpvOvLZD_z-.gif", cAlternateFileName="JQGFIQ~1.GIF")) returned 1
	[0081.237] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c95810, ftCreationTime.dwHighDateTime=0x1d4c870, ftLastAccessTime.dwLowDateTime=0xa902e690, ftLastAccessTime.dwHighDateTime=0x1d4cbd1, ftLastWriteTime.dwLowDateTime=0xa902e690, ftLastWriteTime.dwHighDateTime=0x1d4cbd1, nFileSizeHigh=0x0, nFileSizeLow=0x14329, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kedz whkLKbTy18N6CKQ.jpg", cAlternateFileName="KEDZWH~1.JPG")) returned 1
	[0081.237] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d74ea0, ftCreationTime.dwHighDateTime=0x1d4cdd7, ftLastAccessTime.dwLowDateTime=0xe21447f0, ftLastAccessTime.dwHighDateTime=0x1d4ce81, ftLastWriteTime.dwLowDateTime=0xe21447f0, ftLastWriteTime.dwHighDateTime=0x1d4ce81, nFileSizeHigh=0x0, nFileSizeLow=0x164ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="kggVr-zfra9Y39.png", cAlternateFileName="KGGVR-~1.PNG")) returned 1
	[0081.238] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4acdd0, ftCreationTime.dwHighDateTime=0x1d4c7a5, ftLastAccessTime.dwLowDateTime=0xcc7e8910, ftLastAccessTime.dwHighDateTime=0x1d4cc7d, ftLastWriteTime.dwLowDateTime=0xcc7e8910, ftLastWriteTime.dwHighDateTime=0x1d4cc7d, nFileSizeHigh=0x0, nFileSizeLow=0x401b, dwReserved0=0x0, dwReserved1=0x0, cFileName="KrShyFIlgyBtDZE.png", cAlternateFileName="KRSHYF~1.PNG")) returned 1
	[0081.238] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2982d2b0, ftCreationTime.dwHighDateTime=0x1d4ca9e, ftLastAccessTime.dwLowDateTime=0x16bd9930, ftLastAccessTime.dwHighDateTime=0x1d4ca6c, ftLastWriteTime.dwLowDateTime=0x16bd9930, ftLastWriteTime.dwHighDateTime=0x1d4ca6c, nFileSizeHigh=0x0, nFileSizeLow=0x108b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LRuwaScqtt_ZeF951g6L.jpg", cAlternateFileName="LRUWAS~1.JPG")) returned 1
	[0081.238] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf370970, ftCreationTime.dwHighDateTime=0x1d4c7ae, ftLastAccessTime.dwLowDateTime=0x4bf31d60, ftLastAccessTime.dwHighDateTime=0x1d4ca52, ftLastWriteTime.dwLowDateTime=0x4bf31d60, ftLastWriteTime.dwHighDateTime=0x1d4ca52, nFileSizeHigh=0x0, nFileSizeLow=0x20a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="M8_xKM9Cvc34P8CxhM.gif", cAlternateFileName="M8_XKM~1.GIF")) returned 1
	[0081.238] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5acd0e0, ftCreationTime.dwHighDateTime=0x1d4c952, ftLastAccessTime.dwLowDateTime=0x611494a0, ftLastAccessTime.dwHighDateTime=0x1d4c78a, ftLastWriteTime.dwLowDateTime=0x611494a0, ftLastWriteTime.dwHighDateTime=0x1d4c78a, nFileSizeHigh=0x0, nFileSizeLow=0x7d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="mhpWTamFyl.gif", cAlternateFileName="MHPWTA~1.GIF")) returned 1
	[0081.238] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd9e910, ftCreationTime.dwHighDateTime=0x1d4cd60, ftLastAccessTime.dwLowDateTime=0xade6ccb0, ftLastAccessTime.dwHighDateTime=0x1d4c8ef, ftLastWriteTime.dwLowDateTime=0xade6ccb0, ftLastWriteTime.dwHighDateTime=0x1d4c8ef, nFileSizeHigh=0x0, nFileSizeLow=0xfe8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntZbINu6VQNQRAUq.bmp", cAlternateFileName="NTZBIN~1.BMP")) returned 1
	[0081.238] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c517170, ftCreationTime.dwHighDateTime=0x1d4ce94, ftLastAccessTime.dwLowDateTime=0x5ef5f7c0, ftLastAccessTime.dwHighDateTime=0x1d4d42a, ftLastWriteTime.dwLowDateTime=0x5ef5f7c0, ftLastWriteTime.dwHighDateTime=0x1d4d42a, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x0, dwReserved1=0x0, cFileName="oTI H5UbvP4xzwE2u.gif", cAlternateFileName="OTIH5U~1.GIF")) returned 1
	[0081.239] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd17a0, ftCreationTime.dwHighDateTime=0x1d4d583, ftLastAccessTime.dwLowDateTime=0x8e218e20, ftLastAccessTime.dwHighDateTime=0x1d4c664, ftLastWriteTime.dwLowDateTime=0x8e218e20, ftLastWriteTime.dwHighDateTime=0x1d4c664, nFileSizeHigh=0x0, nFileSizeLow=0xc447, dwReserved0=0x0, dwReserved1=0x0, cFileName="OtqYOXFE34cNlmL.bmp", cAlternateFileName="OTQYOX~1.BMP")) returned 1
	[0081.239] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310e8b20, ftCreationTime.dwHighDateTime=0x1d4c8cb, ftLastAccessTime.dwLowDateTime=0xf9517aa0, ftLastAccessTime.dwHighDateTime=0x1d4d309, ftLastWriteTime.dwLowDateTime=0xf9517aa0, ftLastWriteTime.dwHighDateTime=0x1d4d309, nFileSizeHigh=0x0, nFileSizeLow=0x6cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="q4J6.png", cAlternateFileName="")) returned 1
	[0081.239] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ad1e70, ftCreationTime.dwHighDateTime=0x1d4c6b8, ftLastAccessTime.dwLowDateTime=0x7a5b3850, ftLastAccessTime.dwHighDateTime=0x1d4cb14, ftLastWriteTime.dwLowDateTime=0x7a5b3850, ftLastWriteTime.dwHighDateTime=0x1d4cb14, nFileSizeHigh=0x0, nFileSizeLow=0x12bef, dwReserved0=0x0, dwReserved1=0x0, cFileName="QQnoTkQ9iJ4jqTpr9Bs.gif", cAlternateFileName="QQNOTK~1.GIF")) returned 1
	[0081.239] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1
	[0081.239] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0319a30, ftCreationTime.dwHighDateTime=0x1d4c844, ftLastAccessTime.dwLowDateTime=0x1b854790, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0x1b854790, ftLastWriteTime.dwHighDateTime=0x1d4cc26, nFileSizeHigh=0x0, nFileSizeLow=0xbca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SZ_pP5VqM.bmp", cAlternateFileName="SZ_PP5~1.BMP")) returned 1
	[0081.239] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61902da0, ftCreationTime.dwHighDateTime=0x1d4c7d4, ftLastAccessTime.dwLowDateTime=0xa67922f0, ftLastAccessTime.dwHighDateTime=0x1d4cd88, ftLastWriteTime.dwLowDateTime=0xa67922f0, ftLastWriteTime.dwHighDateTime=0x1d4cd88, nFileSizeHigh=0x0, nFileSizeLow=0x15e68, dwReserved0=0x0, dwReserved1=0x0, cFileName="tijFE9VvGlZRW8SE.jpg", cAlternateFileName="TIJFE9~1.JPG")) returned 1
	[0081.239] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ca15000, ftCreationTime.dwHighDateTime=0x1d4d1ab, ftLastAccessTime.dwLowDateTime=0x343225d0, ftLastAccessTime.dwHighDateTime=0x1d4c869, ftLastWriteTime.dwLowDateTime=0x343225d0, ftLastWriteTime.dwHighDateTime=0x1d4c869, nFileSizeHigh=0x0, nFileSizeLow=0x142d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TzAclKw0M.jpg", cAlternateFileName="TZACLK~1.JPG")) returned 1
	[0081.240] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7f9a820, ftCreationTime.dwHighDateTime=0x1d4cacc, ftLastAccessTime.dwLowDateTime=0x92491b00, ftLastAccessTime.dwHighDateTime=0x1d4c815, ftLastWriteTime.dwLowDateTime=0x92491b00, ftLastWriteTime.dwHighDateTime=0x1d4c815, nFileSizeHigh=0x0, nFileSizeLow=0x16f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="t_re9H.bmp", cAlternateFileName="")) returned 1
	[0081.240] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720e05e0, ftCreationTime.dwHighDateTime=0x1d4d11f, ftLastAccessTime.dwLowDateTime=0xdfcedaf0, ftLastAccessTime.dwHighDateTime=0x1d4cdb4, ftLastWriteTime.dwLowDateTime=0xdfcedaf0, ftLastWriteTime.dwHighDateTime=0x1d4cdb4, nFileSizeHigh=0x0, nFileSizeLow=0x962a, dwReserved0=0x0, dwReserved1=0x0, cFileName="uST.gif", cAlternateFileName="")) returned 1
	[0081.240] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b89c5f0, ftCreationTime.dwHighDateTime=0x1d4d0bc, ftLastAccessTime.dwLowDateTime=0x6d17c380, ftLastAccessTime.dwHighDateTime=0x1d4cf0f, ftLastWriteTime.dwLowDateTime=0x6d17c380, ftLastWriteTime.dwHighDateTime=0x1d4cf0f, nFileSizeHigh=0x0, nFileSizeLow=0x18ce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="vlex.gif", cAlternateFileName="")) returned 1
	[0081.240] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4161330, ftCreationTime.dwHighDateTime=0x1d4cdb6, ftLastAccessTime.dwLowDateTime=0xf6479190, ftLastAccessTime.dwHighDateTime=0x1d4cc5c, ftLastWriteTime.dwLowDateTime=0xf6479190, ftLastWriteTime.dwHighDateTime=0x1d4cc5c, nFileSizeHigh=0x0, nFileSizeLow=0xe1e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="X EyiYzuSSTvExN83.png", cAlternateFileName="XEYIYZ~1.PNG")) returned 1
	[0081.240] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2134e80, ftCreationTime.dwHighDateTime=0x1d4c849, ftLastAccessTime.dwLowDateTime=0x3c2c5120, ftLastAccessTime.dwHighDateTime=0x1d4d052, ftLastWriteTime.dwLowDateTime=0x3c2c5120, ftLastWriteTime.dwHighDateTime=0x1d4d052, nFileSizeHigh=0x0, nFileSizeLow=0x6ee3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y1Dqbk.gif", cAlternateFileName="")) returned 1
	[0081.240] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee7a0, ftCreationTime.dwHighDateTime=0x1d4c603, ftLastAccessTime.dwLowDateTime=0x3bb31a00, ftLastAccessTime.dwHighDateTime=0x1d4cae2, ftLastWriteTime.dwLowDateTime=0x3bb31a00, ftLastWriteTime.dwHighDateTime=0x1d4cae2, nFileSizeHigh=0x0, nFileSizeLow=0x851e, dwReserved0=0x0, dwReserved1=0x0, cFileName="y3ns.png", cAlternateFileName="")) returned 1
	[0081.240] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c3bcda0, ftCreationTime.dwHighDateTime=0x1d4cce7, ftLastAccessTime.dwLowDateTime=0xb3939b20, ftLastAccessTime.dwHighDateTime=0x1d4cdef, ftLastWriteTime.dwLowDateTime=0xb3939b20, ftLastWriteTime.dwHighDateTime=0x1d4cdef, nFileSizeHigh=0x0, nFileSizeLow=0xab36, dwReserved0=0x0, dwReserved1=0x0, cFileName="yzjSQ0dyPgU.bmp", cAlternateFileName="YZJSQ0~1.BMP")) returned 1
	[0081.241] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c93550, ftCreationTime.dwHighDateTime=0x1d4c656, ftLastAccessTime.dwLowDateTime=0x25ea7800, ftLastAccessTime.dwHighDateTime=0x1d4d265, ftLastWriteTime.dwLowDateTime=0x25ea7800, ftLastWriteTime.dwHighDateTime=0x1d4d265, nFileSizeHigh=0x0, nFileSizeLow=0xa26e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZknDe12VuTUg6otSbga.png", cAlternateFileName="ZKNDE1~1.PNG")) returned 1
	[0081.241] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdede6ee0, ftCreationTime.dwHighDateTime=0x1d4c7be, ftLastAccessTime.dwLowDateTime=0x60ac4200, ftLastAccessTime.dwHighDateTime=0x1d4c7ef, ftLastWriteTime.dwLowDateTime=0x60ac4200, ftLastWriteTime.dwHighDateTime=0x1d4c7ef, nFileSizeHigh=0x0, nFileSizeLow=0x28de, dwReserved0=0x0, dwReserved1=0x0, cFileName="zQw5BOj24vCxjewHw1.png", cAlternateFileName="ZQW5BO~1.PNG")) returned 1
	[0081.241] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdf045d0, ftCreationTime.dwHighDateTime=0x1d4cfa9, ftLastAccessTime.dwLowDateTime=0x8612b3e0, ftLastAccessTime.dwHighDateTime=0x1d4c582, ftLastWriteTime.dwLowDateTime=0x8612b3e0, ftLastWriteTime.dwHighDateTime=0x1d4c582, nFileSizeHigh=0x0, nFileSizeLow=0x5b1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zv3Cyst6OSxrOPBB5.gif", cAlternateFileName="ZV3CYS~1.GIF")) returned 1
	[0081.241] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa10e3160, ftCreationTime.dwHighDateTime=0x1d4caaa, ftLastAccessTime.dwLowDateTime=0x548a29e0, ftLastAccessTime.dwHighDateTime=0x1d4d539, ftLastWriteTime.dwLowDateTime=0x548a29e0, ftLastWriteTime.dwHighDateTime=0x1d4d539, nFileSizeHigh=0x0, nFileSizeLow=0xa376, dwReserved0=0x0, dwReserved1=0x0, cFileName="_jpEbCfhotvRhFf_.jpg", cAlternateFileName="_JPEBC~1.JPG")) returned 1
	[0081.241] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa10e3160, ftCreationTime.dwHighDateTime=0x1d4caaa, ftLastAccessTime.dwLowDateTime=0x548a29e0, ftLastAccessTime.dwHighDateTime=0x1d4d539, ftLastWriteTime.dwLowDateTime=0x548a29e0, ftLastWriteTime.dwHighDateTime=0x1d4d539, nFileSizeHigh=0x0, nFileSizeLow=0xa376, dwReserved0=0x0, dwReserved1=0x0, cFileName="_jpEbCfhotvRhFf_.jpg", cAlternateFileName="_JPEBC~1.JPG")) returned 0
	[0081.241] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0081.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18
	[0081.242] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d5e5413, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d5e5413, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0081.242] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d5e5413, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d5e5413, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.242] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7232b90, ftCreationTime.dwHighDateTime=0x1d4c5cd, ftLastAccessTime.dwLowDateTime=0x2c306e40, ftLastAccessTime.dwHighDateTime=0x1d4cfc7, ftLastWriteTime.dwLowDateTime=0x2c306e40, ftLastWriteTime.dwHighDateTime=0x1d4cfc7, nFileSizeHigh=0x0, nFileSizeLow=0x355a, dwReserved0=0x0, dwReserved1=0x0, cFileName="5qJGIHqRkn_7.jpg", cAlternateFileName="5QJGIH~1.JPG")) returned 1
	[0081.242] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26e10, ftCreationTime.dwHighDateTime=0x1d4ce6f, ftLastAccessTime.dwLowDateTime=0x49188940, ftLastAccessTime.dwHighDateTime=0x1d4c638, ftLastWriteTime.dwLowDateTime=0x49188940, ftLastWriteTime.dwHighDateTime=0x1d4c638, nFileSizeHigh=0x0, nFileSizeLow=0x8677, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Fz86lnEj.png", cAlternateFileName="9FZ86L~1.PNG")) returned 1
	[0081.242] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfeb5cd0, ftCreationTime.dwHighDateTime=0x1d4d308, ftLastAccessTime.dwLowDateTime=0xdce35510, ftLastAccessTime.dwHighDateTime=0x1d4c9d5, ftLastWriteTime.dwLowDateTime=0xdce35510, ftLastWriteTime.dwHighDateTime=0x1d4c9d5, nFileSizeHigh=0x0, nFileSizeLow=0x102b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c491ojXkX.gif", cAlternateFileName="C491OJ~1.GIF")) returned 1
	[0081.242] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1
	[0081.243] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7068ad0, ftCreationTime.dwHighDateTime=0x1d4d492, ftLastAccessTime.dwLowDateTime=0xc01df60, ftLastAccessTime.dwHighDateTime=0x1d4d4b7, ftLastWriteTime.dwLowDateTime=0xc01df60, ftLastWriteTime.dwHighDateTime=0x1d4d4b7, nFileSizeHigh=0x0, nFileSizeLow=0x14b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPbP l3.jpg", cAlternateFileName="CPBPL3~1.JPG")) returned 1
	[0081.243] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.243] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x464ef1a0, ftCreationTime.dwHighDateTime=0x1d4d591, ftLastAccessTime.dwLowDateTime=0xd6897db0, ftLastAccessTime.dwHighDateTime=0x1d4ca7b, ftLastWriteTime.dwLowDateTime=0xd6897db0, ftLastWriteTime.dwHighDateTime=0x1d4ca7b, nFileSizeHigh=0x0, nFileSizeLow=0xfec5, dwReserved0=0x0, dwReserved1=0x0, cFileName="e7jrLUSkcu.bmp", cAlternateFileName="E7JRLU~1.BMP")) returned 1
	[0081.243] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d060890, ftCreationTime.dwHighDateTime=0x1d4d334, ftLastAccessTime.dwLowDateTime=0x604ce5a0, ftLastAccessTime.dwHighDateTime=0x1d4d300, ftLastWriteTime.dwLowDateTime=0x604ce5a0, ftLastWriteTime.dwHighDateTime=0x1d4d300, nFileSizeHigh=0x0, nFileSizeLow=0x13dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Etp9d.png", cAlternateFileName="")) returned 1
	[0081.243] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62d69e50, ftCreationTime.dwHighDateTime=0x1d4c73a, ftLastAccessTime.dwLowDateTime=0x4f2d7b70, ftLastAccessTime.dwHighDateTime=0x1d4cdc1, ftLastWriteTime.dwLowDateTime=0x4f2d7b70, ftLastWriteTime.dwHighDateTime=0x1d4cdc1, nFileSizeHigh=0x0, nFileSizeLow=0x3cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="feK6eZdtcihugZTGOdx.jpg", cAlternateFileName="FEK6EZ~1.JPG")) returned 1
	[0081.243] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec452800, ftCreationTime.dwHighDateTime=0x1d4ced8, ftLastAccessTime.dwLowDateTime=0x9ade9ef0, ftLastAccessTime.dwHighDateTime=0x1d4c88a, ftLastWriteTime.dwLowDateTime=0x9ade9ef0, ftLastWriteTime.dwHighDateTime=0x1d4c88a, nFileSizeHigh=0x0, nFileSizeLow=0x1314d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HZg79A8F_.bmp", cAlternateFileName="HZG79A~1.BMP")) returned 1
	[0081.243] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce137420, ftCreationTime.dwHighDateTime=0x1d4d484, ftLastAccessTime.dwLowDateTime=0x86e5d760, ftLastAccessTime.dwHighDateTime=0x1d4c86c, ftLastWriteTime.dwLowDateTime=0x86e5d760, ftLastWriteTime.dwHighDateTime=0x1d4c86c, nFileSizeHigh=0x0, nFileSizeLow=0xf734, dwReserved0=0x0, dwReserved1=0x0, cFileName="I2pBbseix4zH9h0O.png", cAlternateFileName="I2PBBS~1.PNG")) returned 1
	[0081.244] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28ef2ee0, ftCreationTime.dwHighDateTime=0x1d4cb46, ftLastAccessTime.dwLowDateTime=0xe1d1a40, ftLastAccessTime.dwHighDateTime=0x1d4cd90, ftLastWriteTime.dwLowDateTime=0xe1d1a40, ftLastWriteTime.dwHighDateTime=0x1d4cd90, nFileSizeHigh=0x0, nFileSizeLow=0xf682, dwReserved0=0x0, dwReserved1=0x0, cFileName="IGHtIf.jpg", cAlternateFileName="")) returned 1
	[0081.244] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76358d60, ftCreationTime.dwHighDateTime=0x1d4d52e, ftLastAccessTime.dwLowDateTime=0xc9785a00, ftLastAccessTime.dwHighDateTime=0x1d4d288, ftLastWriteTime.dwLowDateTime=0xc9785a00, ftLastWriteTime.dwHighDateTime=0x1d4d288, nFileSizeHigh=0x0, nFileSizeLow=0xac49, dwReserved0=0x0, dwReserved1=0x0, cFileName="IWZ I6.jpg", cAlternateFileName="IWZI6~1.JPG")) returned 1
	[0081.244] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4732f0, ftCreationTime.dwHighDateTime=0x1d4d1bc, ftLastAccessTime.dwLowDateTime=0xddc7ee40, ftLastAccessTime.dwHighDateTime=0x1d4ca0d, ftLastWriteTime.dwLowDateTime=0xddc7ee40, ftLastWriteTime.dwHighDateTime=0x1d4ca0d, nFileSizeHigh=0x0, nFileSizeLow=0x161b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="jFSAbdgB9yYH.png", cAlternateFileName="JFSABD~1.PNG")) returned 1
	[0081.244] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c22930, ftCreationTime.dwHighDateTime=0x1d4cfa7, ftLastAccessTime.dwLowDateTime=0x9ee9dcd0, ftLastAccessTime.dwHighDateTime=0x1d4d073, ftLastWriteTime.dwLowDateTime=0x9ee9dcd0, ftLastWriteTime.dwHighDateTime=0x1d4d073, nFileSizeHigh=0x0, nFileSizeLow=0x6fb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqgFIqnpvOvLZD_z-.gif", cAlternateFileName="JQGFIQ~1.GIF")) returned 1
	[0081.244] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c95810, ftCreationTime.dwHighDateTime=0x1d4c870, ftLastAccessTime.dwLowDateTime=0xa902e690, ftLastAccessTime.dwHighDateTime=0x1d4cbd1, ftLastWriteTime.dwLowDateTime=0xa902e690, ftLastWriteTime.dwHighDateTime=0x1d4cbd1, nFileSizeHigh=0x0, nFileSizeLow=0x14329, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kedz whkLKbTy18N6CKQ.jpg", cAlternateFileName="KEDZWH~1.JPG")) returned 1
	[0081.244] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d74ea0, ftCreationTime.dwHighDateTime=0x1d4cdd7, ftLastAccessTime.dwLowDateTime=0xe21447f0, ftLastAccessTime.dwHighDateTime=0x1d4ce81, ftLastWriteTime.dwLowDateTime=0xe21447f0, ftLastWriteTime.dwHighDateTime=0x1d4ce81, nFileSizeHigh=0x0, nFileSizeLow=0x164ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="kggVr-zfra9Y39.png", cAlternateFileName="KGGVR-~1.PNG")) returned 1
	[0081.244] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4acdd0, ftCreationTime.dwHighDateTime=0x1d4c7a5, ftLastAccessTime.dwLowDateTime=0xcc7e8910, ftLastAccessTime.dwHighDateTime=0x1d4cc7d, ftLastWriteTime.dwLowDateTime=0xcc7e8910, ftLastWriteTime.dwHighDateTime=0x1d4cc7d, nFileSizeHigh=0x0, nFileSizeLow=0x401b, dwReserved0=0x0, dwReserved1=0x0, cFileName="KrShyFIlgyBtDZE.png", cAlternateFileName="KRSHYF~1.PNG")) returned 1
	[0081.244] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2982d2b0, ftCreationTime.dwHighDateTime=0x1d4ca9e, ftLastAccessTime.dwLowDateTime=0x16bd9930, ftLastAccessTime.dwHighDateTime=0x1d4ca6c, ftLastWriteTime.dwLowDateTime=0x16bd9930, ftLastWriteTime.dwHighDateTime=0x1d4ca6c, nFileSizeHigh=0x0, nFileSizeLow=0x108b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LRuwaScqtt_ZeF951g6L.jpg", cAlternateFileName="LRUWAS~1.JPG")) returned 1
	[0081.244] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf370970, ftCreationTime.dwHighDateTime=0x1d4c7ae, ftLastAccessTime.dwLowDateTime=0x4bf31d60, ftLastAccessTime.dwHighDateTime=0x1d4ca52, ftLastWriteTime.dwLowDateTime=0x4bf31d60, ftLastWriteTime.dwHighDateTime=0x1d4ca52, nFileSizeHigh=0x0, nFileSizeLow=0x20a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="M8_xKM9Cvc34P8CxhM.gif", cAlternateFileName="M8_XKM~1.GIF")) returned 1
	[0081.245] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5acd0e0, ftCreationTime.dwHighDateTime=0x1d4c952, ftLastAccessTime.dwLowDateTime=0x611494a0, ftLastAccessTime.dwHighDateTime=0x1d4c78a, ftLastWriteTime.dwLowDateTime=0x611494a0, ftLastWriteTime.dwHighDateTime=0x1d4c78a, nFileSizeHigh=0x0, nFileSizeLow=0x7d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="mhpWTamFyl.gif", cAlternateFileName="MHPWTA~1.GIF")) returned 1
	[0081.245] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd9e910, ftCreationTime.dwHighDateTime=0x1d4cd60, ftLastAccessTime.dwLowDateTime=0xade6ccb0, ftLastAccessTime.dwHighDateTime=0x1d4c8ef, ftLastWriteTime.dwLowDateTime=0xade6ccb0, ftLastWriteTime.dwHighDateTime=0x1d4c8ef, nFileSizeHigh=0x0, nFileSizeLow=0xfe8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntZbINu6VQNQRAUq.bmp", cAlternateFileName="NTZBIN~1.BMP")) returned 1
	[0081.245] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c517170, ftCreationTime.dwHighDateTime=0x1d4ce94, ftLastAccessTime.dwLowDateTime=0x5ef5f7c0, ftLastAccessTime.dwHighDateTime=0x1d4d42a, ftLastWriteTime.dwLowDateTime=0x5ef5f7c0, ftLastWriteTime.dwHighDateTime=0x1d4d42a, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x0, dwReserved1=0x0, cFileName="oTI H5UbvP4xzwE2u.gif", cAlternateFileName="OTIH5U~1.GIF")) returned 1
	[0081.543] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd17a0, ftCreationTime.dwHighDateTime=0x1d4d583, ftLastAccessTime.dwLowDateTime=0x8e218e20, ftLastAccessTime.dwHighDateTime=0x1d4c664, ftLastWriteTime.dwLowDateTime=0x8e218e20, ftLastWriteTime.dwHighDateTime=0x1d4c664, nFileSizeHigh=0x0, nFileSizeLow=0xc447, dwReserved0=0x0, dwReserved1=0x0, cFileName="OtqYOXFE34cNlmL.bmp", cAlternateFileName="OTQYOX~1.BMP")) returned 1
	[0081.543] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310e8b20, ftCreationTime.dwHighDateTime=0x1d4c8cb, ftLastAccessTime.dwLowDateTime=0xf9517aa0, ftLastAccessTime.dwHighDateTime=0x1d4d309, ftLastWriteTime.dwLowDateTime=0xf9517aa0, ftLastWriteTime.dwHighDateTime=0x1d4d309, nFileSizeHigh=0x0, nFileSizeLow=0x6cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="q4J6.png", cAlternateFileName="")) returned 1
	[0081.543] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ad1e70, ftCreationTime.dwHighDateTime=0x1d4c6b8, ftLastAccessTime.dwLowDateTime=0x7a5b3850, ftLastAccessTime.dwHighDateTime=0x1d4cb14, ftLastWriteTime.dwLowDateTime=0x7a5b3850, ftLastWriteTime.dwHighDateTime=0x1d4cb14, nFileSizeHigh=0x0, nFileSizeLow=0x12bef, dwReserved0=0x0, dwReserved1=0x0, cFileName="QQnoTkQ9iJ4jqTpr9Bs.gif", cAlternateFileName="QQNOTK~1.GIF")) returned 1
	[0081.544] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1
	[0081.544] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0319a30, ftCreationTime.dwHighDateTime=0x1d4c844, ftLastAccessTime.dwLowDateTime=0x1b854790, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0x1b854790, ftLastWriteTime.dwHighDateTime=0x1d4cc26, nFileSizeHigh=0x0, nFileSizeLow=0xbca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SZ_pP5VqM.bmp", cAlternateFileName="SZ_PP5~1.BMP")) returned 1
	[0081.544] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61902da0, ftCreationTime.dwHighDateTime=0x1d4c7d4, ftLastAccessTime.dwLowDateTime=0xa67922f0, ftLastAccessTime.dwHighDateTime=0x1d4cd88, ftLastWriteTime.dwLowDateTime=0xa67922f0, ftLastWriteTime.dwHighDateTime=0x1d4cd88, nFileSizeHigh=0x0, nFileSizeLow=0x15e68, dwReserved0=0x0, dwReserved1=0x0, cFileName="tijFE9VvGlZRW8SE.jpg", cAlternateFileName="TIJFE9~1.JPG")) returned 1
	[0081.544] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ca15000, ftCreationTime.dwHighDateTime=0x1d4d1ab, ftLastAccessTime.dwLowDateTime=0x343225d0, ftLastAccessTime.dwHighDateTime=0x1d4c869, ftLastWriteTime.dwLowDateTime=0x343225d0, ftLastWriteTime.dwHighDateTime=0x1d4c869, nFileSizeHigh=0x0, nFileSizeLow=0x142d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TzAclKw0M.jpg", cAlternateFileName="TZACLK~1.JPG")) returned 1
	[0081.544] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7f9a820, ftCreationTime.dwHighDateTime=0x1d4cacc, ftLastAccessTime.dwLowDateTime=0x92491b00, ftLastAccessTime.dwHighDateTime=0x1d4c815, ftLastWriteTime.dwLowDateTime=0x92491b00, ftLastWriteTime.dwHighDateTime=0x1d4c815, nFileSizeHigh=0x0, nFileSizeLow=0x16f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="t_re9H.bmp", cAlternateFileName="")) returned 1
	[0081.544] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720e05e0, ftCreationTime.dwHighDateTime=0x1d4d11f, ftLastAccessTime.dwLowDateTime=0xdfcedaf0, ftLastAccessTime.dwHighDateTime=0x1d4cdb4, ftLastWriteTime.dwLowDateTime=0xdfcedaf0, ftLastWriteTime.dwHighDateTime=0x1d4cdb4, nFileSizeHigh=0x0, nFileSizeLow=0x962a, dwReserved0=0x0, dwReserved1=0x0, cFileName="uST.gif", cAlternateFileName="")) returned 1
	[0081.544] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b89c5f0, ftCreationTime.dwHighDateTime=0x1d4d0bc, ftLastAccessTime.dwLowDateTime=0x6d17c380, ftLastAccessTime.dwHighDateTime=0x1d4cf0f, ftLastWriteTime.dwLowDateTime=0x6d17c380, ftLastWriteTime.dwHighDateTime=0x1d4cf0f, nFileSizeHigh=0x0, nFileSizeLow=0x18ce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="vlex.gif", cAlternateFileName="")) returned 1
	[0081.544] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4161330, ftCreationTime.dwHighDateTime=0x1d4cdb6, ftLastAccessTime.dwLowDateTime=0xf6479190, ftLastAccessTime.dwHighDateTime=0x1d4cc5c, ftLastWriteTime.dwLowDateTime=0xf6479190, ftLastWriteTime.dwHighDateTime=0x1d4cc5c, nFileSizeHigh=0x0, nFileSizeLow=0xe1e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="X EyiYzuSSTvExN83.png", cAlternateFileName="XEYIYZ~1.PNG")) returned 1
	[0081.544] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2134e80, ftCreationTime.dwHighDateTime=0x1d4c849, ftLastAccessTime.dwLowDateTime=0x3c2c5120, ftLastAccessTime.dwHighDateTime=0x1d4d052, ftLastWriteTime.dwLowDateTime=0x3c2c5120, ftLastWriteTime.dwHighDateTime=0x1d4d052, nFileSizeHigh=0x0, nFileSizeLow=0x6ee3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y1Dqbk.gif", cAlternateFileName="")) returned 1
	[0081.545] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee7a0, ftCreationTime.dwHighDateTime=0x1d4c603, ftLastAccessTime.dwLowDateTime=0x3bb31a00, ftLastAccessTime.dwHighDateTime=0x1d4cae2, ftLastWriteTime.dwLowDateTime=0x3bb31a00, ftLastWriteTime.dwHighDateTime=0x1d4cae2, nFileSizeHigh=0x0, nFileSizeLow=0x851e, dwReserved0=0x0, dwReserved1=0x0, cFileName="y3ns.png", cAlternateFileName="")) returned 1
	[0081.545] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c3bcda0, ftCreationTime.dwHighDateTime=0x1d4cce7, ftLastAccessTime.dwLowDateTime=0xb3939b20, ftLastAccessTime.dwHighDateTime=0x1d4cdef, ftLastWriteTime.dwLowDateTime=0xb3939b20, ftLastWriteTime.dwHighDateTime=0x1d4cdef, nFileSizeHigh=0x0, nFileSizeLow=0xab36, dwReserved0=0x0, dwReserved1=0x0, cFileName="yzjSQ0dyPgU.bmp", cAlternateFileName="YZJSQ0~1.BMP")) returned 1
	[0081.545] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c93550, ftCreationTime.dwHighDateTime=0x1d4c656, ftLastAccessTime.dwLowDateTime=0x25ea7800, ftLastAccessTime.dwHighDateTime=0x1d4d265, ftLastWriteTime.dwLowDateTime=0x25ea7800, ftLastWriteTime.dwHighDateTime=0x1d4d265, nFileSizeHigh=0x0, nFileSizeLow=0xa26e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZknDe12VuTUg6otSbga.png", cAlternateFileName="ZKNDE1~1.PNG")) returned 1
	[0081.545] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdede6ee0, ftCreationTime.dwHighDateTime=0x1d4c7be, ftLastAccessTime.dwLowDateTime=0x60ac4200, ftLastAccessTime.dwHighDateTime=0x1d4c7ef, ftLastWriteTime.dwLowDateTime=0x60ac4200, ftLastWriteTime.dwHighDateTime=0x1d4c7ef, nFileSizeHigh=0x0, nFileSizeLow=0x28de, dwReserved0=0x0, dwReserved1=0x0, cFileName="zQw5BOj24vCxjewHw1.png", cAlternateFileName="ZQW5BO~1.PNG")) returned 1
	[0081.545] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdf045d0, ftCreationTime.dwHighDateTime=0x1d4cfa9, ftLastAccessTime.dwLowDateTime=0x8612b3e0, ftLastAccessTime.dwHighDateTime=0x1d4c582, ftLastWriteTime.dwLowDateTime=0x8612b3e0, ftLastWriteTime.dwHighDateTime=0x1d4c582, nFileSizeHigh=0x0, nFileSizeLow=0x5b1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zv3Cyst6OSxrOPBB5.gif", cAlternateFileName="ZV3CYS~1.GIF")) returned 1
	[0081.545] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa10e3160, ftCreationTime.dwHighDateTime=0x1d4caaa, ftLastAccessTime.dwLowDateTime=0x548a29e0, ftLastAccessTime.dwHighDateTime=0x1d4d539, ftLastWriteTime.dwLowDateTime=0x548a29e0, ftLastWriteTime.dwHighDateTime=0x1d4d539, nFileSizeHigh=0x0, nFileSizeLow=0xa376, dwReserved0=0x0, dwReserved1=0x0, cFileName="_jpEbCfhotvRhFf_.jpg", cAlternateFileName="_JPEBC~1.JPG")) returned 1
	[0081.545] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0081.545] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0081.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.546] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0081.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.546] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.546] GetFileType (hFile=0x5dc) returned 0x1
	[0081.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.546] GetFileType (hFile=0x5dc) returned 0x1
	[0081.546] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b8e7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b8e7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.547] CloseHandle (hObject=0x5dc) returned 1
	[0081.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.547] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\PrintHood", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\PrintHood", lpFilePart=0x0) returned 0x19
	[0081.547] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\PrintHood\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\PrintHood", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\PrintHood", lpFilePart=0x0) returned 0x19
	[0081.548] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\PrintHood\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\PrintHood\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\PrintHood\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0081.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.550] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\PrintHood\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\printhood\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.699] GetFileType (hFile=0x5dc) returned 0x1
	[0081.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.699] GetFileType (hFile=0x5dc) returned 0x1
	[0081.699] WriteFile (in: hFile=0x5dc, lpBuffer=0x25bbef0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bbef0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.700] CloseHandle (hObject=0x5dc) returned 1
	[0081.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.964] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Recent", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Recent", lpFilePart=0x0) returned 0x16
	[0081.964] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Recent\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.966] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Recent", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Recent", lpFilePart=0x0) returned 0x16
	[0081.966] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Recent\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.967] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Recent\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Recent\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0081.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.967] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Recent\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\recent\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.968] GetFileType (hFile=0x5dc) returned 0x1
	[0081.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.968] GetFileType (hFile=0x5dc) returned 0x1
	[0081.968] WriteFile (in: hFile=0x5dc, lpBuffer=0x25bee5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bee5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.969] CloseHandle (hObject=0x5dc) returned 1
	[0081.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.969] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b
	[0081.969] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0081.969] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.969] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.969] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0081.969] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0081.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.970] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b
	[0081.970] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0081.970] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.970] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.970] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0081.970] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0081.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.970] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games\\Decrypt.txt", lpFilePart=0x0) returned 0x27
	[0081.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.970] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\saved games\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.971] GetFileType (hFile=0x5dc) returned 0x1
	[0081.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.971] GetFileType (hFile=0x5dc) returned 0x1
	[0081.971] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c2008*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c2008*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.971] CloseHandle (hObject=0x5dc) returned 1
	[0081.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.972] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18
	[0081.972] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0081.972] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.972] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.972] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1
	[0081.972] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1
	[0081.972] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1
	[0081.972] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0
	[0081.973] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0081.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.973] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18
	[0081.973] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0081.973] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.973] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.973] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1
	[0081.973] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1
	[0081.973] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1
	[0081.974] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0081.974] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0081.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0081.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0081.974] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0081.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.974] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\searches\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.974] GetFileType (hFile=0x5dc) returned 0x1
	[0081.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.974] GetFileType (hFile=0x5dc) returned 0x1
	[0081.974] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c5d14*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c5d14*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.975] CloseHandle (hObject=0x5dc) returned 1
	[0081.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\SendTo", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\SendTo", lpFilePart=0x0) returned 0x16
	[0081.975] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\SendTo\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\SendTo", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\SendTo", lpFilePart=0x0) returned 0x16
	[0081.976] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\SendTo\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\SendTo\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\SendTo\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0081.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.978] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\SendTo\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\sendto\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0081.989] GetFileType (hFile=0x5dc) returned 0x1
	[0081.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0081.989] GetFileType (hFile=0x5dc) returned 0x1
	[0081.989] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c8c80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c8c80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0081.990] CloseHandle (hObject=0x5dc) returned 1
	[0081.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Start Menu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Start Menu", lpFilePart=0x0) returned 0x1a
	[0081.991] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Start Menu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0081.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Start Menu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Start Menu", lpFilePart=0x0) returned 0x1a
	[0081.992] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Start Menu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0081.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0081.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Start Menu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Start Menu\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0081.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0081.993] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Start Menu\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\start menu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.041] GetFileType (hFile=0x5dc) returned 0x1
	[0082.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.042] GetFileType (hFile=0x5dc) returned 0x1
	[0082.042] WriteFile (in: hFile=0x5dc, lpBuffer=0x25cbc7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cbc7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.043] CloseHandle (hObject=0x5dc) returned 1
	[0082.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Templates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Templates", lpFilePart=0x0) returned 0x19
	[0082.043] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Templates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0082.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0082.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.044] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Templates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Templates", lpFilePart=0x0) returned 0x19
	[0082.044] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Templates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0082.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0082.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0082.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.046] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Templates\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\templates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.046] GetFileType (hFile=0x5dc) returned 0x1
	[0082.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.046] GetFileType (hFile=0x5dc) returned 0x1
	[0082.046] WriteFile (in: hFile=0x5dc, lpBuffer=0x25cec30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cec30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.047] CloseHandle (hObject=0x5dc) returned 1
	[0082.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16
	[0082.047] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d52686b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d52686b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0082.047] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d52686b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d52686b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.047] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11bb26a0, ftCreationTime.dwHighDateTime=0x1d4cce2, ftLastAccessTime.dwLowDateTime=0x91e6f10, ftLastAccessTime.dwHighDateTime=0x1d4cb62, ftLastWriteTime.dwLowDateTime=0x91e6f10, ftLastWriteTime.dwHighDateTime=0x1d4cb62, nFileSizeHigh=0x0, nFileSizeLow=0xa65c, dwReserved0=0x0, dwReserved1=0x0, cFileName="6t75.flv", cAlternateFileName="")) returned 1
	[0082.047] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.048] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b2d990, ftCreationTime.dwHighDateTime=0x1d4c6df, ftLastAccessTime.dwLowDateTime=0x9782d2c0, ftLastAccessTime.dwHighDateTime=0x1d4ca98, ftLastWriteTime.dwLowDateTime=0x9782d2c0, ftLastWriteTime.dwHighDateTime=0x1d4ca98, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="G8cFu 9vqjW8W", cAlternateFileName="G8CFU9~1")) returned 1
	[0082.048] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9100c570, ftCreationTime.dwHighDateTime=0x1d4cd58, ftLastAccessTime.dwLowDateTime=0x34df4770, ftLastAccessTime.dwHighDateTime=0x1d4c7f5, ftLastWriteTime.dwLowDateTime=0x34df4770, ftLastWriteTime.dwHighDateTime=0x1d4c7f5, nFileSizeHigh=0x0, nFileSizeLow=0xd380, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJBilQ.mkv", cAlternateFileName="")) returned 1
	[0082.048] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c16850, ftCreationTime.dwHighDateTime=0x1d4d3c0, ftLastAccessTime.dwLowDateTime=0x6d346f30, ftLastAccessTime.dwHighDateTime=0x1d4cb1d, ftLastWriteTime.dwLowDateTime=0x6d346f30, ftLastWriteTime.dwHighDateTime=0x1d4cb1d, nFileSizeHigh=0x0, nFileSizeLow=0x34e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="X 8VKJWfhmVLyWbhbxE.avi", cAlternateFileName="X8VKJW~1.AVI")) returned 1
	[0082.048] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c16850, ftCreationTime.dwHighDateTime=0x1d4d3c0, ftLastAccessTime.dwLowDateTime=0x6d346f30, ftLastAccessTime.dwHighDateTime=0x1d4cb1d, ftLastWriteTime.dwLowDateTime=0x6d346f30, ftLastWriteTime.dwHighDateTime=0x1d4cb1d, nFileSizeHigh=0x0, nFileSizeLow=0x34e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="X 8VKJWfhmVLyWbhbxE.avi", cAlternateFileName="X8VKJW~1.AVI")) returned 0
	[0082.048] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0082.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.048] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16
	[0082.048] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d52686b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d52686b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0082.048] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d52686b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3d52686b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.049] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11bb26a0, ftCreationTime.dwHighDateTime=0x1d4cce2, ftLastAccessTime.dwLowDateTime=0x91e6f10, ftLastAccessTime.dwHighDateTime=0x1d4cb62, ftLastWriteTime.dwLowDateTime=0x91e6f10, ftLastWriteTime.dwHighDateTime=0x1d4cb62, nFileSizeHigh=0x0, nFileSizeLow=0xa65c, dwReserved0=0x0, dwReserved1=0x0, cFileName="6t75.flv", cAlternateFileName="")) returned 1
	[0082.049] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.049] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b2d990, ftCreationTime.dwHighDateTime=0x1d4c6df, ftLastAccessTime.dwLowDateTime=0x9782d2c0, ftLastAccessTime.dwHighDateTime=0x1d4ca98, ftLastWriteTime.dwLowDateTime=0x9782d2c0, ftLastWriteTime.dwHighDateTime=0x1d4ca98, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="G8cFu 9vqjW8W", cAlternateFileName="G8CFU9~1")) returned 1
	[0082.049] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9100c570, ftCreationTime.dwHighDateTime=0x1d4cd58, ftLastAccessTime.dwLowDateTime=0x34df4770, ftLastAccessTime.dwHighDateTime=0x1d4c7f5, ftLastWriteTime.dwLowDateTime=0x34df4770, ftLastWriteTime.dwHighDateTime=0x1d4c7f5, nFileSizeHigh=0x0, nFileSizeLow=0xd380, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJBilQ.mkv", cAlternateFileName="")) returned 1
	[0082.049] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c16850, ftCreationTime.dwHighDateTime=0x1d4d3c0, ftLastAccessTime.dwLowDateTime=0x6d346f30, ftLastAccessTime.dwHighDateTime=0x1d4cb1d, ftLastWriteTime.dwLowDateTime=0x6d346f30, ftLastWriteTime.dwHighDateTime=0x1d4cb1d, nFileSizeHigh=0x0, nFileSizeLow=0x34e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="X 8VKJWfhmVLyWbhbxE.avi", cAlternateFileName="X8VKJW~1.AVI")) returned 1
	[0082.049] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.049] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0082.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.049] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0082.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.049] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\videos\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.050] GetFileType (hFile=0x5dc) returned 0x1
	[0082.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.050] GetFileType (hFile=0x5dc) returned 0x1
	[0082.050] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d2648*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d2648*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.051] CloseHandle (hObject=0x5dc) returned 1
	[0082.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.051] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\AccountPictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\AccountPictures", lpFilePart=0x0) returned 0x1f
	[0082.051] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0082.051] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.051] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.051] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0082.052] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0082.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.052] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\AccountPictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\AccountPictures", lpFilePart=0x0) returned 0x1f
	[0082.052] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0082.052] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.052] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.052] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.053] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0082.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.053] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\AccountPictures\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0082.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.053] CreateFileW (lpFileName="C:\\Users\\Public\\AccountPictures\\Decrypt.txt" (normalized: "c:\\users\\public\\accountpictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.053] GetFileType (hFile=0x5dc) returned 0x1
	[0082.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.053] GetFileType (hFile=0x5dc) returned 0x1
	[0082.053] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d58d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d58d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.054] CloseHandle (hObject=0x5dc) returned 1
	[0082.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.054] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17
	[0082.054] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6986c5e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6986c5e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0082.055] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6986c5e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6986c5e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.055] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1
	[0082.055] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6986c5e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6986c5e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a2a0238, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0082.055] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.055] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1
	[0082.055] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1
	[0082.055] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0
	[0082.056] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0082.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.056] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17
	[0082.056] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6986c5e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6986c5e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0082.056] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6986c5e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6986c5e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.056] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1
	[0082.056] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6986c5e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6986c5e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a2a0238, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0082.056] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.056] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1
	[0082.057] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1
	[0082.057] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.057] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0082.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.057] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Decrypt.txt", lpFilePart=0x0) returned 0x23
	[0082.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.057] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Decrypt.txt" (normalized: "c:\\users\\public\\desktop\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.249] GetFileType (hFile=0x5dc) returned 0x1
	[0082.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.249] GetFileType (hFile=0x5dc) returned 0x1
	[0082.249] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d9588*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d9588*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.250] CloseHandle (hObject=0x5dc) returned 1
	[0082.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.250] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19
	[0082.250] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6986c5e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0082.250] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6986c5e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.251] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6986c5e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6986c5e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a2a0238, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0082.251] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.251] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0082.251] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0082.251] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0082.251] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.251] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0082.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.251] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19
	[0082.251] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6986c5e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6986c5e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0082.252] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6986c5e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6986c5e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.252] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6986c5e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6986c5e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a2a0238, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0082.252] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.252] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0082.252] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0082.252] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0082.252] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0
	[0082.252] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0082.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.253] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0082.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.253] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\Decrypt.txt" (normalized: "c:\\users\\public\\documents\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.253] GetFileType (hFile=0x5dc) returned 0x1
	[0082.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.253] GetFileType (hFile=0x5dc) returned 0x1
	[0082.253] WriteFile (in: hFile=0x5dc, lpBuffer=0x25dcfcc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25dcfcc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.254] CloseHandle (hObject=0x5dc) returned 1
	[0082.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.254] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19
	[0082.254] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0082.255] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.255] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.255] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0082.255] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0082.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.255] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19
	[0082.255] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0082.255] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.256] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.256] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.256] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0082.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.256] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0082.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.256] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\Decrypt.txt" (normalized: "c:\\users\\public\\downloads\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.257] GetFileType (hFile=0x5dc) returned 0x1
	[0082.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.257] GetFileType (hFile=0x5dc) returned 0x1
	[0082.257] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e0108*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e0108*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.257] CloseHandle (hObject=0x5dc) returned 1
	[0082.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.258] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries", lpFilePart=0x0) returned 0x19
	[0082.258] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0082.258] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.258] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.258] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1
	[0082.258] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0
	[0082.259] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0082.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.259] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries", lpFilePart=0x0) returned 0x19
	[0082.259] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0082.259] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.259] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.259] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1
	[0082.259] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.259] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0082.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.260] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0082.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.260] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\Decrypt.txt" (normalized: "c:\\users\\public\\libraries\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.260] GetFileType (hFile=0x5dc) returned 0x1
	[0082.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.260] GetFileType (hFile=0x5dc) returned 0x1
	[0082.260] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e3558*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e3558*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.261] CloseHandle (hObject=0x5dc) returned 1
	[0082.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.261] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15
	[0082.261] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0082.261] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.261] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.261] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0082.262] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0082.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.262] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15
	[0082.262] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0082.262] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.262] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.262] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.262] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0082.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.262] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Decrypt.txt", lpFilePart=0x0) returned 0x21
	[0082.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.263] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Decrypt.txt" (normalized: "c:\\users\\public\\music\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.263] GetFileType (hFile=0x5dc) returned 0x1
	[0082.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.263] GetFileType (hFile=0x5dc) returned 0x1
	[0082.263] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e65b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e65b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.264] CloseHandle (hObject=0x5dc) returned 1
	[0082.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.264] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18
	[0082.264] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0082.264] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.264] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.264] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0082.264] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0082.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.265] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18
	[0082.265] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0082.265] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.265] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.265] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.265] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0082.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.265] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0082.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.265] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Decrypt.txt" (normalized: "c:\\users\\public\\pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.265] GetFileType (hFile=0x5dc) returned 0x1
	[0082.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.266] GetFileType (hFile=0x5dc) returned 0x1
	[0082.266] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e96e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e96e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.266] CloseHandle (hObject=0x5dc) returned 1
	[0082.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.267] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16
	[0082.267] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0082.267] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.267] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.267] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0082.267] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0082.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.267] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16
	[0082.268] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0082.268] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.268] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.268] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.268] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0082.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.268] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0082.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.268] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Decrypt.txt" (normalized: "c:\\users\\public\\videos\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.269] GetFileType (hFile=0x5dc) returned 0x1
	[0082.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.269] GetFileType (hFile=0x5dc) returned 0x1
	[0082.269] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ec79c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ec79c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.270] CloseHandle (hObject=0x5dc) returned 1
	[0082.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.270] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033", lpFilePart=0x0) returned 0x2c
	[0082.270] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0082.271] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.271] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0082.271] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0082.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.272] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033", lpFilePart=0x0) returned 0x2c
	[0082.272] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0082.272] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.272] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0082.272] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0082.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.272] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\Decrypt.txt", lpFilePart=0x0) returned 0x38
	[0082.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.272] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\Decrypt.txt" (normalized: "c:\\programdata\\adobe\\arm\\reader_15.007.20033\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.272] GetFileType (hFile=0x5dc) returned 0x1
	[0082.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.273] GetFileType (hFile=0x5dc) returned 0x1
	[0082.273] WriteFile (in: hFile=0x5dc, lpBuffer=0x25efa60*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25efa60*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.273] CloseHandle (hObject=0x5dc) returned 1
	[0082.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.274] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070", lpFilePart=0x0) returned 0x2c
	[0082.274] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0082.274] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.274] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0082.274] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0082.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.274] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070", lpFilePart=0x0) returned 0x2c
	[0082.274] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0082.274] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.275] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0082.275] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0082.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.275] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\Decrypt.txt", lpFilePart=0x0) returned 0x38
	[0082.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.275] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\Decrypt.txt" (normalized: "c:\\programdata\\adobe\\arm\\reader_15.023.20070\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.275] GetFileType (hFile=0x5dc) returned 0x1
	[0082.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.275] GetFileType (hFile=0x5dc) returned 0x1
	[0082.275] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f2d24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f2d24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.276] CloseHandle (hObject=0x5dc) returned 1
	[0082.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.277] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\S", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\S", lpFilePart=0x0) returned 0x1a
	[0082.277] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\S\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0082.277] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.277] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0082.277] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0082.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.277] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\S", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\S", lpFilePart=0x0) returned 0x1a
	[0082.277] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\S\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0082.278] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.278] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0082.278] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0082.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.278] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\S\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\S\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0082.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.278] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\S\\Decrypt.txt" (normalized: "c:\\programdata\\adobe\\arm\\s\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.278] GetFileType (hFile=0x5dc) returned 0x1
	[0082.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.278] GetFileType (hFile=0x5dc) returned 0x1
	[0082.278] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f5c88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f5c88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.279] CloseHandle (hObject=0x5dc) returned 1
	[0082.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.279] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\AppV\\Setup", lpFilePart=0x0) returned 0x23
	[0082.279] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0082.280] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.280] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 1
	[0082.280] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 0
	[0082.280] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0082.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\AppV\\Setup", lpFilePart=0x0) returned 0x23
	[0082.280] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0082.280] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.280] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 1
	[0082.281] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.281] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0082.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.281] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\AppV\\Setup\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0082.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.281] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\appv\\setup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.448] GetFileType (hFile=0x5dc) returned 0x1
	[0082.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.448] GetFileType (hFile=0x5dc) returned 0x1
	[0082.448] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f9140*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f9140*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.449] CloseHandle (hObject=0x5dc) returned 1
	[0082.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.449] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpFilePart=0x0) returned 0x48
	[0082.449] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0082.450] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.450] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0082.450] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0082.450] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.450] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0082.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.450] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpFilePart=0x0) returned 0x48
	[0082.450] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0082.450] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.451] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0082.451] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0082.451] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0082.451] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0082.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.451] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0082.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.451] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.451] GetFileType (hFile=0x5dc) returned 0x1
	[0082.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.451] GetFileType (hFile=0x5dc) returned 0x1
	[0082.451] WriteFile (in: hFile=0x5dc, lpBuffer=0x25fd038*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fd038*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.452] CloseHandle (hObject=0x5dc) returned 1
	[0082.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.452] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpFilePart=0x0) returned 0x48
	[0082.452] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0082.452] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.453] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0082.453] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0082.453] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.453] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0082.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.453] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpFilePart=0x0) returned 0x48
	[0082.453] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0082.453] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.453] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0082.453] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0082.453] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0082.453] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0082.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.454] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0082.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.454] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.454] GetFileType (hFile=0x5dc) returned 0x1
	[0082.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.454] GetFileType (hFile=0x5dc) returned 0x1
	[0082.454] WriteFile (in: hFile=0x5dc, lpBuffer=0x2600f30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2600f30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.455] CloseHandle (hObject=0x5dc) returned 1
	[0082.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.455] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpFilePart=0x0) returned 0x48
	[0082.455] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0082.465] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.465] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0082.465] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0082.465] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.465] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0082.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpFilePart=0x0) returned 0x48
	[0082.466] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0082.467] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.467] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0082.467] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0082.467] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0082.467] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0082.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0082.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.468] GetFileType (hFile=0x5dc) returned 0x1
	[0082.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.469] GetFileType (hFile=0x5dc) returned 0x1
	[0082.469] WriteFile (in: hFile=0x5dc, lpBuffer=0x2604e28*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2604e28*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.469] CloseHandle (hObject=0x5dc) returned 1
	[0082.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.470] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData", lpFilePart=0x0) returned 0x2f
	[0082.470] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0082.470] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.470] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1
	[0082.470] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1
	[0082.470] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.470] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0082.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.470] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData", lpFilePart=0x0) returned 0x2f
	[0082.470] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0082.470] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.471] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1
	[0082.471] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1
	[0082.471] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0
	[0082.471] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0082.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0082.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.471] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.472] GetFileType (hFile=0x5dc) returned 0x1
	[0082.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.472] GetFileType (hFile=0x5dc) returned 0x1
	[0082.472] WriteFile (in: hFile=0x5dc, lpBuffer=0x2608724*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2608724*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.473] CloseHandle (hObject=0x5dc) returned 1
	[0082.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases", lpFilePart=0x0) returned 0x33
	[0082.473] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0082.488] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.488] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", cAlternateFileName="5A65C4~1")) returned 1
	[0082.488] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1
	[0082.488] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.488] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0082.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.489] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases", lpFilePart=0x0) returned 0x33
	[0082.489] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0082.489] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.490] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", cAlternateFileName="5A65C4~1")) returned 1
	[0082.490] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1
	[0082.490] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0
	[0082.490] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0082.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.491] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0082.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.491] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.492] GetFileType (hFile=0x5dc) returned 0x1
	[0082.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.492] GetFileType (hFile=0x5dc) returned 0x1
	[0082.492] WriteFile (in: hFile=0x5dc, lpBuffer=0x260c434*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260c434*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.492] CloseHandle (hObject=0x5dc) returned 1
	[0082.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.493] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData", lpFilePart=0x0) returned 0x2c
	[0082.493] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0082.493] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.493] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0082.493] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0082.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.493] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData", lpFilePart=0x0) returned 0x2c
	[0082.493] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0082.493] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.493] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0082.494] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0082.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.494] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\Decrypt.txt", lpFilePart=0x0) returned 0x38
	[0082.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.494] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\userdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.494] GetFileType (hFile=0x5dc) returned 0x1
	[0082.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.494] GetFileType (hFile=0x5dc) returned 0x1
	[0082.494] WriteFile (in: hFile=0x5dc, lpBuffer=0x260f6f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260f6f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.495] CloseHandle (hObject=0x5dc) returned 1
	[0082.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.495] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpFilePart=0x0) returned 0x4a
	[0082.495] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0082.509] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.510] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x247ecc35, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x0, dwReserved1=0x0, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 1
	[0082.510] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 1
	[0082.510] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 1
	[0082.510] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 1
	[0082.510] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 1
	[0082.510] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 1
	[0082.510] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 1
	[0082.511] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 1
	[0082.511] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 1
	[0082.511] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 1
	[0082.511] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 1
	[0082.511] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 1
	[0082.511] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32mui.msi.16.en-us.xml", cAlternateFileName="C2BADD~1.XML")) returned 1
	[0082.511] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32ww.msi.16.x-none.xml", cAlternateFileName="C2EBFE~1.XML")) returned 1
	[0082.511] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 1
	[0082.512] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 1
	[0082.512] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 1
	[0082.512] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 1
	[0082.512] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 1
	[0082.512] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 1
	[0082.512] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 1
	[0082.512] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 1
	[0082.512] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 1
	[0082.513] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 1
	[0082.513] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 1
	[0082.513] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", cAlternateFileName="C2E87B~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.projectmui.msi.16.en-us.xml", cAlternateFileName="C26005~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", cAlternateFileName="C2668D~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.visiomui.msi.16.en-us.xml", cAlternateFileName="C2A712~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x0, dwReserved1=0x0, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf427d4ce, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf40d9aa3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 1
	[0082.514] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 0
	[0082.514] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0082.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpFilePart=0x0) returned 0x4a
	[0082.515] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x247ecc35, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x0, dwReserved1=0x0, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32mui.msi.16.en-us.xml", cAlternateFileName="C2BADD~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32ww.msi.16.x-none.xml", cAlternateFileName="C2EBFE~1.XML")) returned 1
	[0082.516] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", cAlternateFileName="C2E87B~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.projectmui.msi.16.en-us.xml", cAlternateFileName="C26005~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", cAlternateFileName="C2668D~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.visiomui.msi.16.en-us.xml", cAlternateFileName="C2A712~1.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 1
	[0082.517] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 1
	[0082.518] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x0, dwReserved1=0x0, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1
	[0082.518] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf427d4ce, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 1
	[0082.518] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf40d9aa3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 1
	[0082.518] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 1
	[0082.518] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 1
	[0082.518] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.518] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0082.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.519] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0082.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.519] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.519] GetFileType (hFile=0x5dc) returned 0x1
	[0082.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.519] GetFileType (hFile=0x5dc) returned 0x1
	[0082.519] WriteFile (in: hFile=0x5dc, lpBuffer=0x26221c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26221c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.520] CloseHandle (hObject=0x5dc) returned 1
	[0082.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23
	[0082.749] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0082.749] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.749] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0082.749] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.749] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0082.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.749] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23
	[0082.749] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0082.749] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.749] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0082.749] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0
	[0082.749] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0082.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.750] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0082.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.750] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.750] GetFileType (hFile=0x5dc) returned 0x1
	[0082.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.750] GetFileType (hFile=0x5dc) returned 0x1
	[0082.750] WriteFile (in: hFile=0x5dc, lpBuffer=0x2625704*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2625704*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.751] CloseHandle (hObject=0x5dc) returned 1
	[0082.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.751] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24
	[0082.751] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0082.752] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.752] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0082.752] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0082.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24
	[0082.752] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0082.752] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.752] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0082.753] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0082.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.753] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0082.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.753] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\keys\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0082.753] GetFileType (hFile=0x5dc) returned 0x1
	[0082.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.753] GetFileType (hFile=0x5dc) returned 0x1
	[0082.753] WriteFile (in: hFile=0x5dc, lpBuffer=0x2628848*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2628848*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.754] CloseHandle (hObject=0x5dc) returned 1
	[0082.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.754] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP", lpFilePart=0x0) returned 0x26
	[0082.754] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0082.754] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.755] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1
	[0082.755] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.755] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0082.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP", lpFilePart=0x0) returned 0x26
	[0082.755] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0082.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.758] WriteFile (in: hFile=0x5dc, lpBuffer=0x262bcd4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262bcd4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.760] WriteFile (in: hFile=0x5dc, lpBuffer=0x262f2c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262f2c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.763] WriteFile (in: hFile=0x5dc, lpBuffer=0x2633104*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2633104*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.764] WriteFile (in: hFile=0x5dc, lpBuffer=0x2636368*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2636368*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.766] WriteFile (in: hFile=0x5dc, lpBuffer=0x2639efc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2639efc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.767] WriteFile (in: hFile=0x5dc, lpBuffer=0x263da10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263da10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.769] WriteFile (in: hFile=0x5dc, lpBuffer=0x2640da4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2640da4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.771] WriteFile (in: hFile=0x5dc, lpBuffer=0x26446e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26446e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.776] WriteFile (in: hFile=0x5dc, lpBuffer=0x264a8b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264a8b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.782] WriteFile (in: hFile=0x5dc, lpBuffer=0x264e484*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264e484*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.888] WriteFile (in: hFile=0x5dc, lpBuffer=0x2651868*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2651868*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0082.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0082.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0082.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0082.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0082.890] WriteFile (in: hFile=0x5dc, lpBuffer=0x2654adc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2654adc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.891] WriteFile (in: hFile=0x5dc, lpBuffer=0x2657d40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2657d40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.897] WriteFile (in: hFile=0x5dc, lpBuffer=0x2660774*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2660774*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.898] WriteFile (in: hFile=0x5dc, lpBuffer=0x2663b68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2663b68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.899] WriteFile (in: hFile=0x5dc, lpBuffer=0x266718c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266718c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.900] WriteFile (in: hFile=0x5dc, lpBuffer=0x266a280*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266a280*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.902] WriteFile (in: hFile=0x5dc, lpBuffer=0x266d8d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266d8d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.903] WriteFile (in: hFile=0x5dc, lpBuffer=0x2670e54*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2670e54*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.905] WriteFile (in: hFile=0x5dc, lpBuffer=0x2495f58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2495f58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.906] WriteFile (in: hFile=0x5dc, lpBuffer=0x24993ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24993ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.907] WriteFile (in: hFile=0x5dc, lpBuffer=0x249cb30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x249cb30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.908] WriteFile (in: hFile=0x5dc, lpBuffer=0x24a109c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24a109c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.910] WriteFile (in: hFile=0x5dc, lpBuffer=0x24a54f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24a54f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.911] WriteFile (in: hFile=0x5dc, lpBuffer=0x24a9944*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24a9944*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.913] WriteFile (in: hFile=0x5dc, lpBuffer=0x24add98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24add98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.914] WriteFile (in: hFile=0x5dc, lpBuffer=0x24b21ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b21ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.915] WriteFile (in: hFile=0x5dc, lpBuffer=0x24b6640*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b6640*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.922] WriteFile (in: hFile=0x5dc, lpBuffer=0x24bab34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24bab34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.924] WriteFile (in: hFile=0x5dc, lpBuffer=0x24bef88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24bef88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.980] WriteFile (in: hFile=0x5dc, lpBuffer=0x24c349c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c349c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.982] WriteFile (in: hFile=0x5dc, lpBuffer=0x24c78f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c78f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.983] WriteFile (in: hFile=0x5dc, lpBuffer=0x24cbd44*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24cbd44*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.985] WriteFile (in: hFile=0x5dc, lpBuffer=0x24d0198*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d0198*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.990] WriteFile (in: hFile=0x5dc, lpBuffer=0x24d468c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d468c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.991] WriteFile (in: hFile=0x5dc, lpBuffer=0x24d8ae0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d8ae0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0082.993] WriteFile (in: hFile=0x5dc, lpBuffer=0x24dcf34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24dcf34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.060] WriteFile (in: hFile=0x5dc, lpBuffer=0x24e1428*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e1428*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.078] WriteFile (in: hFile=0x5dc, lpBuffer=0x24e587c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e587c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.080] WriteFile (in: hFile=0x5dc, lpBuffer=0x24e9cd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e9cd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.094] WriteFile (in: hFile=0x5dc, lpBuffer=0x24ee1c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ee1c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.110] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f1864*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f1864*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.122] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f4ba0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f4ba0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511db20) returned 1
	[0083.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.130] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates", lpFilePart=0x0) returned 0x2b
	[0083.130] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.140] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.195] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4771, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopSettings2013.xml", cAlternateFileName="")) returned 1
	[0083.196] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x173d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EaseOfAccessSettings2013.xml", cAlternateFileName="")) returned 1
	[0083.196] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc27, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013.xml", cAlternateFileName="")) returned 1
	[0083.196] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013Backup.xml", cAlternateFileName="")) returned 1
	[0083.196] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2010.xml", cAlternateFileName="")) returned 1
	[0083.196] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win32.xml", cAlternateFileName="")) returned 1
	[0083.196] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win64.xml", cAlternateFileName="")) returned 1
	[0083.196] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftNotepad.xml", cAlternateFileName="")) returned 1
	[0083.196] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win32.xml", cAlternateFileName="")) returned 1
	[0083.197] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win64.xml", cAlternateFileName="")) returned 1
	[0083.197] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin32.xml", cAlternateFileName="")) returned 1
	[0083.197] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin64.xml", cAlternateFileName="")) returned 1
	[0083.197] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win32.xml", cAlternateFileName="")) returned 1
	[0083.197] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win64.xml", cAlternateFileName="")) returned 1
	[0083.197] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win32.xml", cAlternateFileName="")) returned 1
	[0083.197] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win64.xml", cAlternateFileName="")) returned 1
	[0083.197] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin32.xml", cAlternateFileName="")) returned 1
	[0083.197] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin64.xml", cAlternateFileName="")) returned 1
	[0083.198] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win32.xml", cAlternateFileName="")) returned 1
	[0083.198] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win64.xml", cAlternateFileName="")) returned 1
	[0083.198] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin32.xml", cAlternateFileName="")) returned 1
	[0083.198] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin64.xml", cAlternateFileName="")) returned 1
	[0083.198] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin32.xml", cAlternateFileName="")) returned 1
	[0083.198] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin64.xml", cAlternateFileName="")) returned 1
	[0083.198] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win32.xml", cAlternateFileName="")) returned 1
	[0083.199] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win64.xml", cAlternateFileName="")) returned 1
	[0083.199] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftWordpad.xml", cAlternateFileName="")) returned 1
	[0083.199] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkPrinters.xml", cAlternateFileName="")) returned 1
	[0083.199] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingCredentialSettings.xml", cAlternateFileName="")) returned 1
	[0083.199] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThemeSettings2013.xml", cAlternateFileName="")) returned 1
	[0083.199] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VdiState.xml", cAlternateFileName="")) returned 1
	[0083.199] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VdiState.xml", cAlternateFileName="")) returned 0
	[0083.199] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.200] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates", lpFilePart=0x0) returned 0x2b
	[0083.200] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.201] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.201] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4771, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopSettings2013.xml", cAlternateFileName="")) returned 1
	[0083.201] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x173d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EaseOfAccessSettings2013.xml", cAlternateFileName="")) returned 1
	[0083.201] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc27, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013.xml", cAlternateFileName="")) returned 1
	[0083.202] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013Backup.xml", cAlternateFileName="")) returned 1
	[0083.202] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2010.xml", cAlternateFileName="")) returned 1
	[0083.202] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win32.xml", cAlternateFileName="")) returned 1
	[0083.202] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win64.xml", cAlternateFileName="")) returned 1
	[0083.202] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftNotepad.xml", cAlternateFileName="")) returned 1
	[0083.202] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win32.xml", cAlternateFileName="")) returned 1
	[0083.202] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win64.xml", cAlternateFileName="")) returned 1
	[0083.202] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin32.xml", cAlternateFileName="")) returned 1
	[0083.202] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin64.xml", cAlternateFileName="")) returned 1
	[0083.202] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win32.xml", cAlternateFileName="")) returned 1
	[0083.203] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win64.xml", cAlternateFileName="")) returned 1
	[0083.203] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win32.xml", cAlternateFileName="")) returned 1
	[0083.203] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win64.xml", cAlternateFileName="")) returned 1
	[0083.203] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin32.xml", cAlternateFileName="")) returned 1
	[0083.203] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin64.xml", cAlternateFileName="")) returned 1
	[0083.203] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win32.xml", cAlternateFileName="")) returned 1
	[0083.203] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win64.xml", cAlternateFileName="")) returned 1
	[0083.203] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin32.xml", cAlternateFileName="")) returned 1
	[0083.203] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin64.xml", cAlternateFileName="")) returned 1
	[0083.203] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin32.xml", cAlternateFileName="")) returned 1
	[0083.203] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin64.xml", cAlternateFileName="")) returned 1
	[0083.204] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win32.xml", cAlternateFileName="")) returned 1
	[0083.204] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win64.xml", cAlternateFileName="")) returned 1
	[0083.204] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftWordpad.xml", cAlternateFileName="")) returned 1
	[0083.204] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkPrinters.xml", cAlternateFileName="")) returned 1
	[0083.204] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingCredentialSettings.xml", cAlternateFileName="")) returned 1
	[0083.204] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThemeSettings2013.xml", cAlternateFileName="")) returned 1
	[0083.204] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VdiState.xml", cAlternateFileName="")) returned 1
	[0083.204] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.204] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.205] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0083.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.205] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.206] GetFileType (hFile=0x5dc) returned 0x1
	[0083.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.206] GetFileType (hFile=0x5dc) returned 0x1
	[0083.206] WriteFile (in: hFile=0x5dc, lpBuffer=0x2501738*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2501738*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.207] CloseHandle (hObject=0x5dc) returned 1
	[0083.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Scripts", lpFilePart=0x0) returned 0x24
	[0083.207] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0083.207] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.208] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterInboxTemplates.ps1", cAlternateFileName="")) returned 1
	[0083.208] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterInboxTemplates.ps1", cAlternateFileName="")) returned 0
	[0083.208] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0083.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.208] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Scripts", lpFilePart=0x0) returned 0x24
	[0083.208] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0083.208] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.208] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterInboxTemplates.ps1", cAlternateFileName="")) returned 1
	[0083.208] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.209] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0083.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0083.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.209] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\uev\\scripts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.209] GetFileType (hFile=0x5dc) returned 0x1
	[0083.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.209] GetFileType (hFile=0x5dc) returned 0x1
	[0083.209] WriteFile (in: hFile=0x5dc, lpBuffer=0x2504bd4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2504bd4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.210] CloseHandle (hObject=0x5dc) returned 1
	[0083.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.210] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Templates", lpFilePart=0x0) returned 0x26
	[0083.210] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.210] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.211] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x25ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate.xsd", cAlternateFileName="")) returned 1
	[0083.211] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013.xsd", cAlternateFileName="")) returned 1
	[0083.211] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013A.xsd", cAlternateFileName="")) returned 1
	[0083.211] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013A.xsd", cAlternateFileName="")) returned 0
	[0083.211] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Templates", lpFilePart=0x0) returned 0x26
	[0083.211] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0083.211] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.212] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x25ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate.xsd", cAlternateFileName="")) returned 1
	[0083.212] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013.xsd", cAlternateFileName="")) returned 1
	[0083.212] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013A.xsd", cAlternateFileName="")) returned 1
	[0083.212] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.212] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0083.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.212] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x32
	[0083.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.212] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.212] GetFileType (hFile=0x5dc) returned 0x1
	[0083.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.213] GetFileType (hFile=0x5dc) returned 0x1
	[0083.213] WriteFile (in: hFile=0x5dc, lpBuffer=0x2508804*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2508804*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.213] CloseHandle (hObject=0x5dc) returned 1
	[0083.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204", lpFilePart=0x0) returned 0x43
	[0083.214] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0083.215] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.215] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", cAlternateFileName="154E23~1.VSC")) returned 1
	[0083.216] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", cAlternateFileName="2F1A65~1.VSC")) returned 1
	[0083.216] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", cAlternateFileName="3CCD54~1.VSC")) returned 1
	[0083.216] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 1
	[0083.216] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 0
	[0083.216] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0083.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.216] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204", lpFilePart=0x0) returned 0x43
	[0083.216] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0083.217] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.217] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", cAlternateFileName="154E23~1.VSC")) returned 1
	[0083.217] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", cAlternateFileName="2F1A65~1.VSC")) returned 1
	[0083.217] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", cAlternateFileName="3CCD54~1.VSC")) returned 1
	[0083.217] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 1
	[0083.217] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.217] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0083.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0083.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.217] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.218] GetFileType (hFile=0x5dc) returned 0x1
	[0083.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.218] GetFileType (hFile=0x5dc) returned 0x1
	[0083.218] WriteFile (in: hFile=0x5dc, lpBuffer=0x250d230*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250d230*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.219] CloseHandle (hObject=0x5dc) returned 1
	[0083.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.219] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC\\Server", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WinMSIPC\\Server", lpFilePart=0x0) returned 0x28
	[0083.219] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC\\Server\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.220] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.220] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0083.220] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.221] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC\\Server", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WinMSIPC\\Server", lpFilePart=0x0) returned 0x28
	[0083.221] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC\\Server\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0083.221] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.221] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0083.221] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0083.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.221] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC\\Server\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WinMSIPC\\Server\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0083.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.221] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC\\Server\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\winmsipc\\server\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.222] GetFileType (hFile=0x5dc) returned 0x1
	[0083.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.222] GetFileType (hFile=0x5dc) returned 0x1
	[0083.222] WriteFile (in: hFile=0x5dc, lpBuffer=0x2510434*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2510434*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.223] CloseHandle (hObject=0x5dc) returned 1
	[0083.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.223] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\DMProfiles", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\DMProfiles", lpFilePart=0x0) returned 0x2b
	[0083.223] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\DMProfiles\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0083.223] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.223] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0083.223] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0083.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.223] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\DMProfiles", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\DMProfiles", lpFilePart=0x0) returned 0x2b
	[0083.224] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\DMProfiles\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0083.224] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.224] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0083.224] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0083.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\DMProfiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\DMProfiles\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0083.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.224] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\DMProfiles\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\wwansvc\\dmprofiles\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0083.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511db20) returned 1
	[0083.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.225] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x29
	[0083.226] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0083.226] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.226] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0083.226] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0083.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.226] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x29
	[0083.226] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0083.226] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.227] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0083.227] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0083.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.227] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0083.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.227] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\wwansvc\\profiles\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0083.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511db20) returned 1
	[0083.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.228] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage", lpFilePart=0x0) returned 0x2c
	[0083.228] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0083.229] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.229] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 1
	[0083.229] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 0
	[0083.229] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0083.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.397] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage", lpFilePart=0x0) returned 0x2c
	[0083.397] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0083.398] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.398] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 1
	[0083.398] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.398] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0083.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.398] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\Decrypt.txt", lpFilePart=0x0) returned 0x38
	[0083.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.398] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\Decrypt.txt" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.399] GetFileType (hFile=0x5dc) returned 0x1
	[0083.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.399] GetFileType (hFile=0x5dc) returned 0x1
	[0083.400] WriteFile (in: hFile=0x5dc, lpBuffer=0x2515f80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2515f80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.401] CloseHandle (hObject=0x5dc) returned 1
	[0083.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.401] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\installcache_x64", lpFilePart=0x0) returned 0x2b
	[0083.401] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0083.402] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.402] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 1
	[0083.402] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 0
	[0083.402] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0083.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.403] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\installcache_x64", lpFilePart=0x0) returned 0x2b
	[0083.403] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0083.403] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.403] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 1
	[0083.403] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.404] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0083.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.404] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0083.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.404] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\Decrypt.txt" (normalized: "c:\\programdata\\oracle\\java\\installcache_x64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.404] GetFileType (hFile=0x5dc) returned 0x1
	[0083.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.404] GetFileType (hFile=0x5dc) returned 0x1
	[0083.405] WriteFile (in: hFile=0x5dc, lpBuffer=0x2519528*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2519528*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.406] CloseHandle (hObject=0x5dc) returned 1
	[0083.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23
	[0083.406] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0083.406] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.406] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1
	[0083.408] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1
	[0083.408] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1
	[0083.408] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 0
	[0083.408] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0083.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.409] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23
	[0083.409] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0083.409] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.409] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1
	[0083.409] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1
	[0083.409] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1
	[0083.410] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.410] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0083.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.411] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0083.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.411] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Decrypt.txt" (normalized: "c:\\programdata\\oracle\\java\\javapath\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.411] GetFileType (hFile=0x5dc) returned 0x1
	[0083.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.412] GetFileType (hFile=0x5dc) returned 0x1
	[0083.412] WriteFile (in: hFile=0x5dc, lpBuffer=0x251cd24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251cd24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.414] CloseHandle (hObject=0x5dc) returned 1
	[0083.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.414] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984", lpFilePart=0x0) returned 0x31
	[0083.414] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0083.414] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.415] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c0c933b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.415] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1
	[0083.415] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1
	[0083.415] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1
	[0083.418] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 0
	[0083.418] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0083.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.418] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984", lpFilePart=0x0) returned 0x31
	[0083.418] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.419] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.419] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c0c933b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.419] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1
	[0083.419] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1
	[0083.419] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1
	[0083.419] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.419] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0083.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.420] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\Decrypt.txt" (normalized: "c:\\programdata\\oracle\\java\\javapath_target_474984\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.420] GetFileType (hFile=0x5dc) returned 0x1
	[0083.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.421] GetFileType (hFile=0x5dc) returned 0x1
	[0083.421] WriteFile (in: hFile=0x5dc, lpBuffer=0x2520be0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2520be0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.423] CloseHandle (hObject=0x5dc) returned 1
	[0083.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.424] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0083.424] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0083.424] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.424] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.424] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.424] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0083.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.425] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0083.425] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.425] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.425] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.425] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0083.425] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.426] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0083.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.426] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.426] GetFileType (hFile=0x5dc) returned 0x1
	[0083.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.426] GetFileType (hFile=0x5dc) returned 0x1
	[0083.426] WriteFile (in: hFile=0x5dc, lpBuffer=0x2524b98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2524b98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.427] CloseHandle (hObject=0x5dc) returned 1
	[0083.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0083.427] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0083.428] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.428] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.429] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.429] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0083.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0083.429] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0083.429] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.429] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.430] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0083.430] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0083.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.430] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0083.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.430] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.430] GetFileType (hFile=0x5dc) returned 0x1
	[0083.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.430] GetFileType (hFile=0x5dc) returned 0x1
	[0083.431] WriteFile (in: hFile=0x5dc, lpBuffer=0x2528b88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2528b88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.431] CloseHandle (hObject=0x5dc) returned 1
	[0083.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0083.432] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0083.432] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.432] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.432] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.433] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0083.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.433] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0083.433] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0083.433] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.433] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.433] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0083.434] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0083.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0083.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.434] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.434] GetFileType (hFile=0x5dc) returned 0x1
	[0083.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.434] GetFileType (hFile=0x5dc) returned 0x1
	[0083.434] WriteFile (in: hFile=0x5dc, lpBuffer=0x252cb90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x252cb90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.435] CloseHandle (hObject=0x5dc) returned 1
	[0083.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.435] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0083.435] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.436] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.436] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.436] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.436] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.436] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0083.436] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.437] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.437] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.437] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0083.437] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.437] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0083.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.437] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.503] GetFileType (hFile=0x5dc) returned 0x1
	[0083.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.503] GetFileType (hFile=0x5dc) returned 0x1
	[0083.503] WriteFile (in: hFile=0x5dc, lpBuffer=0x2530cd8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2530cd8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.504] CloseHandle (hObject=0x5dc) returned 1
	[0083.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0083.504] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0083.504] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.505] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.505] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.505] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0083.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0083.505] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0083.505] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.505] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.506] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0083.506] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0083.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.506] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0083.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.506] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.506] GetFileType (hFile=0x5dc) returned 0x1
	[0083.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.506] GetFileType (hFile=0x5dc) returned 0x1
	[0083.506] WriteFile (in: hFile=0x5dc, lpBuffer=0x2534cfc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2534cfc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.507] CloseHandle (hObject=0x5dc) returned 1
	[0083.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.507] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0083.507] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0083.507] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.508] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.508] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.508] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0083.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.508] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0083.508] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0083.508] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.508] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.508] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0083.508] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0083.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.509] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0083.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.509] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.509] GetFileType (hFile=0x5dc) returned 0x1
	[0083.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.509] GetFileType (hFile=0x5dc) returned 0x1
	[0083.509] WriteFile (in: hFile=0x5dc, lpBuffer=0x2538cec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2538cec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.510] CloseHandle (hObject=0x5dc) returned 1
	[0083.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.510] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0083.510] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0083.510] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.510] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.510] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.510] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0083.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0083.511] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0083.511] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.511] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.511] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0083.511] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0083.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0083.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.511] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.512] GetFileType (hFile=0x5dc) returned 0x1
	[0083.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.512] GetFileType (hFile=0x5dc) returned 0x1
	[0083.512] WriteFile (in: hFile=0x5dc, lpBuffer=0x253ccc0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253ccc0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.515] CloseHandle (hObject=0x5dc) returned 1
	[0083.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0083.515] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0083.516] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.516] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.516] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.516] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0083.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.516] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0083.516] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0083.516] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.516] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.516] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0083.517] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0083.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.517] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0083.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.517] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.517] GetFileType (hFile=0x5dc) returned 0x1
	[0083.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.518] GetFileType (hFile=0x5dc) returned 0x1
	[0083.518] WriteFile (in: hFile=0x5dc, lpBuffer=0x2540c94*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2540c94*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.518] CloseHandle (hObject=0x5dc) returned 1
	[0083.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.519] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0083.519] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0083.519] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.519] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.519] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.519] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0083.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.519] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0083.519] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0083.519] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.520] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.520] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0083.520] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0083.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.520] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0083.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.520] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.520] GetFileType (hFile=0x5dc) returned 0x1
	[0083.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.520] GetFileType (hFile=0x5dc) returned 0x1
	[0083.520] WriteFile (in: hFile=0x5dc, lpBuffer=0x2544c4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2544c4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.521] CloseHandle (hObject=0x5dc) returned 1
	[0083.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0083.521] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0083.521] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.522] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.522] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.522] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0083.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.522] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0083.522] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0083.522] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.522] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.522] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0083.522] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0083.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.523] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0083.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.523] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.523] GetFileType (hFile=0x5dc) returned 0x1
	[0083.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.523] GetFileType (hFile=0x5dc) returned 0x1
	[0083.523] WriteFile (in: hFile=0x5dc, lpBuffer=0x2548c20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2548c20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.524] CloseHandle (hObject=0x5dc) returned 1
	[0083.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0083.524] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0083.524] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.524] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.525] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.525] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0083.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.525] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0083.525] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0083.525] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.525] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.525] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0083.525] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0083.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.525] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0083.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.525] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.526] GetFileType (hFile=0x5dc) returned 0x1
	[0083.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.526] GetFileType (hFile=0x5dc) returned 0x1
	[0083.526] WriteFile (in: hFile=0x5dc, lpBuffer=0x254cc70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254cc70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.526] CloseHandle (hObject=0x5dc) returned 1
	[0083.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.527] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0083.527] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0083.527] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.527] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.527] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.527] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0083.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.527] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0083.527] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0083.527] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.528] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0083.528] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0083.528] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0083.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.528] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0083.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.528] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.529] GetFileType (hFile=0x5dc) returned 0x1
	[0083.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.529] GetFileType (hFile=0x5dc) returned 0x1
	[0083.529] WriteFile (in: hFile=0x5dc, lpBuffer=0x2550c44*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2550c44*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.529] CloseHandle (hObject=0x5dc) returned 1
	[0083.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.530] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM", lpFilePart=0x0) returned 0x1c
	[0083.530] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x69a94388, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0083.530] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x69a94388, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.530] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69a94388, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69a94388, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69a94388, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.530] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1
	[0083.530] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1
	[0083.530] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1
	[0083.530] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.530] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0083.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.530] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM", lpFilePart=0x0) returned 0x1c
	[0083.531] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x69a94388, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69a94388, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0083.531] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x69a94388, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69a94388, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.531] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69a94388, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69a94388, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69a94388, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.531] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1
	[0083.531] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1
	[0083.531] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1
	[0083.531] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 0
	[0083.531] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0083.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.531] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0083.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.531] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.533] GetFileType (hFile=0x5dc) returned 0x1
	[0083.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.533] GetFileType (hFile=0x5dc) returned 0x1
	[0083.533] WriteFile (in: hFile=0x5dc, lpBuffer=0x25545d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25545d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.534] CloseHandle (hObject=0x5dc) returned 1
	[0083.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.534] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\AppV", lpFilePart=0x0) returned 0x21
	[0083.534] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0083.534] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.534] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69aba662, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69aba662, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.534] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1
	[0083.534] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.534] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0083.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.535] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\AppV", lpFilePart=0x0) returned 0x21
	[0083.535] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x69aba662, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0083.535] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x69aba662, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.535] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69aba662, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69aba662, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.535] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1
	[0083.535] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 0
	[0083.535] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0083.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.535] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\AppV\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0083.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.535] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\appv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.536] GetFileType (hFile=0x5dc) returned 0x1
	[0083.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.536] GetFileType (hFile=0x5dc) returned 0x1
	[0083.536] WriteFile (in: hFile=0x5dc, lpBuffer=0x2557ae4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2557ae4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.537] CloseHandle (hObject=0x5dc) returned 1
	[0083.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.537] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun", lpFilePart=0x0) returned 0x27
	[0083.537] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0083.537] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.537] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", cAlternateFileName="0D0D4E~1")) returned 1
	[0083.537] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1
	[0083.538] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1
	[0083.538] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69aba662, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69aba662, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.538] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1
	[0083.538] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1
	[0083.538] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1
	[0083.538] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1
	[0083.538] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1
	[0083.538] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1
	[0083.538] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1
	[0083.538] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.539] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0083.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.539] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun", lpFilePart=0x0) returned 0x27
	[0083.539] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69aba662, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0083.539] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69aba662, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.539] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", cAlternateFileName="0D0D4E~1")) returned 1
	[0083.539] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1
	[0083.539] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1
	[0083.539] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69aba662, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69aba662, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.539] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1
	[0083.540] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1
	[0083.540] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1
	[0083.540] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1
	[0083.540] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1
	[0083.540] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1
	[0083.540] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1
	[0083.540] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0
	[0083.540] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0083.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.540] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0083.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.540] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.541] GetFileType (hFile=0x5dc) returned 0x1
	[0083.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.541] GetFileType (hFile=0x5dc) returned 0x1
	[0083.541] WriteFile (in: hFile=0x5dc, lpBuffer=0x255d200*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255d200*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.542] CloseHandle (hObject=0x5dc) returned 1
	[0083.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.542] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23
	[0083.542] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0083.542] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.542] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69aba662, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69aba662, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.543] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1
	[0083.543] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1
	[0083.543] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1
	[0083.543] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0083.543] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1
	[0083.543] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.543] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0083.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.543] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23
	[0083.543] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69aba662, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0083.543] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69aba662, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.543] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69aba662, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69aba662, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69aba662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.543] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1
	[0083.544] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1
	[0083.544] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1
	[0083.544] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0083.544] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1
	[0083.544] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0
	[0083.544] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0083.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.544] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0083.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.544] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.545] GetFileType (hFile=0x5dc) returned 0x1
	[0083.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.545] GetFileType (hFile=0x5dc) returned 0x1
	[0083.545] WriteFile (in: hFile=0x5dc, lpBuffer=0x25610bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25610bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.545] CloseHandle (hObject=0x5dc) returned 1
	[0083.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.546] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart", lpFilePart=0x0) returned 0x25
	[0083.546] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69ae087c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0083.546] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69ae087c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.546] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69ae087c, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69ae087c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69ae087c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.546] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1
	[0083.546] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.546] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0083.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.546] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart", lpFilePart=0x0) returned 0x25
	[0083.546] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69ae087c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69ae087c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0083.546] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69ae087c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69ae087c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.546] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69ae087c, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69ae087c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69ae087c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.546] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1
	[0083.546] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0
	[0083.547] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0083.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.547] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0083.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.547] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\datamart\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.547] GetFileType (hFile=0x5dc) returned 0x1
	[0083.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.547] GetFileType (hFile=0x5dc) returned 0x1
	[0083.548] WriteFile (in: hFile=0x5dc, lpBuffer=0x2564708*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2564708*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.646] CloseHandle (hObject=0x5dc) returned 1
	[0083.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.646] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x29
	[0083.646] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0083.646] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.646] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b52e44, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69b52e44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.646] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1
	[0083.647] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1
	[0083.647] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.647] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0083.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.647] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x29
	[0083.647] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69b52e44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0083.647] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69b52e44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.647] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b52e44, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69b52e44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.647] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1
	[0083.647] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1
	[0083.647] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0
	[0083.647] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0083.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.648] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0083.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.648] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.648] GetFileType (hFile=0x5dc) returned 0x1
	[0083.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.648] GetFileType (hFile=0x5dc) returned 0x1
	[0083.649] WriteFile (in: hFile=0x5dc, lpBuffer=0x25680dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25680dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.649] CloseHandle (hObject=0x5dc) returned 1
	[0083.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.649] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x27
	[0083.649] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0083.650] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.650] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b52e44, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69b52e44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.650] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b52e44, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69b52e44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0083.650] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0083.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.650] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x27
	[0083.650] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69b52e44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0083.650] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69b52e44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.650] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b52e44, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69b52e44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b52e44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.650] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.650] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0083.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.650] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0083.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.650] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.651] GetFileType (hFile=0x5dc) returned 0x1
	[0083.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.651] GetFileType (hFile=0x5dc) returned 0x1
	[0083.651] WriteFile (in: hFile=0x5dc, lpBuffer=0x256b528*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256b528*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.652] CloseHandle (hObject=0x5dc) returned 1
	[0083.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.652] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis", lpFilePart=0x0) returned 0x26
	[0083.652] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0083.652] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.652] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AsimovUploader", cAlternateFileName="ASIMOV~1")) returned 1
	[0083.652] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b78fff, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69b78fff, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedScenarios", cAlternateFileName="DOWNLO~1")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedSettings", cAlternateFileName="DOWNLO~2")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETLLogs", cAlternateFileName="")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_CostDeferred.rbs", cAlternateFileName="EVENTS~3.RBS")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b5e567a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b5e567a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x1000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Normal.rbs", cAlternateFileName="EVENTS~1.RBS")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_NormalCritical.rbs", cAlternateFileName="EVENTS~2.RBS")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x333333, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Realtime.rbs", cAlternateFileName="EVENTS~4.RBS")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalTraceStore", cAlternateFileName="LOCALT~1")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="osver.txt", cAlternateFileName="")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="parse.dat", cAlternateFileName="")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sideload", cAlternateFileName="")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Siufloc", cAlternateFileName="")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLanding", cAlternateFileName="SOFTLA~1")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLandingStage", cAlternateFileName="SOFTLA~2")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TenantStorage", cAlternateFileName="TENANT~1")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 1
	[0083.653] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 0
	[0083.680] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0083.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.680] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis", lpFilePart=0x0) returned 0x26
	[0083.680] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69b78fff, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0083.680] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69b78fff, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.680] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AsimovUploader", cAlternateFileName="ASIMOV~1")) returned 1
	[0083.680] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b78fff, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69b78fff, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.680] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedScenarios", cAlternateFileName="DOWNLO~1")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedSettings", cAlternateFileName="DOWNLO~2")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETLLogs", cAlternateFileName="")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_CostDeferred.rbs", cAlternateFileName="EVENTS~3.RBS")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b5e567a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b5e567a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x1000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Normal.rbs", cAlternateFileName="EVENTS~1.RBS")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_NormalCritical.rbs", cAlternateFileName="EVENTS~2.RBS")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x333333, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Realtime.rbs", cAlternateFileName="EVENTS~4.RBS")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalTraceStore", cAlternateFileName="LOCALT~1")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="osver.txt", cAlternateFileName="")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="parse.dat", cAlternateFileName="")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sideload", cAlternateFileName="")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Siufloc", cAlternateFileName="")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLanding", cAlternateFileName="SOFTLA~1")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLandingStage", cAlternateFileName="SOFTLA~2")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TenantStorage", cAlternateFileName="TENANT~1")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 1
	[0083.681] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.681] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0083.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.681] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Decrypt.txt", lpFilePart=0x0) returned 0x32
	[0083.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.681] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.682] GetFileType (hFile=0x5dc) returned 0x1
	[0083.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.682] GetFileType (hFile=0x5dc) returned 0x1
	[0083.682] WriteFile (in: hFile=0x5dc, lpBuffer=0x2571b48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2571b48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.683] CloseHandle (hObject=0x5dc) returned 1
	[0083.683] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM", lpFilePart=0x0) returned 0x20
	[0083.683] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0083.683] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.683] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b78fff, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69b78fff, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.683] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1
	[0083.683] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.683] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0083.684] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM", lpFilePart=0x0) returned 0x20
	[0083.684] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69b78fff, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0083.684] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69b78fff, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.684] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b78fff, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69b78fff, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.684] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1
	[0083.684] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0
	[0083.684] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0083.684] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0083.684] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\drm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.685] GetFileType (hFile=0x5dc) returned 0x1
	[0083.685] GetFileType (hFile=0x5dc) returned 0x1
	[0083.685] WriteFile (in: hFile=0x5dc, lpBuffer=0x2575058*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2575058*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.685] CloseHandle (hObject=0x5dc) returned 1
	[0083.686] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x29
	[0083.686] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0083.686] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.686] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b78fff, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69b78fff, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.686] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1
	[0083.686] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.686] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0083.686] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x29
	[0083.686] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x69b78fff, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0083.686] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x69b78fff, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.686] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b78fff, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69b78fff, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.686] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1
	[0083.686] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0
	[0083.686] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0083.687] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0083.687] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.687] GetFileType (hFile=0x5dc) returned 0x1
	[0083.687] GetFileType (hFile=0x5dc) returned 0x1
	[0083.687] WriteFile (in: hFile=0x5dc, lpBuffer=0x257876c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257876c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.688] CloseHandle (hObject=0x5dc) returned 1
	[0083.688] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x28
	[0083.688] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0083.689] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b78fff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.693] WriteFile (in: hFile=0x5dc, lpBuffer=0x257c144*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257c144*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.695] WriteFile (in: hFile=0x5dc, lpBuffer=0x257f510*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257f510*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.696] WriteFile (in: hFile=0x5dc, lpBuffer=0x2582c1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2582c1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.698] WriteFile (in: hFile=0x5dc, lpBuffer=0x25863f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25863f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.699] WriteFile (in: hFile=0x5dc, lpBuffer=0x2589d4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2589d4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.701] WriteFile (in: hFile=0x5dc, lpBuffer=0x258d3e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258d3e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.702] WriteFile (in: hFile=0x5dc, lpBuffer=0x2595734*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2595734*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.704] WriteFile (in: hFile=0x5dc, lpBuffer=0x2598cd4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2598cd4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.800] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0083.801] WriteFile (in: hFile=0x5dc, lpBuffer=0x259c3e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259c3e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511db20) returned 1
	[0083.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.804] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Spectrum", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Spectrum", lpFilePart=0x0) returned 0x25
	[0083.804] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Spectrum\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0083.804] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.804] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e018a9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e018a9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.804] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e018a9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e018a9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0083.805] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0083.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.805] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Spectrum", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Spectrum", lpFilePart=0x0) returned 0x25
	[0083.805] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Spectrum\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69e018a9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0083.805] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69e018a9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.805] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e018a9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e018a9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.805] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.805] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0083.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.806] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Spectrum\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Spectrum\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0083.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.806] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Spectrum\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\spectrum\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.806] GetFileType (hFile=0x5dc) returned 0x1
	[0083.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.806] GetFileType (hFile=0x5dc) returned 0x1
	[0083.807] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a0b48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a0b48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.807] CloseHandle (hObject=0x5dc) returned 1
	[0083.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.807] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Speech_OneCore", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Speech_OneCore", lpFilePart=0x0) returned 0x2b
	[0083.808] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0083.808] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.808] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e018a9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e018a9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.808] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e018a9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e018a9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0083.808] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0083.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.808] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Speech_OneCore", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Speech_OneCore", lpFilePart=0x0) returned 0x2b
	[0083.808] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69e018a9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0083.809] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69e018a9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.809] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e018a9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e018a9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e018a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.809] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.809] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0083.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.809] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0083.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.809] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\speech_onecore\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.810] GetFileType (hFile=0x5dc) returned 0x1
	[0083.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.810] GetFileType (hFile=0x5dc) returned 0x1
	[0083.810] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a4074*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a4074*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.811] CloseHandle (hObject=0x5dc) returned 1
	[0083.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.811] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Storage Health", lpFilePart=0x0) returned 0x2b
	[0083.811] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0083.811] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.812] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e018a9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e018a9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.812] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4dcad0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x2ab8b28d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x1571, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageEventsArchive.dat", cAlternateFileName="STORAG~1.DAT")) returned 1
	[0083.812] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 1
	[0083.812] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 0
	[0083.812] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0083.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.813] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Storage Health", lpFilePart=0x0) returned 0x2b
	[0083.813] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69e279e6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0083.813] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69e279e6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.813] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e018a9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e018a9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.813] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4dcad0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x2ab8b28d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x1571, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageEventsArchive.dat", cAlternateFileName="STORAG~1.DAT")) returned 1
	[0083.813] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 1
	[0083.814] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.814] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0083.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.814] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Storage Health\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0083.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.814] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\storage health\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.815] GetFileType (hFile=0x5dc) returned 0x1
	[0083.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.815] GetFileType (hFile=0x5dc) returned 0x1
	[0083.815] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a7c80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a7c80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.816] CloseHandle (hObject=0x5dc) returned 1
	[0083.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.816] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV", lpFilePart=0x0) returned 0x20
	[0083.816] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0083.816] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.816] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e279e6, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e279e6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.817] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InboxTemplates", cAlternateFileName="INBOXT~1")) returned 1
	[0083.817] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scripts", cAlternateFileName="")) returned 1
	[0083.817] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0083.817] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.817] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0083.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.817] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV", lpFilePart=0x0) returned 0x20
	[0083.817] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x69e279e6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0083.817] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x69e279e6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.818] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e279e6, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e279e6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.818] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InboxTemplates", cAlternateFileName="INBOXT~1")) returned 1
	[0083.818] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scripts", cAlternateFileName="")) returned 1
	[0083.818] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0083.818] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0
	[0083.818] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0083.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.818] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0083.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.818] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\uev\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.819] GetFileType (hFile=0x5dc) returned 0x1
	[0083.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.819] GetFileType (hFile=0x5dc) returned 0x1
	[0083.819] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ab6ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ab6ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.820] CloseHandle (hObject=0x5dc) returned 1
	[0083.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.820] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x32
	[0083.820] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0083.820] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.820] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e279e6, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e279e6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.821] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecc15f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa4ecc15f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa4ecc15f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x930d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default User.dat", cAlternateFileName="DEFAUL~1.DAT")) returned 1
	[0083.821] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37896d36, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37896d36, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37896d36, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy.dat", cAlternateFileName="")) returned 1
	[0083.821] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1
	[0083.821] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.png", cAlternateFileName="")) returned 1
	[0083.821] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-192.png", cAlternateFileName="")) returned 1
	[0083.821] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-32.png", cAlternateFileName="")) returned 1
	[0083.821] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-40.png", cAlternateFileName="")) returned 1
	[0083.821] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-48.png", cAlternateFileName="")) returned 1
	[0083.822] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1
	[0083.822] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png", cAlternateFileName="")) returned 1
	[0083.822] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png", cAlternateFileName="")) returned 0
	[0083.822] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0083.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.822] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x32
	[0083.822] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69e279e6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0083.822] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69e279e6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.823] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e279e6, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e279e6, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e279e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.823] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecc15f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa4ecc15f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa4ecc15f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x930d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default User.dat", cAlternateFileName="DEFAUL~1.DAT")) returned 1
	[0083.823] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37896d36, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37896d36, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37896d36, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy.dat", cAlternateFileName="")) returned 1
	[0083.823] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1
	[0083.823] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.png", cAlternateFileName="")) returned 1
	[0083.823] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-192.png", cAlternateFileName="")) returned 1
	[0083.823] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-32.png", cAlternateFileName="")) returned 1
	[0083.823] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-40.png", cAlternateFileName="")) returned 1
	[0083.823] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-48.png", cAlternateFileName="")) returned 1
	[0083.823] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1
	[0083.824] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png", cAlternateFileName="")) returned 1
	[0083.824] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.824] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0083.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.824] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0083.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.824] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.825] GetFileType (hFile=0x5dc) returned 0x1
	[0083.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.825] GetFileType (hFile=0x5dc) returned 0x1
	[0083.825] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b0afc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b0afc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.825] CloseHandle (hObject=0x5dc) returned 1
	[0083.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.826] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault", lpFilePart=0x0) returned 0x22
	[0083.826] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e4dd2b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0083.826] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e4dd2b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.826] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 1
	[0083.826] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e4dd2b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e4dd2b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e4dd2b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.826] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e4dd2b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e4dd2b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e4dd2b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0083.826] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0083.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.827] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault", lpFilePart=0x0) returned 0x22
	[0083.827] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x69e4dd2b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e4dd2b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0083.827] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x69e4dd2b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e4dd2b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.827] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 1
	[0083.827] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e4dd2b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e4dd2b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e4dd2b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.827] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.827] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0083.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.827] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0083.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.828] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\vault\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.828] GetFileType (hFile=0x5dc) returned 0x1
	[0083.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.828] GetFileType (hFile=0x5dc) returned 0x1
	[0083.828] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b423c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b423c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.829] CloseHandle (hObject=0x5dc) returned 1
	[0083.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.829] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WDF", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WDF", lpFilePart=0x0) returned 0x20
	[0083.829] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WDF\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e73e65, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0083.830] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e73e65, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.830] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e73e65, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e73e65, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.830] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e73e65, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e73e65, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0083.830] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0083.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.830] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WDF", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WDF", lpFilePart=0x0) returned 0x20
	[0083.830] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WDF\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69e73e65, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e73e65, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0083.831] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69e73e65, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69e73e65, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.831] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e73e65, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69e73e65, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.831] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.831] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0083.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.831] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WDF\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WDF\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0083.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.831] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WDF\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\wdf\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.832] GetFileType (hFile=0x5dc) returned 0x1
	[0083.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.832] GetFileType (hFile=0x5dc) returned 0x1
	[0083.832] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b7528*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b7528*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.833] CloseHandle (hObject=0x5dc) returned 1
	[0083.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.833] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WinMSIPC", lpFilePart=0x0) returned 0x25
	[0083.833] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0083.833] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.833] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69f7f0ce, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69f7f0ce, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.833] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1
	[0083.833] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.834] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0083.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.834] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WinMSIPC", lpFilePart=0x0) returned 0x25
	[0083.834] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69f7f0ce, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0083.834] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69f7f0ce, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.834] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69f7f0ce, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69f7f0ce, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.834] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1
	[0083.834] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0
	[0083.834] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0083.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.835] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0083.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.835] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\winmsipc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.835] GetFileType (hFile=0x5dc) returned 0x1
	[0083.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.835] GetFileType (hFile=0x5dc) returned 0x1
	[0083.836] WriteFile (in: hFile=0x5dc, lpBuffer=0x25bab58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bab58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.836] CloseHandle (hObject=0x5dc) returned 1
	[0083.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x24
	[0083.837] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0083.837] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.837] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69f7f0ce, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69f7f0ce, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.837] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMProfiles", cAlternateFileName="DMPROF~1")) returned 1
	[0083.837] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0083.837] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.837] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0083.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.837] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x24
	[0083.838] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69f7f0ce, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0083.838] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69f7f0ce, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.838] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69f7f0ce, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69f7f0ce, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69f7f0ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.838] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMProfiles", cAlternateFileName="DMPROF~1")) returned 1
	[0083.838] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0083.838] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0
	[0083.838] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0083.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.838] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0083.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.839] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.839] GetFileType (hFile=0x5dc) returned 0x1
	[0083.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.839] GetFileType (hFile=0x5dc) returned 0x1
	[0083.839] WriteFile (in: hFile=0x5dc, lpBuffer=0x25be424*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25be424*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.840] CloseHandle (hObject=0x5dc) returned 1
	[0083.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.840] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft OneDrive\\setup", lpFilePart=0x0) returned 0x2b
	[0083.840] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0083.841] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.841] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69fa5250, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69fa5250, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.841] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 1
	[0083.841] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 0
	[0083.841] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0083.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.841] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft OneDrive\\setup", lpFilePart=0x0) returned 0x2b
	[0083.841] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69fa5250, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0083.841] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69fa5250, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.842] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69fa5250, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69fa5250, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.842] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 1
	[0083.842] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.842] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0083.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0083.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.842] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.843] GetFileType (hFile=0x5dc) returned 0x1
	[0083.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.843] GetFileType (hFile=0x5dc) returned 0x1
	[0083.843] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c1c0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c1c0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.844] CloseHandle (hObject=0x5dc) returned 1
	[0083.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.844] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java", lpFilePart=0x0) returned 0x1e
	[0083.844] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0083.844] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.844] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".oracle_jre_usage", cAlternateFileName="ORACLE~1")) returned 1
	[0083.844] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69fa5250, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69fa5250, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.844] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="installcache_x64", cAlternateFileName="INSTAL~1")) returned 1
	[0083.844] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath", cAlternateFileName="")) returned 1
	[0083.845] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1
	[0083.845] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.845] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0083.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.845] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java", lpFilePart=0x0) returned 0x1e
	[0083.845] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x69fa5250, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0083.890] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x69fa5250, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.890] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".oracle_jre_usage", cAlternateFileName="ORACLE~1")) returned 1
	[0083.890] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69fa5250, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69fa5250, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.890] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="installcache_x64", cAlternateFileName="INSTAL~1")) returned 1
	[0083.891] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath", cAlternateFileName="")) returned 1
	[0083.891] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1
	[0083.891] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 0
	[0083.891] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0083.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.891] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\Decrypt.txt", lpFilePart=0x0) returned 0x2a
	[0083.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.891] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\Decrypt.txt" (normalized: "c:\\users\\all users\\oracle\\java\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.892] GetFileType (hFile=0x5dc) returned 0x1
	[0083.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.892] GetFileType (hFile=0x5dc) returned 0x1
	[0083.892] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c5ae8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c5ae8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.893] CloseHandle (hObject=0x5dc) returned 1
	[0083.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.893] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0083.893] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.893] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.894] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fa5250, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69fa5250, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.894] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.894] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.894] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.894] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0083.894] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x69fa5250, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0083.895] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x69fa5250, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.895] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fa5250, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69fa5250, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fa5250, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.895] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.895] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0083.895] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0083.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.895] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0083.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.895] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.896] GetFileType (hFile=0x5dc) returned 0x1
	[0083.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.896] GetFileType (hFile=0x5dc) returned 0x1
	[0083.896] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c9c94*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c9c94*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.897] CloseHandle (hObject=0x5dc) returned 1
	[0083.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.897] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x47
	[0083.897] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0083.898] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.898] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fcb3d9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69fcb3d9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.898] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x354d9570, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0083.898] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0083.898] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0083.898] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0083.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.899] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x47
	[0083.899] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x69fcb3d9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0083.899] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x69fcb3d9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.899] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fcb3d9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69fcb3d9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.899] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x354d9570, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0083.899] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0083.899] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.899] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0083.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.900] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0083.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.900] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.901] GetFileType (hFile=0x5dc) returned 0x1
	[0083.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.901] GetFileType (hFile=0x5dc) returned 0x1
	[0083.901] WriteFile (in: hFile=0x5dc, lpBuffer=0x25cdf94*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cdf94*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.901] CloseHandle (hObject=0x5dc) returned 1
	[0083.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.902] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0083.902] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0083.902] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.902] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fcb3d9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69fcb3d9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.902] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.903] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.903] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0083.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.903] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0083.903] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x69fcb3d9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0083.903] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x69fcb3d9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.903] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fcb3d9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69fcb3d9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.903] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.903] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0083.904] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0083.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.904] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0083.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.904] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.905] GetFileType (hFile=0x5dc) returned 0x1
	[0083.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.905] GetFileType (hFile=0x5dc) returned 0x1
	[0083.905] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d2140*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d2140*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.906] CloseHandle (hObject=0x5dc) returned 1
	[0083.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.906] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpFilePart=0x0) returned 0x47
	[0083.906] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0083.906] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.906] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fcb3d9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69fcb3d9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.907] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3639a1f2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0083.907] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0083.907] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0083.907] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0083.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.907] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpFilePart=0x0) returned 0x47
	[0083.907] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x69fcb3d9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0083.907] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x69fcb3d9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.908] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fcb3d9, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x69fcb3d9, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x69fcb3d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.908] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3639a1f2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0083.908] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0083.908] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.908] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0083.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.908] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0083.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.908] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.909] GetFileType (hFile=0x5dc) returned 0x1
	[0083.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.909] GetFileType (hFile=0x5dc) returned 0x1
	[0083.909] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d6440*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d6440*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.910] CloseHandle (hObject=0x5dc) returned 1
	[0083.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.910] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0083.911] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a122b7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0083.911] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a122b7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.911] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a122b7b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a122b7b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a122b7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.911] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.911] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.911] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0083.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.911] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0083.911] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a122b7b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a122b7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.911] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a122b7b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a122b7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.912] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a122b7b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a122b7b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a122b7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.912] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.912] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0083.912] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.912] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0083.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.912] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.913] GetFileType (hFile=0x5dc) returned 0x1
	[0083.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.913] GetFileType (hFile=0x5dc) returned 0x1
	[0083.913] WriteFile (in: hFile=0x5dc, lpBuffer=0x25da60c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25da60c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.914] CloseHandle (hObject=0x5dc) returned 1
	[0083.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.914] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0083.915] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a122b7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0083.915] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a122b7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.915] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a122b7b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a122b7b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a122b7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.915] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.915] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.915] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0083.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.915] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0083.915] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a122b7b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a122b7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0083.916] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a122b7b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a122b7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.916] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a122b7b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a122b7b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a122b7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.916] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.916] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0083.916] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0083.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.916] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0083.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.916] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.917] GetFileType (hFile=0x5dc) returned 0x1
	[0083.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.917] GetFileType (hFile=0x5dc) returned 0x1
	[0083.917] WriteFile (in: hFile=0x5dc, lpBuffer=0x25de7d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25de7d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.918] CloseHandle (hObject=0x5dc) returned 1
	[0083.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.918] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0083.918] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0083.919] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.919] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a151b63, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a151b63, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.919] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.919] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.919] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0083.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.919] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0083.919] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a151b63, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0083.920] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a151b63, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.920] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a151b63, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a151b63, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.920] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.920] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0083.920] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0083.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.920] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0083.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.920] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.921] GetFileType (hFile=0x5dc) returned 0x1
	[0083.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.921] GetFileType (hFile=0x5dc) returned 0x1
	[0083.921] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e29a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e29a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.922] CloseHandle (hObject=0x5dc) returned 1
	[0083.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.922] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0083.922] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0083.922] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.923] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a151b63, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a151b63, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.923] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.923] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.923] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0083.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.923] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0083.923] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a151b63, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0083.923] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a151b63, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.923] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a151b63, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a151b63, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.923] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.924] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0083.924] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0083.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.924] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0083.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.924] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.925] GetFileType (hFile=0x5dc) returned 0x1
	[0083.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.925] GetFileType (hFile=0x5dc) returned 0x1
	[0083.925] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e6b50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e6b50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.926] CloseHandle (hObject=0x5dc) returned 1
	[0083.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.926] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0083.926] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0083.926] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.926] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a151b63, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a151b63, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.926] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.926] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.926] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0083.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.927] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0083.927] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a151b63, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0083.927] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a151b63, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.927] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a151b63, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a151b63, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a151b63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.927] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.927] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0083.927] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0083.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.927] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0083.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.927] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.986] GetFileType (hFile=0x5dc) returned 0x1
	[0083.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.986] GetFileType (hFile=0x5dc) returned 0x1
	[0083.986] WriteFile (in: hFile=0x5dc, lpBuffer=0x25eadbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25eadbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.987] CloseHandle (hObject=0x5dc) returned 1
	[0083.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.987] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0083.987] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0083.988] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.988] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1952e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.988] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.988] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.988] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0083.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.988] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0083.988] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.988] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.988] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1952e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.988] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.989] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0083.989] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.989] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0083.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.989] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.990] GetFileType (hFile=0x5dc) returned 0x1
	[0083.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.990] GetFileType (hFile=0x5dc) returned 0x1
	[0083.990] WriteFile (in: hFile=0x5dc, lpBuffer=0x25eef68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25eef68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.990] CloseHandle (hObject=0x5dc) returned 1
	[0083.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.991] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0083.991] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0083.991] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.991] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1952e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.991] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.991] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.991] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0083.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.991] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0083.991] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0083.991] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.991] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1952e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.992] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.992] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0083.992] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0083.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.992] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0083.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.992] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.992] GetFileType (hFile=0x5dc) returned 0x1
	[0083.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.993] GetFileType (hFile=0x5dc) returned 0x1
	[0083.993] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f3114*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f3114*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.993] CloseHandle (hObject=0x5dc) returned 1
	[0083.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.993] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpFilePart=0x0) returned 0x47
	[0083.994] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.994] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.994] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1952e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.994] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x359ea6b6, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0083.994] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0083.994] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0083.994] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.994] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpFilePart=0x0) returned 0x47
	[0083.994] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0083.994] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.994] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1952e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.994] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x359ea6b6, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0083.994] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0083.994] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.994] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0083.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.995] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0083.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.995] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.995] GetFileType (hFile=0x5dc) returned 0x1
	[0083.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.995] GetFileType (hFile=0x5dc) returned 0x1
	[0083.995] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f7414*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f7414*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.996] CloseHandle (hObject=0x5dc) returned 1
	[0083.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.996] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0083.996] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0083.997] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.997] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1952e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.997] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.997] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.997] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0083.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.997] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0083.997] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0083.997] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.997] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1952e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.997] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.997] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0083.997] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0083.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0083.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0083.997] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0083.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0083.997] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0083.998] GetFileType (hFile=0x5dc) returned 0x1
	[0083.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0083.998] GetFileType (hFile=0x5dc) returned 0x1
	[0083.998] WriteFile (in: hFile=0x5dc, lpBuffer=0x25fb5c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fb5c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0083.999] CloseHandle (hObject=0x5dc) returned 1
	[0083.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0083.999] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0083.999] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0083.999] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.999] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1952e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0083.999] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0083.999] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0083.999] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0084.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.000] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0084.000] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0084.000] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.000] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1952e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a1952e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a1952e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0084.000] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0084.000] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0084.000] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0084.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.000] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0084.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.000] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.001] GetFileType (hFile=0x5dc) returned 0x1
	[0084.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.001] GetFileType (hFile=0x5dc) returned 0x1
	[0084.001] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ff78c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ff78c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.063] CloseHandle (hObject=0x5dc) returned 1
	[0084.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.064] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", lpFilePart=0x0) returned 0x47
	[0084.064] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6a253dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0084.064] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6a253dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.064] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a253dda, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a253dda, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a253dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0084.064] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x37687158, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0084.064] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1
	[0084.064] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0
	[0084.064] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0084.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.065] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", lpFilePart=0x0) returned 0x47
	[0084.065] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a253dda, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a253dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0084.065] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a253dda, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a253dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.065] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a253dda, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a253dda, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a253dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0084.065] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x37687158, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0084.065] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1
	[0084.065] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.065] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0084.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.065] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0084.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.065] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.066] GetFileType (hFile=0x5dc) returned 0x1
	[0084.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.066] GetFileType (hFile=0x5dc) returned 0x1
	[0084.066] WriteFile (in: hFile=0x5dc, lpBuffer=0x2603a8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2603a8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.067] CloseHandle (hObject=0x5dc) returned 1
	[0084.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.067] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x47
	[0084.067] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a253dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0084.067] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a253dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.067] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a253dda, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a253dda, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a253dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0084.067] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x35efb7db, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0084.067] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0084.067] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0084.067] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0084.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.067] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x47
	[0084.067] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a253dda, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a253dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0084.068] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6a253dda, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a253dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.068] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a253dda, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6a253dda, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6a253dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0084.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.071] WriteFile (in: hFile=0x5dc, lpBuffer=0x2607d8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2607d8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.074] WriteFile (in: hFile=0x5dc, lpBuffer=0x260c08c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260c08c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.075] WriteFile (in: hFile=0x5dc, lpBuffer=0x2610238*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2610238*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.077] WriteFile (in: hFile=0x5dc, lpBuffer=0x2613f6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2613f6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.127] WriteFile (in: hFile=0x5dc, lpBuffer=0x26224d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26224d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.128] WriteFile (in: hFile=0x5dc, lpBuffer=0x2626404*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2626404*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.130] WriteFile (in: hFile=0x5dc, lpBuffer=0x26299a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26299a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.133] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Music", lpFilePart=0x0) returned 0x23
	[0084.133] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.134] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Music\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0084.134] CreateFileW (lpFileName="C:\\Users\\Default\\Documents\\My Music\\Decrypt.txt" (normalized: "c:\\users\\default\\documents\\my music\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.135] GetFileType (hFile=0x5dc) returned 0x1
	[0084.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.135] GetFileType (hFile=0x5dc) returned 0x1
	[0084.135] WriteFile (in: hFile=0x5dc, lpBuffer=0x262cabc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262cabc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.136] CloseHandle (hObject=0x5dc) returned 1
	[0084.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.136] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Pictures", lpFilePart=0x0) returned 0x26
	[0084.136] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.137] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Pictures", lpFilePart=0x0) returned 0x26
	[0084.137] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.138] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x32
	[0084.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.138] CreateFileW (lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\Decrypt.txt" (normalized: "c:\\users\\default\\documents\\my pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.139] GetFileType (hFile=0x5dc) returned 0x1
	[0084.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.139] GetFileType (hFile=0x5dc) returned 0x1
	[0084.139] WriteFile (in: hFile=0x5dc, lpBuffer=0x262fc68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262fc68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.140] CloseHandle (hObject=0x5dc) returned 1
	[0084.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.144] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Videos", lpFilePart=0x0) returned 0x24
	[0084.144] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.145] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Videos", lpFilePart=0x0) returned 0x24
	[0084.145] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.146] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Videos\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0084.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.146] CreateFileW (lpFileName="C:\\Users\\Default\\Documents\\My Videos\\Decrypt.txt" (normalized: "c:\\users\\default\\documents\\my videos\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.147] GetFileType (hFile=0x5dc) returned 0x1
	[0084.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.147] GetFileType (hFile=0x5dc) returned 0x1
	[0084.147] WriteFile (in: hFile=0x5dc, lpBuffer=0x2632dcc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2632dcc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.148] CloseHandle (hObject=0x5dc) returned 1
	[0084.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.148] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Local", lpFilePart=0x0) returned 0x27
	[0084.148] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0084.149] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.149] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0084.149] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.149] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0084.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.149] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Local", lpFilePart=0x0) returned 0x27
	[0084.150] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0084.150] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.150] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0084.150] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0
	[0084.150] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0084.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.151] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Local\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0084.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.151] CreateFileW (lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Decrypt.txt" (normalized: "c:\\users\\default.migrated\\appdata\\local\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.151] GetFileType (hFile=0x5dc) returned 0x1
	[0084.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.151] GetFileType (hFile=0x5dc) returned 0x1
	[0084.151] WriteFile (in: hFile=0x5dc, lpBuffer=0x263625c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263625c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.152] CloseHandle (hObject=0x5dc) returned 1
	[0084.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.152] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents\\My Music", lpFilePart=0x0) returned 0x2c
	[0084.152] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.153] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents\\My Music", lpFilePart=0x0) returned 0x2c
	[0084.153] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.155] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Music\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents\\My Music\\Decrypt.txt", lpFilePart=0x0) returned 0x38
	[0084.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.155] CreateFileW (lpFileName="C:\\Users\\Default.migrated\\Documents\\My Music\\Decrypt.txt" (normalized: "c:\\users\\default.migrated\\documents\\my music\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.155] GetFileType (hFile=0x5dc) returned 0x1
	[0084.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.155] GetFileType (hFile=0x5dc) returned 0x1
	[0084.155] WriteFile (in: hFile=0x5dc, lpBuffer=0x26394e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26394e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.156] CloseHandle (hObject=0x5dc) returned 1
	[0084.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.156] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents\\My Pictures", lpFilePart=0x0) returned 0x2f
	[0084.156] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.158] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents\\My Pictures", lpFilePart=0x0) returned 0x2f
	[0084.158] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.159] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents\\My Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0084.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.159] CreateFileW (lpFileName="C:\\Users\\Default.migrated\\Documents\\My Pictures\\Decrypt.txt" (normalized: "c:\\users\\default.migrated\\documents\\my pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.160] GetFileType (hFile=0x5dc) returned 0x1
	[0084.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.160] GetFileType (hFile=0x5dc) returned 0x1
	[0084.160] WriteFile (in: hFile=0x5dc, lpBuffer=0x263c7ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263c7ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.161] CloseHandle (hObject=0x5dc) returned 1
	[0084.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.161] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents\\My Videos", lpFilePart=0x0) returned 0x2d
	[0084.161] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.162] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents\\My Videos", lpFilePart=0x0) returned 0x2d
	[0084.162] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.163] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Videos\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents\\My Videos\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0084.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.163] CreateFileW (lpFileName="C:\\Users\\Default.migrated\\Documents\\My Videos\\Decrypt.txt" (normalized: "c:\\users\\default.migrated\\documents\\my videos\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.237] GetFileType (hFile=0x5dc) returned 0x1
	[0084.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.237] GetFileType (hFile=0x5dc) returned 0x1
	[0084.237] WriteFile (in: hFile=0x5dc, lpBuffer=0x263fba4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263fba4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.238] CloseHandle (hObject=0x5dc) returned 1
	[0084.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.238] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local", lpFilePart=0x0) returned 0x1d
	[0084.238] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x6abdd290, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0084.239] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x6abdd290, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.239] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1
	[0084.239] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0084.239] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0084.239] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CEF", cAlternateFileName="")) returned 1
	[0084.239] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1
	[0084.239] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConnectedDevicesPlatform", cAlternateFileName="CONNEC~1")) returned 1
	[0084.239] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6abdd290, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6abdd290, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6abdd290, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0084.240] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1
	[0084.240] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0084.240] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4a3b706e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4a3b706e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x56f5f2ae, ftLastWriteTime.dwHighDateTime=0x1d4ae7c, nFileSizeHigh=0x0, nFileSizeLow=0x11110, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0084.240] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0084.240] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1
	[0084.240] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0084.240] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1
	[0084.241] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdf9e1b08, ftLastWriteTime.dwHighDateTime=0x1d32734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1
	[0084.241] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e09841, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1
	[0084.241] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x66e278ac, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x66e278ac, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0084.241] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0084.241] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3cdbf8a7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1
	[0084.241] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UNP", cAlternateFileName="")) returned 1
	[0084.241] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a795684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1
	[0084.241] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.242] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0084.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local", lpFilePart=0x0) returned 0x1d
	[0084.242] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6abdd290, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6abdd290, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0084.242] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6abdd290, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6abdd290, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.242] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1
	[0084.242] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0084.243] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0084.243] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CEF", cAlternateFileName="")) returned 1
	[0084.243] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1
	[0084.243] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ConnectedDevicesPlatform", cAlternateFileName="CONNEC~1")) returned 1
	[0084.243] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6abdd290, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6abdd290, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6abdd290, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0084.244] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1
	[0084.244] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0084.244] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4a3b706e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4a3b706e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x56f5f2ae, ftLastWriteTime.dwHighDateTime=0x1d4ae7c, nFileSizeHigh=0x0, nFileSizeLow=0x11110, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0084.244] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0084.244] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1
	[0084.244] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0084.245] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1
	[0084.245] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdf9e1b08, ftLastWriteTime.dwHighDateTime=0x1d32734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1
	[0084.245] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e09841, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1
	[0084.245] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x66e278ac, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x66e278ac, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0084.245] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0084.245] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3cdbf8a7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1
	[0084.246] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UNP", cAlternateFileName="")) returned 1
	[0084.246] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a795684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1
	[0084.246] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a795684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0
	[0084.246] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0084.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Decrypt.txt", lpFilePart=0x0) returned 0x29
	[0084.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.246] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.247] GetFileType (hFile=0x5dc) returned 0x1
	[0084.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.247] GetFileType (hFile=0x5dc) returned 0x1
	[0084.247] WriteFile (in: hFile=0x5dc, lpBuffer=0x2645d44*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2645d44*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.248] CloseHandle (hObject=0x5dc) returned 1
	[0084.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.248] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\LocalLow", lpFilePart=0x0) returned 0x20
	[0084.248] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\LocalLow\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0084.249] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.249] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7157dbce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0084.249] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xdfedb1f6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x63cde605, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x63cde605, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0084.249] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfdd2edaa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7275453, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x7275453, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0084.249] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1
	[0084.249] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.249] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0084.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.250] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\LocalLow", lpFilePart=0x0) returned 0x20
	[0084.250] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\LocalLow\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0084.250] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.250] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7157dbce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0084.250] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xdfedb1f6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x63cde605, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x63cde605, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0084.250] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfdd2edaa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7275453, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x7275453, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0084.251] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1
	[0084.251] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0
	[0084.251] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0084.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.251] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0084.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.251] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.314] GetFileType (hFile=0x5dc) returned 0x1
	[0084.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.314] GetFileType (hFile=0x5dc) returned 0x1
	[0084.315] WriteFile (in: hFile=0x5dc, lpBuffer=0x2649660*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2649660*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.315] CloseHandle (hObject=0x5dc) returned 1
	[0084.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.316] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f
	[0084.316] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6aa85cc5, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6aa85cc5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0084.316] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6aa85cc5, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6aa85cc5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.316] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa4f7360, ftCreationTime.dwHighDateTime=0x1d4d22a, ftLastAccessTime.dwLowDateTime=0xd4c36c40, ftLastAccessTime.dwHighDateTime=0x1d4ca92, ftLastWriteTime.dwLowDateTime=0xd4c36c40, ftLastWriteTime.dwHighDateTime=0x1d4ca92, nFileSizeHigh=0x0, nFileSizeLow=0x16e84, dwReserved0=0x0, dwReserved1=0x0, cFileName="2EPHmi6_nPZ8vbbcb DF.mp3", cAlternateFileName="2EPHMI~1.MP3")) returned 1
	[0084.316] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb29b600, ftCreationTime.dwHighDateTime=0x1d4d3a5, ftLastAccessTime.dwLowDateTime=0xcbdd7100, ftLastAccessTime.dwHighDateTime=0x1d4cf44, ftLastWriteTime.dwLowDateTime=0xcbdd7100, ftLastWriteTime.dwHighDateTime=0x1d4cf44, nFileSizeHigh=0x0, nFileSizeLow=0x7c14, dwReserved0=0x0, dwReserved1=0x0, cFileName="2e_muLLvgKK.m4a", cAlternateFileName="2E_MUL~1.M4A")) returned 1
	[0084.316] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9030f030, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0xe4b37d20, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0xe4b37d20, ftLastWriteTime.dwHighDateTime=0x1d4d0a0, nFileSizeHigh=0x0, nFileSizeLow=0xf20d, dwReserved0=0x0, dwReserved1=0x0, cFileName="4ANgj8teVFsAP 6-81.wav", cAlternateFileName="4ANGJ8~1.WAV")) returned 1
	[0084.317] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31283c10, ftCreationTime.dwHighDateTime=0x1d4cc99, ftLastAccessTime.dwLowDateTime=0x1afbbaf0, ftLastAccessTime.dwHighDateTime=0x1d4ce44, ftLastWriteTime.dwLowDateTime=0x1afbbaf0, ftLastWriteTime.dwHighDateTime=0x1d4ce44, nFileSizeHigh=0x0, nFileSizeLow=0x64ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="4AqDBaBsIdRpPojboy.csv", cAlternateFileName="4AQDBA~1.CSV")) returned 1
	[0084.317] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc06baf10, ftCreationTime.dwHighDateTime=0x1d4d1b7, ftLastAccessTime.dwLowDateTime=0x5b0df8d0, ftLastAccessTime.dwHighDateTime=0x1d4cd7f, ftLastWriteTime.dwLowDateTime=0x5b0df8d0, ftLastWriteTime.dwHighDateTime=0x1d4cd7f, nFileSizeHigh=0x0, nFileSizeLow=0x471, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Q6L9ygQV_4yle0.bmp", cAlternateFileName="4Q6L9Y~1.BMP")) returned 1
	[0084.317] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f14e020, ftCreationTime.dwHighDateTime=0x1d4c977, ftLastAccessTime.dwLowDateTime=0x4f4791c0, ftLastAccessTime.dwHighDateTime=0x1d4c62f, ftLastWriteTime.dwLowDateTime=0x4f4791c0, ftLastWriteTime.dwHighDateTime=0x1d4c62f, nFileSizeHigh=0x0, nFileSizeLow=0xdf5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="90eDKidfizwsRlcadt.wav", cAlternateFileName="90EDKI~1.WAV")) returned 1
	[0084.317] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0084.317] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb03c31d0, ftCreationTime.dwHighDateTime=0x1d4d218, ftLastAccessTime.dwLowDateTime=0xd96b5910, ftLastAccessTime.dwHighDateTime=0x1d4cc09, ftLastWriteTime.dwLowDateTime=0xd96b5910, ftLastWriteTime.dwHighDateTime=0x1d4cc09, nFileSizeHigh=0x0, nFileSizeLow=0x7db6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AeQBUMx.m4a", cAlternateFileName="")) returned 1
	[0084.317] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1492c540, ftCreationTime.dwHighDateTime=0x1d4c6cf, ftLastAccessTime.dwLowDateTime=0x41731a00, ftLastAccessTime.dwHighDateTime=0x1d4cf2c, ftLastWriteTime.dwLowDateTime=0x41731a00, ftLastWriteTime.dwHighDateTime=0x1d4cf2c, nFileSizeHigh=0x0, nFileSizeLow=0x1091a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aupAXO5KQBNxYrAoimAs.mkv", cAlternateFileName="AUPAXO~1.MKV")) returned 1
	[0084.317] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530d06f0, ftCreationTime.dwHighDateTime=0x1d4d511, ftLastAccessTime.dwLowDateTime=0x47623750, ftLastAccessTime.dwHighDateTime=0x1d4cc86, ftLastWriteTime.dwLowDateTime=0x47623750, ftLastWriteTime.dwHighDateTime=0x1d4cc86, nFileSizeHigh=0x0, nFileSizeLow=0x154cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bzd10fFq-Jb.flv", cAlternateFileName="BZD10F~1.FLV")) returned 1
	[0084.317] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e847d0, ftCreationTime.dwHighDateTime=0x1d4c872, ftLastAccessTime.dwLowDateTime=0x4f620b80, ftLastAccessTime.dwHighDateTime=0x1d4c888, ftLastWriteTime.dwLowDateTime=0x4f620b80, ftLastWriteTime.dwHighDateTime=0x1d4c888, nFileSizeHigh=0x0, nFileSizeLow=0xa8d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="c2l2sTZr.mp3", cAlternateFileName="")) returned 1
	[0084.318] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9299690, ftCreationTime.dwHighDateTime=0x1d4c961, ftLastAccessTime.dwLowDateTime=0x8275f430, ftLastAccessTime.dwHighDateTime=0x1d4cccc, ftLastWriteTime.dwLowDateTime=0x8275f430, ftLastWriteTime.dwHighDateTime=0x1d4cccc, nFileSizeHigh=0x0, nFileSizeLow=0xa0da, dwReserved0=0x0, dwReserved1=0x0, cFileName="CffnjByNcPJ1.mp4", cAlternateFileName="CFFNJB~1.MP4")) returned 1
	[0084.318] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6aa85cc5, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6aa85cc5, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6aa85cc5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0084.318] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb4b100, ftCreationTime.dwHighDateTime=0x1d4d292, ftLastAccessTime.dwLowDateTime=0x7a573f60, ftLastAccessTime.dwHighDateTime=0x1d4cc82, ftLastWriteTime.dwLowDateTime=0x7a573f60, ftLastWriteTime.dwHighDateTime=0x1d4cc82, nFileSizeHigh=0x0, nFileSizeLow=0x9050, dwReserved0=0x0, dwReserved1=0x0, cFileName="fJptY.png", cAlternateFileName="")) returned 1
	[0084.318] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c94220, ftCreationTime.dwHighDateTime=0x1d4cc98, ftLastAccessTime.dwLowDateTime=0xe9891f60, ftLastAccessTime.dwHighDateTime=0x1d4c800, ftLastWriteTime.dwLowDateTime=0xe9891f60, ftLastWriteTime.dwHighDateTime=0x1d4c800, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="i2-LW4Rn5rNuf5KUj.wav", cAlternateFileName="I2-LW4~1.WAV")) returned 1
	[0084.318] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc62c5e0, ftCreationTime.dwHighDateTime=0x1d4cd01, ftLastAccessTime.dwLowDateTime=0x427c45e0, ftLastAccessTime.dwHighDateTime=0x1d4c9f8, ftLastWriteTime.dwLowDateTime=0x427c45e0, ftLastWriteTime.dwHighDateTime=0x1d4c9f8, nFileSizeHigh=0x0, nFileSizeLow=0x1274a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ihbd_YP-zcVKqRmUr6T.rtf", cAlternateFileName="IHBD_Y~1.RTF")) returned 1
	[0084.318] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3c68650, ftCreationTime.dwHighDateTime=0x1d4c596, ftLastAccessTime.dwLowDateTime=0x28e9e30, ftLastAccessTime.dwHighDateTime=0x1d4d298, ftLastWriteTime.dwLowDateTime=0x28e9e30, ftLastWriteTime.dwHighDateTime=0x1d4d298, nFileSizeHigh=0x0, nFileSizeLow=0x67a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRVAtpRJoe9wy_IH27.png", cAlternateFileName="IRVATP~1.PNG")) returned 1
	[0084.318] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59b3feb0, ftCreationTime.dwHighDateTime=0x1d4d10f, ftLastAccessTime.dwLowDateTime=0xa5b01ec0, ftLastAccessTime.dwHighDateTime=0x1d4d3f8, ftLastWriteTime.dwLowDateTime=0xa5b01ec0, ftLastWriteTime.dwHighDateTime=0x1d4d3f8, nFileSizeHigh=0x0, nFileSizeLow=0x17faf, dwReserved0=0x0, dwReserved1=0x0, cFileName="jAHv99.bmp", cAlternateFileName="")) returned 1
	[0084.319] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1
	[0084.319] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0084.319] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0084.319] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1547d970, ftCreationTime.dwHighDateTime=0x1d4c9b9, ftLastAccessTime.dwLowDateTime=0xccbf0b30, ftLastAccessTime.dwHighDateTime=0x1d4cbd2, ftLastWriteTime.dwLowDateTime=0xccbf0b30, ftLastWriteTime.dwHighDateTime=0x1d4cbd2, nFileSizeHigh=0x0, nFileSizeLow=0x13fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="o5FwHnOMCs-2qhrYzUHO.ots", cAlternateFileName="O5FWHN~1.OTS")) returned 1
	[0084.319] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c926190, ftCreationTime.dwHighDateTime=0x1d4d4c8, ftLastAccessTime.dwLowDateTime=0x5b039220, ftLastAccessTime.dwHighDateTime=0x1d4d0ac, ftLastWriteTime.dwLowDateTime=0x5b039220, ftLastWriteTime.dwHighDateTime=0x1d4d0ac, nFileSizeHigh=0x0, nFileSizeLow=0x93e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OgLd.flv", cAlternateFileName="")) returned 1
	[0084.319] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67a5d80, ftCreationTime.dwHighDateTime=0x1d4cf1f, ftLastAccessTime.dwLowDateTime=0x156aa930, ftLastAccessTime.dwHighDateTime=0x1d4cab5, ftLastWriteTime.dwLowDateTime=0x156aa930, ftLastWriteTime.dwHighDateTime=0x1d4cab5, nFileSizeHigh=0x0, nFileSizeLow=0x13d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="oTfgRC1I.doc", cAlternateFileName="")) returned 1
	[0084.319] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6956e0, ftCreationTime.dwHighDateTime=0x1d4d04c, ftLastAccessTime.dwLowDateTime=0x4a0ae210, ftLastAccessTime.dwHighDateTime=0x1d4d008, ftLastWriteTime.dwLowDateTime=0x4a0ae210, ftLastWriteTime.dwHighDateTime=0x1d4d008, nFileSizeHigh=0x0, nFileSizeLow=0x15628, dwReserved0=0x0, dwReserved1=0x0, cFileName="pVmi289lW.flv", cAlternateFileName="PVMI28~1.FLV")) returned 1
	[0084.319] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14aba580, ftCreationTime.dwHighDateTime=0x1d4cfc4, ftLastAccessTime.dwLowDateTime=0xee24d3b0, ftLastAccessTime.dwHighDateTime=0x1d4c5f4, ftLastWriteTime.dwLowDateTime=0xee24d3b0, ftLastWriteTime.dwHighDateTime=0x1d4c5f4, nFileSizeHigh=0x0, nFileSizeLow=0x122a, dwReserved0=0x0, dwReserved1=0x0, cFileName="QqG5c6J.gif", cAlternateFileName="")) returned 1
	[0084.320] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b93610, ftCreationTime.dwHighDateTime=0x1d4d06a, ftLastAccessTime.dwLowDateTime=0x3d751240, ftLastAccessTime.dwHighDateTime=0x1d4c956, ftLastWriteTime.dwLowDateTime=0x3d751240, ftLastWriteTime.dwHighDateTime=0x1d4c956, nFileSizeHigh=0x0, nFileSizeLow=0x17cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RfFhNrVlffGKp4Dzg.jpg", cAlternateFileName="RFFHNR~1.JPG")) returned 1
	[0084.320] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf15b7b0, ftCreationTime.dwHighDateTime=0x1d4c6ea, ftLastAccessTime.dwLowDateTime=0xeae09810, ftLastAccessTime.dwHighDateTime=0x1d4d440, ftLastWriteTime.dwLowDateTime=0xeae09810, ftLastWriteTime.dwHighDateTime=0x1d4d440, nFileSizeHigh=0x0, nFileSizeLow=0x11086, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIsYucTC1uGNihRN.jpg", cAlternateFileName="RISYUC~1.JPG")) returned 1
	[0084.320] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbf7fb0, ftCreationTime.dwHighDateTime=0x1d4d441, ftLastAccessTime.dwLowDateTime=0x2edacc20, ftLastAccessTime.dwHighDateTime=0x1d4d509, ftLastWriteTime.dwLowDateTime=0x2edacc20, ftLastWriteTime.dwHighDateTime=0x1d4d509, nFileSizeHigh=0x0, nFileSizeLow=0x74f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="rZ6ASR2d.mp3", cAlternateFileName="")) returned 1
	[0084.320] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2590cc20, ftCreationTime.dwHighDateTime=0x1d4d5cf, ftLastAccessTime.dwLowDateTime=0xe75b480, ftLastAccessTime.dwHighDateTime=0x1d4ca01, ftLastWriteTime.dwLowDateTime=0xe75b480, ftLastWriteTime.dwHighDateTime=0x1d4ca01, nFileSizeHigh=0x0, nFileSizeLow=0x1f15, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHknWzZEDOOsg0m13LU5.pptx", cAlternateFileName="SHKNWZ~1.PPT")) returned 1
	[0084.320] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skype", cAlternateFileName="")) returned 1
	[0084.320] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1
	[0084.320] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa038720, ftCreationTime.dwHighDateTime=0x1d4ce15, ftLastAccessTime.dwLowDateTime=0xc5c93370, ftLastAccessTime.dwHighDateTime=0x1d4c96e, ftLastWriteTime.dwLowDateTime=0xc5c93370, ftLastWriteTime.dwHighDateTime=0x1d4c96e, nFileSizeHigh=0x0, nFileSizeLow=0x910c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRnG3JuEby-3n8lan.png", cAlternateFileName="TRNG3J~1.PNG")) returned 1
	[0084.320] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6746e470, ftCreationTime.dwHighDateTime=0x1d4ce03, ftLastAccessTime.dwLowDateTime=0xffff52a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ca, ftLastWriteTime.dwLowDateTime=0xffff52a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ca, nFileSizeHigh=0x0, nFileSizeLow=0x10081, dwReserved0=0x0, dwReserved1=0x0, cFileName="UBJf8dlFkRJbZF.mkv", cAlternateFileName="UBJF8D~1.MKV")) returned 1
	[0084.321] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cac0700, ftCreationTime.dwHighDateTime=0x1d4ccb8, ftLastAccessTime.dwLowDateTime=0x43c668d0, ftLastAccessTime.dwHighDateTime=0x1d4d0ed, ftLastWriteTime.dwLowDateTime=0x43c668d0, ftLastWriteTime.dwHighDateTime=0x1d4d0ed, nFileSizeHigh=0x0, nFileSizeLow=0x4806, dwReserved0=0x0, dwReserved1=0x0, cFileName="uhqpVKPg.bmp", cAlternateFileName="")) returned 1
	[0084.321] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd10b2e90, ftCreationTime.dwHighDateTime=0x1d4d18a, ftLastAccessTime.dwLowDateTime=0xf0b2ba20, ftLastAccessTime.dwHighDateTime=0x1d4c76b, ftLastWriteTime.dwLowDateTime=0xf0b2ba20, ftLastWriteTime.dwHighDateTime=0x1d4c76b, nFileSizeHigh=0x0, nFileSizeLow=0xda2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="wkgA.m4a", cAlternateFileName="")) returned 1
	[0084.321] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9f4980, ftCreationTime.dwHighDateTime=0x1d4c99a, ftLastAccessTime.dwLowDateTime=0x777d2600, ftLastAccessTime.dwHighDateTime=0x1d4cd82, ftLastWriteTime.dwLowDateTime=0x777d2600, ftLastWriteTime.dwHighDateTime=0x1d4cd82, nFileSizeHigh=0x0, nFileSizeLow=0xaa4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xgn92eAznnLviwxTrZgc.pptx", cAlternateFileName="XGN92E~1.PPT")) returned 1
	[0084.321] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba988c0, ftCreationTime.dwHighDateTime=0x1d4cf91, ftLastAccessTime.dwLowDateTime=0x62b19c10, ftLastAccessTime.dwHighDateTime=0x1d4ce8b, ftLastWriteTime.dwLowDateTime=0x62b19c10, ftLastWriteTime.dwHighDateTime=0x1d4ce8b, nFileSizeHigh=0x0, nFileSizeLow=0x11fd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="XgUwMSDy8CzxLSGkjkhZ.odt", cAlternateFileName="XGUWMS~1.ODT")) returned 1
	[0084.321] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf237b990, ftCreationTime.dwHighDateTime=0x1d4ca36, ftLastAccessTime.dwLowDateTime=0xa907fe90, ftLastAccessTime.dwHighDateTime=0x1d4d343, ftLastWriteTime.dwLowDateTime=0xa907fe90, ftLastWriteTime.dwHighDateTime=0x1d4d343, nFileSizeHigh=0x0, nFileSizeLow=0xfc68, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAR6_GPCI0E.m4a", cAlternateFileName="YAR6_G~1.M4A")) returned 1
	[0084.321] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee92370, ftCreationTime.dwHighDateTime=0x1d4d49a, ftLastAccessTime.dwLowDateTime=0x602bad90, ftLastAccessTime.dwHighDateTime=0x1d4d085, ftLastWriteTime.dwLowDateTime=0x602bad90, ftLastWriteTime.dwHighDateTime=0x1d4d085, nFileSizeHigh=0x0, nFileSizeLow=0x7e32, dwReserved0=0x0, dwReserved1=0x0, cFileName="yjRtm.csv", cAlternateFileName="")) returned 1
	[0084.321] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea439e10, ftCreationTime.dwHighDateTime=0x1d4d27a, ftLastAccessTime.dwLowDateTime=0x381da250, ftLastAccessTime.dwHighDateTime=0x1d4d516, ftLastWriteTime.dwLowDateTime=0x381da250, ftLastWriteTime.dwHighDateTime=0x1d4d516, nFileSizeHigh=0x0, nFileSizeLow=0x17493, dwReserved0=0x0, dwReserved1=0x0, cFileName="ylhdOZEt41.gif", cAlternateFileName="YLHDOZ~1.GIF")) returned 1
	[0084.321] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5ffc10, ftCreationTime.dwHighDateTime=0x1d4c9cb, ftLastAccessTime.dwLowDateTime=0xb75f22b0, ftLastAccessTime.dwHighDateTime=0x1d4d4ed, ftLastWriteTime.dwLowDateTime=0xb75f22b0, ftLastWriteTime.dwHighDateTime=0x1d4d4ed, nFileSizeHigh=0x0, nFileSizeLow=0x186a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZLvldQuI.doc", cAlternateFileName="")) returned 1
	[0084.322] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5ffc10, ftCreationTime.dwHighDateTime=0x1d4c9cb, ftLastAccessTime.dwLowDateTime=0xb75f22b0, ftLastAccessTime.dwHighDateTime=0x1d4d4ed, ftLastWriteTime.dwLowDateTime=0xb75f22b0, ftLastWriteTime.dwHighDateTime=0x1d4d4ed, nFileSizeHigh=0x0, nFileSizeLow=0x186a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZLvldQuI.doc", cAlternateFileName="")) returned 0
	[0084.322] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0084.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.322] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f
	[0084.322] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6aa85cc5, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6aa85cc5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0084.322] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6aa85cc5, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6aa85cc5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.322] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa4f7360, ftCreationTime.dwHighDateTime=0x1d4d22a, ftLastAccessTime.dwLowDateTime=0xd4c36c40, ftLastAccessTime.dwHighDateTime=0x1d4ca92, ftLastWriteTime.dwLowDateTime=0xd4c36c40, ftLastWriteTime.dwHighDateTime=0x1d4ca92, nFileSizeHigh=0x0, nFileSizeLow=0x16e84, dwReserved0=0x0, dwReserved1=0x0, cFileName="2EPHmi6_nPZ8vbbcb DF.mp3", cAlternateFileName="2EPHMI~1.MP3")) returned 1
	[0084.322] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb29b600, ftCreationTime.dwHighDateTime=0x1d4d3a5, ftLastAccessTime.dwLowDateTime=0xcbdd7100, ftLastAccessTime.dwHighDateTime=0x1d4cf44, ftLastWriteTime.dwLowDateTime=0xcbdd7100, ftLastWriteTime.dwHighDateTime=0x1d4cf44, nFileSizeHigh=0x0, nFileSizeLow=0x7c14, dwReserved0=0x0, dwReserved1=0x0, cFileName="2e_muLLvgKK.m4a", cAlternateFileName="2E_MUL~1.M4A")) returned 1
	[0084.322] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9030f030, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0xe4b37d20, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0xe4b37d20, ftLastWriteTime.dwHighDateTime=0x1d4d0a0, nFileSizeHigh=0x0, nFileSizeLow=0xf20d, dwReserved0=0x0, dwReserved1=0x0, cFileName="4ANgj8teVFsAP 6-81.wav", cAlternateFileName="4ANGJ8~1.WAV")) returned 1
	[0084.323] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31283c10, ftCreationTime.dwHighDateTime=0x1d4cc99, ftLastAccessTime.dwLowDateTime=0x1afbbaf0, ftLastAccessTime.dwHighDateTime=0x1d4ce44, ftLastWriteTime.dwLowDateTime=0x1afbbaf0, ftLastWriteTime.dwHighDateTime=0x1d4ce44, nFileSizeHigh=0x0, nFileSizeLow=0x64ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="4AqDBaBsIdRpPojboy.csv", cAlternateFileName="4AQDBA~1.CSV")) returned 1
	[0084.323] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc06baf10, ftCreationTime.dwHighDateTime=0x1d4d1b7, ftLastAccessTime.dwLowDateTime=0x5b0df8d0, ftLastAccessTime.dwHighDateTime=0x1d4cd7f, ftLastWriteTime.dwLowDateTime=0x5b0df8d0, ftLastWriteTime.dwHighDateTime=0x1d4cd7f, nFileSizeHigh=0x0, nFileSizeLow=0x471, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Q6L9ygQV_4yle0.bmp", cAlternateFileName="4Q6L9Y~1.BMP")) returned 1
	[0084.323] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f14e020, ftCreationTime.dwHighDateTime=0x1d4c977, ftLastAccessTime.dwLowDateTime=0x4f4791c0, ftLastAccessTime.dwHighDateTime=0x1d4c62f, ftLastWriteTime.dwLowDateTime=0x4f4791c0, ftLastWriteTime.dwHighDateTime=0x1d4c62f, nFileSizeHigh=0x0, nFileSizeLow=0xdf5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="90eDKidfizwsRlcadt.wav", cAlternateFileName="90EDKI~1.WAV")) returned 1
	[0084.323] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0084.323] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb03c31d0, ftCreationTime.dwHighDateTime=0x1d4d218, ftLastAccessTime.dwLowDateTime=0xd96b5910, ftLastAccessTime.dwHighDateTime=0x1d4cc09, ftLastWriteTime.dwLowDateTime=0xd96b5910, ftLastWriteTime.dwHighDateTime=0x1d4cc09, nFileSizeHigh=0x0, nFileSizeLow=0x7db6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AeQBUMx.m4a", cAlternateFileName="")) returned 1
	[0084.323] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1492c540, ftCreationTime.dwHighDateTime=0x1d4c6cf, ftLastAccessTime.dwLowDateTime=0x41731a00, ftLastAccessTime.dwHighDateTime=0x1d4cf2c, ftLastWriteTime.dwLowDateTime=0x41731a00, ftLastWriteTime.dwHighDateTime=0x1d4cf2c, nFileSizeHigh=0x0, nFileSizeLow=0x1091a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aupAXO5KQBNxYrAoimAs.mkv", cAlternateFileName="AUPAXO~1.MKV")) returned 1
	[0084.323] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530d06f0, ftCreationTime.dwHighDateTime=0x1d4d511, ftLastAccessTime.dwLowDateTime=0x47623750, ftLastAccessTime.dwHighDateTime=0x1d4cc86, ftLastWriteTime.dwLowDateTime=0x47623750, ftLastWriteTime.dwHighDateTime=0x1d4cc86, nFileSizeHigh=0x0, nFileSizeLow=0x154cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bzd10fFq-Jb.flv", cAlternateFileName="BZD10F~1.FLV")) returned 1
	[0084.323] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e847d0, ftCreationTime.dwHighDateTime=0x1d4c872, ftLastAccessTime.dwLowDateTime=0x4f620b80, ftLastAccessTime.dwHighDateTime=0x1d4c888, ftLastWriteTime.dwLowDateTime=0x4f620b80, ftLastWriteTime.dwHighDateTime=0x1d4c888, nFileSizeHigh=0x0, nFileSizeLow=0xa8d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="c2l2sTZr.mp3", cAlternateFileName="")) returned 1
	[0084.324] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9299690, ftCreationTime.dwHighDateTime=0x1d4c961, ftLastAccessTime.dwLowDateTime=0x8275f430, ftLastAccessTime.dwHighDateTime=0x1d4cccc, ftLastWriteTime.dwLowDateTime=0x8275f430, ftLastWriteTime.dwHighDateTime=0x1d4cccc, nFileSizeHigh=0x0, nFileSizeLow=0xa0da, dwReserved0=0x0, dwReserved1=0x0, cFileName="CffnjByNcPJ1.mp4", cAlternateFileName="CFFNJB~1.MP4")) returned 1
	[0084.324] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6aa85cc5, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6aa85cc5, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6aa85cc5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0084.324] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb4b100, ftCreationTime.dwHighDateTime=0x1d4d292, ftLastAccessTime.dwLowDateTime=0x7a573f60, ftLastAccessTime.dwHighDateTime=0x1d4cc82, ftLastWriteTime.dwLowDateTime=0x7a573f60, ftLastWriteTime.dwHighDateTime=0x1d4cc82, nFileSizeHigh=0x0, nFileSizeLow=0x9050, dwReserved0=0x0, dwReserved1=0x0, cFileName="fJptY.png", cAlternateFileName="")) returned 1
	[0084.324] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c94220, ftCreationTime.dwHighDateTime=0x1d4cc98, ftLastAccessTime.dwLowDateTime=0xe9891f60, ftLastAccessTime.dwHighDateTime=0x1d4c800, ftLastWriteTime.dwLowDateTime=0xe9891f60, ftLastWriteTime.dwHighDateTime=0x1d4c800, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="i2-LW4Rn5rNuf5KUj.wav", cAlternateFileName="I2-LW4~1.WAV")) returned 1
	[0084.324] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc62c5e0, ftCreationTime.dwHighDateTime=0x1d4cd01, ftLastAccessTime.dwLowDateTime=0x427c45e0, ftLastAccessTime.dwHighDateTime=0x1d4c9f8, ftLastWriteTime.dwLowDateTime=0x427c45e0, ftLastWriteTime.dwHighDateTime=0x1d4c9f8, nFileSizeHigh=0x0, nFileSizeLow=0x1274a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ihbd_YP-zcVKqRmUr6T.rtf", cAlternateFileName="IHBD_Y~1.RTF")) returned 1
	[0084.324] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3c68650, ftCreationTime.dwHighDateTime=0x1d4c596, ftLastAccessTime.dwLowDateTime=0x28e9e30, ftLastAccessTime.dwHighDateTime=0x1d4d298, ftLastWriteTime.dwLowDateTime=0x28e9e30, ftLastWriteTime.dwHighDateTime=0x1d4d298, nFileSizeHigh=0x0, nFileSizeLow=0x67a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRVAtpRJoe9wy_IH27.png", cAlternateFileName="IRVATP~1.PNG")) returned 1
	[0084.324] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59b3feb0, ftCreationTime.dwHighDateTime=0x1d4d10f, ftLastAccessTime.dwLowDateTime=0xa5b01ec0, ftLastAccessTime.dwHighDateTime=0x1d4d3f8, ftLastWriteTime.dwLowDateTime=0xa5b01ec0, ftLastWriteTime.dwHighDateTime=0x1d4d3f8, nFileSizeHigh=0x0, nFileSizeLow=0x17faf, dwReserved0=0x0, dwReserved1=0x0, cFileName="jAHv99.bmp", cAlternateFileName="")) returned 1
	[0084.324] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1
	[0084.324] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0084.324] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1547d970, ftCreationTime.dwHighDateTime=0x1d4c9b9, ftLastAccessTime.dwLowDateTime=0xccbf0b30, ftLastAccessTime.dwHighDateTime=0x1d4cbd2, ftLastWriteTime.dwLowDateTime=0xccbf0b30, ftLastWriteTime.dwHighDateTime=0x1d4cbd2, nFileSizeHigh=0x0, nFileSizeLow=0x13fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="o5FwHnOMCs-2qhrYzUHO.ots", cAlternateFileName="O5FWHN~1.OTS")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c926190, ftCreationTime.dwHighDateTime=0x1d4d4c8, ftLastAccessTime.dwLowDateTime=0x5b039220, ftLastAccessTime.dwHighDateTime=0x1d4d0ac, ftLastWriteTime.dwLowDateTime=0x5b039220, ftLastWriteTime.dwHighDateTime=0x1d4d0ac, nFileSizeHigh=0x0, nFileSizeLow=0x93e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OgLd.flv", cAlternateFileName="")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67a5d80, ftCreationTime.dwHighDateTime=0x1d4cf1f, ftLastAccessTime.dwLowDateTime=0x156aa930, ftLastAccessTime.dwHighDateTime=0x1d4cab5, ftLastWriteTime.dwLowDateTime=0x156aa930, ftLastWriteTime.dwHighDateTime=0x1d4cab5, nFileSizeHigh=0x0, nFileSizeLow=0x13d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="oTfgRC1I.doc", cAlternateFileName="")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6956e0, ftCreationTime.dwHighDateTime=0x1d4d04c, ftLastAccessTime.dwLowDateTime=0x4a0ae210, ftLastAccessTime.dwHighDateTime=0x1d4d008, ftLastWriteTime.dwLowDateTime=0x4a0ae210, ftLastWriteTime.dwHighDateTime=0x1d4d008, nFileSizeHigh=0x0, nFileSizeLow=0x15628, dwReserved0=0x0, dwReserved1=0x0, cFileName="pVmi289lW.flv", cAlternateFileName="PVMI28~1.FLV")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14aba580, ftCreationTime.dwHighDateTime=0x1d4cfc4, ftLastAccessTime.dwLowDateTime=0xee24d3b0, ftLastAccessTime.dwHighDateTime=0x1d4c5f4, ftLastWriteTime.dwLowDateTime=0xee24d3b0, ftLastWriteTime.dwHighDateTime=0x1d4c5f4, nFileSizeHigh=0x0, nFileSizeLow=0x122a, dwReserved0=0x0, dwReserved1=0x0, cFileName="QqG5c6J.gif", cAlternateFileName="")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b93610, ftCreationTime.dwHighDateTime=0x1d4d06a, ftLastAccessTime.dwLowDateTime=0x3d751240, ftLastAccessTime.dwHighDateTime=0x1d4c956, ftLastWriteTime.dwLowDateTime=0x3d751240, ftLastWriteTime.dwHighDateTime=0x1d4c956, nFileSizeHigh=0x0, nFileSizeLow=0x17cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RfFhNrVlffGKp4Dzg.jpg", cAlternateFileName="RFFHNR~1.JPG")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf15b7b0, ftCreationTime.dwHighDateTime=0x1d4c6ea, ftLastAccessTime.dwLowDateTime=0xeae09810, ftLastAccessTime.dwHighDateTime=0x1d4d440, ftLastWriteTime.dwLowDateTime=0xeae09810, ftLastWriteTime.dwHighDateTime=0x1d4d440, nFileSizeHigh=0x0, nFileSizeLow=0x11086, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIsYucTC1uGNihRN.jpg", cAlternateFileName="RISYUC~1.JPG")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbf7fb0, ftCreationTime.dwHighDateTime=0x1d4d441, ftLastAccessTime.dwLowDateTime=0x2edacc20, ftLastAccessTime.dwHighDateTime=0x1d4d509, ftLastWriteTime.dwLowDateTime=0x2edacc20, ftLastWriteTime.dwHighDateTime=0x1d4d509, nFileSizeHigh=0x0, nFileSizeLow=0x74f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="rZ6ASR2d.mp3", cAlternateFileName="")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2590cc20, ftCreationTime.dwHighDateTime=0x1d4d5cf, ftLastAccessTime.dwLowDateTime=0xe75b480, ftLastAccessTime.dwHighDateTime=0x1d4ca01, ftLastWriteTime.dwLowDateTime=0xe75b480, ftLastWriteTime.dwHighDateTime=0x1d4ca01, nFileSizeHigh=0x0, nFileSizeLow=0x1f15, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHknWzZEDOOsg0m13LU5.pptx", cAlternateFileName="SHKNWZ~1.PPT")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skype", cAlternateFileName="")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa038720, ftCreationTime.dwHighDateTime=0x1d4ce15, ftLastAccessTime.dwLowDateTime=0xc5c93370, ftLastAccessTime.dwHighDateTime=0x1d4c96e, ftLastWriteTime.dwLowDateTime=0xc5c93370, ftLastWriteTime.dwHighDateTime=0x1d4c96e, nFileSizeHigh=0x0, nFileSizeLow=0x910c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRnG3JuEby-3n8lan.png", cAlternateFileName="TRNG3J~1.PNG")) returned 1
	[0084.326] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6746e470, ftCreationTime.dwHighDateTime=0x1d4ce03, ftLastAccessTime.dwLowDateTime=0xffff52a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ca, ftLastWriteTime.dwLowDateTime=0xffff52a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ca, nFileSizeHigh=0x0, nFileSizeLow=0x10081, dwReserved0=0x0, dwReserved1=0x0, cFileName="UBJf8dlFkRJbZF.mkv", cAlternateFileName="UBJF8D~1.MKV")) returned 1
	[0084.326] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cac0700, ftCreationTime.dwHighDateTime=0x1d4ccb8, ftLastAccessTime.dwLowDateTime=0x43c668d0, ftLastAccessTime.dwHighDateTime=0x1d4d0ed, ftLastWriteTime.dwLowDateTime=0x43c668d0, ftLastWriteTime.dwHighDateTime=0x1d4d0ed, nFileSizeHigh=0x0, nFileSizeLow=0x4806, dwReserved0=0x0, dwReserved1=0x0, cFileName="uhqpVKPg.bmp", cAlternateFileName="")) returned 1
	[0084.326] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd10b2e90, ftCreationTime.dwHighDateTime=0x1d4d18a, ftLastAccessTime.dwLowDateTime=0xf0b2ba20, ftLastAccessTime.dwHighDateTime=0x1d4c76b, ftLastWriteTime.dwLowDateTime=0xf0b2ba20, ftLastWriteTime.dwHighDateTime=0x1d4c76b, nFileSizeHigh=0x0, nFileSizeLow=0xda2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="wkgA.m4a", cAlternateFileName="")) returned 1
	[0084.326] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9f4980, ftCreationTime.dwHighDateTime=0x1d4c99a, ftLastAccessTime.dwLowDateTime=0x777d2600, ftLastAccessTime.dwHighDateTime=0x1d4cd82, ftLastWriteTime.dwLowDateTime=0x777d2600, ftLastWriteTime.dwHighDateTime=0x1d4cd82, nFileSizeHigh=0x0, nFileSizeLow=0xaa4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xgn92eAznnLviwxTrZgc.pptx", cAlternateFileName="XGN92E~1.PPT")) returned 1
	[0084.326] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba988c0, ftCreationTime.dwHighDateTime=0x1d4cf91, ftLastAccessTime.dwLowDateTime=0x62b19c10, ftLastAccessTime.dwHighDateTime=0x1d4ce8b, ftLastWriteTime.dwLowDateTime=0x62b19c10, ftLastWriteTime.dwHighDateTime=0x1d4ce8b, nFileSizeHigh=0x0, nFileSizeLow=0x11fd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="XgUwMSDy8CzxLSGkjkhZ.odt", cAlternateFileName="XGUWMS~1.ODT")) returned 1
	[0084.326] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf237b990, ftCreationTime.dwHighDateTime=0x1d4ca36, ftLastAccessTime.dwLowDateTime=0xa907fe90, ftLastAccessTime.dwHighDateTime=0x1d4d343, ftLastWriteTime.dwLowDateTime=0xa907fe90, ftLastWriteTime.dwHighDateTime=0x1d4d343, nFileSizeHigh=0x0, nFileSizeLow=0xfc68, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAR6_GPCI0E.m4a", cAlternateFileName="YAR6_G~1.M4A")) returned 1
	[0084.326] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee92370, ftCreationTime.dwHighDateTime=0x1d4d49a, ftLastAccessTime.dwLowDateTime=0x602bad90, ftLastAccessTime.dwHighDateTime=0x1d4d085, ftLastWriteTime.dwLowDateTime=0x602bad90, ftLastWriteTime.dwHighDateTime=0x1d4d085, nFileSizeHigh=0x0, nFileSizeLow=0x7e32, dwReserved0=0x0, dwReserved1=0x0, cFileName="yjRtm.csv", cAlternateFileName="")) returned 1
	[0084.326] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea439e10, ftCreationTime.dwHighDateTime=0x1d4d27a, ftLastAccessTime.dwLowDateTime=0x381da250, ftLastAccessTime.dwHighDateTime=0x1d4d516, ftLastWriteTime.dwLowDateTime=0x381da250, ftLastWriteTime.dwHighDateTime=0x1d4d516, nFileSizeHigh=0x0, nFileSizeLow=0x17493, dwReserved0=0x0, dwReserved1=0x0, cFileName="ylhdOZEt41.gif", cAlternateFileName="YLHDOZ~1.GIF")) returned 1
	[0084.326] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5ffc10, ftCreationTime.dwHighDateTime=0x1d4c9cb, ftLastAccessTime.dwLowDateTime=0xb75f22b0, ftLastAccessTime.dwHighDateTime=0x1d4d4ed, ftLastWriteTime.dwLowDateTime=0xb75f22b0, ftLastWriteTime.dwHighDateTime=0x1d4d4ed, nFileSizeHigh=0x0, nFileSizeLow=0x186a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZLvldQuI.doc", cAlternateFileName="")) returned 1
	[0084.326] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.326] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0084.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.326] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0084.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.327] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.327] GetFileType (hFile=0x5dc) returned 0x1
	[0084.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.327] GetFileType (hFile=0x5dc) returned 0x1
	[0084.327] WriteFile (in: hFile=0x5dc, lpBuffer=0x2653898*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2653898*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.328] CloseHandle (hObject=0x5dc) returned 1
	[0084.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.328] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ", lpFilePart=0x0) returned 0x22
	[0084.328] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319897c0, ftCreationTime.dwHighDateTime=0x1d4caf1, ftLastAccessTime.dwLowDateTime=0x69694d70, ftLastAccessTime.dwHighDateTime=0x1d4ce3e, ftLastWriteTime.dwLowDateTime=0x69694d70, ftLastWriteTime.dwHighDateTime=0x1d4ce3e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0084.328] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319897c0, ftCreationTime.dwHighDateTime=0x1d4caf1, ftLastAccessTime.dwLowDateTime=0x69694d70, ftLastAccessTime.dwHighDateTime=0x1d4ce3e, ftLastWriteTime.dwLowDateTime=0x69694d70, ftLastWriteTime.dwHighDateTime=0x1d4ce3e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.329] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920d6860, ftCreationTime.dwHighDateTime=0x1d4cfa6, ftLastAccessTime.dwLowDateTime=0xae782b10, ftLastAccessTime.dwHighDateTime=0x1d4d312, ftLastWriteTime.dwLowDateTime=0xae782b10, ftLastWriteTime.dwHighDateTime=0x1d4d312, nFileSizeHigh=0x0, nFileSizeLow=0x391d, dwReserved0=0x0, dwReserved1=0x0, cFileName="-bz-pPO9k6vNaqNUo_.png", cAlternateFileName="-BZ-PP~1.PNG")) returned 1
	[0084.329] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd08c4cd0, ftCreationTime.dwHighDateTime=0x1d4c661, ftLastAccessTime.dwLowDateTime=0xc5695f50, ftLastAccessTime.dwHighDateTime=0x1d4cf44, ftLastWriteTime.dwLowDateTime=0xc5695f50, ftLastWriteTime.dwHighDateTime=0x1d4cf44, nFileSizeHigh=0x0, nFileSizeLow=0x69fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="7 PNOE67vbgbcCxlEgc.doc", cAlternateFileName="7PNOE6~1.DOC")) returned 1
	[0084.329] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4174e780, ftCreationTime.dwHighDateTime=0x1d4c654, ftLastAccessTime.dwLowDateTime=0x86e0fb20, ftLastAccessTime.dwHighDateTime=0x1d4cdab, ftLastWriteTime.dwLowDateTime=0x86e0fb20, ftLastWriteTime.dwHighDateTime=0x1d4cdab, nFileSizeHigh=0x0, nFileSizeLow=0x157bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bK_cgmqE.swf", cAlternateFileName="")) returned 1
	[0084.329] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f4503b0, ftCreationTime.dwHighDateTime=0x1d4cf5e, ftLastAccessTime.dwLowDateTime=0x20da30c0, ftLastAccessTime.dwHighDateTime=0x1d4c59b, ftLastWriteTime.dwLowDateTime=0x20da30c0, ftLastWriteTime.dwHighDateTime=0x1d4c59b, nFileSizeHigh=0x0, nFileSizeLow=0x1268d, dwReserved0=0x0, dwReserved1=0x0, cFileName="db6rvdyhdTxtD-YS.jpg", cAlternateFileName="DB6RVD~1.JPG")) returned 1
	[0084.329] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc5ee510, ftCreationTime.dwHighDateTime=0x1d4d073, ftLastAccessTime.dwLowDateTime=0xcadf4130, ftLastAccessTime.dwHighDateTime=0x1d4d010, ftLastWriteTime.dwLowDateTime=0xcadf4130, ftLastWriteTime.dwHighDateTime=0x1d4d010, nFileSizeHigh=0x0, nFileSizeLow=0x1495e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eyw6oOw_Vr-rFY.mkv", cAlternateFileName="EYW6OO~1.MKV")) returned 1
	[0084.329] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afa3b0, ftCreationTime.dwHighDateTime=0x1d4d05c, ftLastAccessTime.dwLowDateTime=0xdf79c9a0, ftLastAccessTime.dwHighDateTime=0x1d4c5ff, ftLastWriteTime.dwLowDateTime=0xdf79c9a0, ftLastWriteTime.dwHighDateTime=0x1d4c5ff, nFileSizeHigh=0x0, nFileSizeLow=0xc483, dwReserved0=0x0, dwReserved1=0x0, cFileName="HIE 4mLx pz.jpg", cAlternateFileName="HIE4ML~1.JPG")) returned 1
	[0084.329] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8612ba0, ftCreationTime.dwHighDateTime=0x1d4cac2, ftLastAccessTime.dwLowDateTime=0xe7c19b60, ftLastAccessTime.dwHighDateTime=0x1d4d03b, ftLastWriteTime.dwLowDateTime=0xe7c19b60, ftLastWriteTime.dwHighDateTime=0x1d4d03b, nFileSizeHigh=0x0, nFileSizeLow=0x9c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="JCjBeMKKmJ1vQ.wav", cAlternateFileName="JCJBEM~1.WAV")) returned 1
	[0084.329] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed7eb60, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0x453336b0, ftLastAccessTime.dwHighDateTime=0x1d4cbf4, ftLastWriteTime.dwLowDateTime=0x453336b0, ftLastWriteTime.dwHighDateTime=0x1d4cbf4, nFileSizeHigh=0x0, nFileSizeLow=0x1e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="KUNLL-O.flv", cAlternateFileName="")) returned 1
	[0084.329] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aae9700, ftCreationTime.dwHighDateTime=0x1d4cf08, ftLastAccessTime.dwLowDateTime=0x209ac50, ftLastAccessTime.dwHighDateTime=0x1d4d5f1, ftLastWriteTime.dwLowDateTime=0x209ac50, ftLastWriteTime.dwHighDateTime=0x1d4d5f1, nFileSizeHigh=0x0, nFileSizeLow=0x113a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="uWqtBWdq9DI0XNRX3G.odp", cAlternateFileName="UWQTBW~1.ODP")) returned 1
	[0084.330] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x232102b0, ftCreationTime.dwHighDateTime=0x1d4cb5d, ftLastAccessTime.dwLowDateTime=0x105a25f0, ftLastAccessTime.dwHighDateTime=0x1d4ca43, ftLastWriteTime.dwLowDateTime=0x105a25f0, ftLastWriteTime.dwHighDateTime=0x1d4ca43, nFileSizeHigh=0x0, nFileSizeLow=0x8ff7, dwReserved0=0x0, dwReserved1=0x0, cFileName="vqXdae1ehmGjzYo.m4a", cAlternateFileName="VQXDAE~1.M4A")) returned 1
	[0084.330] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x232102b0, ftCreationTime.dwHighDateTime=0x1d4cb5d, ftLastAccessTime.dwLowDateTime=0x105a25f0, ftLastAccessTime.dwHighDateTime=0x1d4ca43, ftLastWriteTime.dwLowDateTime=0x105a25f0, ftLastWriteTime.dwHighDateTime=0x1d4ca43, nFileSizeHigh=0x0, nFileSizeLow=0x8ff7, dwReserved0=0x0, dwReserved1=0x0, cFileName="vqXdae1ehmGjzYo.m4a", cAlternateFileName="VQXDAE~1.M4A")) returned 0
	[0084.330] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0084.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.330] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ", lpFilePart=0x0) returned 0x22
	[0084.330] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319897c0, ftCreationTime.dwHighDateTime=0x1d4caf1, ftLastAccessTime.dwLowDateTime=0x69694d70, ftLastAccessTime.dwHighDateTime=0x1d4ce3e, ftLastWriteTime.dwLowDateTime=0x69694d70, ftLastWriteTime.dwHighDateTime=0x1d4ce3e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0084.330] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319897c0, ftCreationTime.dwHighDateTime=0x1d4caf1, ftLastAccessTime.dwLowDateTime=0x69694d70, ftLastAccessTime.dwHighDateTime=0x1d4ce3e, ftLastWriteTime.dwLowDateTime=0x69694d70, ftLastWriteTime.dwHighDateTime=0x1d4ce3e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.330] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920d6860, ftCreationTime.dwHighDateTime=0x1d4cfa6, ftLastAccessTime.dwLowDateTime=0xae782b10, ftLastAccessTime.dwHighDateTime=0x1d4d312, ftLastWriteTime.dwLowDateTime=0xae782b10, ftLastWriteTime.dwHighDateTime=0x1d4d312, nFileSizeHigh=0x0, nFileSizeLow=0x391d, dwReserved0=0x0, dwReserved1=0x0, cFileName="-bz-pPO9k6vNaqNUo_.png", cAlternateFileName="-BZ-PP~1.PNG")) returned 1
	[0084.331] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd08c4cd0, ftCreationTime.dwHighDateTime=0x1d4c661, ftLastAccessTime.dwLowDateTime=0xc5695f50, ftLastAccessTime.dwHighDateTime=0x1d4cf44, ftLastWriteTime.dwLowDateTime=0xc5695f50, ftLastWriteTime.dwHighDateTime=0x1d4cf44, nFileSizeHigh=0x0, nFileSizeLow=0x69fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="7 PNOE67vbgbcCxlEgc.doc", cAlternateFileName="7PNOE6~1.DOC")) returned 1
	[0084.331] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4174e780, ftCreationTime.dwHighDateTime=0x1d4c654, ftLastAccessTime.dwLowDateTime=0x86e0fb20, ftLastAccessTime.dwHighDateTime=0x1d4cdab, ftLastWriteTime.dwLowDateTime=0x86e0fb20, ftLastWriteTime.dwHighDateTime=0x1d4cdab, nFileSizeHigh=0x0, nFileSizeLow=0x157bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bK_cgmqE.swf", cAlternateFileName="")) returned 1
	[0084.331] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f4503b0, ftCreationTime.dwHighDateTime=0x1d4cf5e, ftLastAccessTime.dwLowDateTime=0x20da30c0, ftLastAccessTime.dwHighDateTime=0x1d4c59b, ftLastWriteTime.dwLowDateTime=0x20da30c0, ftLastWriteTime.dwHighDateTime=0x1d4c59b, nFileSizeHigh=0x0, nFileSizeLow=0x1268d, dwReserved0=0x0, dwReserved1=0x0, cFileName="db6rvdyhdTxtD-YS.jpg", cAlternateFileName="DB6RVD~1.JPG")) returned 1
	[0084.331] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc5ee510, ftCreationTime.dwHighDateTime=0x1d4d073, ftLastAccessTime.dwLowDateTime=0xcadf4130, ftLastAccessTime.dwHighDateTime=0x1d4d010, ftLastWriteTime.dwLowDateTime=0xcadf4130, ftLastWriteTime.dwHighDateTime=0x1d4d010, nFileSizeHigh=0x0, nFileSizeLow=0x1495e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eyw6oOw_Vr-rFY.mkv", cAlternateFileName="EYW6OO~1.MKV")) returned 1
	[0084.331] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afa3b0, ftCreationTime.dwHighDateTime=0x1d4d05c, ftLastAccessTime.dwLowDateTime=0xdf79c9a0, ftLastAccessTime.dwHighDateTime=0x1d4c5ff, ftLastWriteTime.dwLowDateTime=0xdf79c9a0, ftLastWriteTime.dwHighDateTime=0x1d4c5ff, nFileSizeHigh=0x0, nFileSizeLow=0xc483, dwReserved0=0x0, dwReserved1=0x0, cFileName="HIE 4mLx pz.jpg", cAlternateFileName="HIE4ML~1.JPG")) returned 1
	[0084.331] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8612ba0, ftCreationTime.dwHighDateTime=0x1d4cac2, ftLastAccessTime.dwLowDateTime=0xe7c19b60, ftLastAccessTime.dwHighDateTime=0x1d4d03b, ftLastWriteTime.dwLowDateTime=0xe7c19b60, ftLastWriteTime.dwHighDateTime=0x1d4d03b, nFileSizeHigh=0x0, nFileSizeLow=0x9c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="JCjBeMKKmJ1vQ.wav", cAlternateFileName="JCJBEM~1.WAV")) returned 1
	[0084.331] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed7eb60, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0x453336b0, ftLastAccessTime.dwHighDateTime=0x1d4cbf4, ftLastWriteTime.dwLowDateTime=0x453336b0, ftLastWriteTime.dwHighDateTime=0x1d4cbf4, nFileSizeHigh=0x0, nFileSizeLow=0x1e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="KUNLL-O.flv", cAlternateFileName="")) returned 1
	[0084.331] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aae9700, ftCreationTime.dwHighDateTime=0x1d4cf08, ftLastAccessTime.dwLowDateTime=0x209ac50, ftLastAccessTime.dwHighDateTime=0x1d4d5f1, ftLastWriteTime.dwLowDateTime=0x209ac50, ftLastWriteTime.dwHighDateTime=0x1d4d5f1, nFileSizeHigh=0x0, nFileSizeLow=0x113a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="uWqtBWdq9DI0XNRX3G.odp", cAlternateFileName="UWQTBW~1.ODP")) returned 1
	[0084.331] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x232102b0, ftCreationTime.dwHighDateTime=0x1d4cb5d, ftLastAccessTime.dwLowDateTime=0x105a25f0, ftLastAccessTime.dwHighDateTime=0x1d4ca43, ftLastWriteTime.dwLowDateTime=0x105a25f0, ftLastWriteTime.dwHighDateTime=0x1d4ca43, nFileSizeHigh=0x0, nFileSizeLow=0x8ff7, dwReserved0=0x0, dwReserved1=0x0, cFileName="vqXdae1ehmGjzYo.m4a", cAlternateFileName="VQXDAE~1.M4A")) returned 1
	[0084.331] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.331] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0084.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.331] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0084.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.331] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.332] GetFileType (hFile=0x5dc) returned 0x1
	[0084.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.332] GetFileType (hFile=0x5dc) returned 0x1
	[0084.332] WriteFile (in: hFile=0x5dc, lpBuffer=0x26587ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26587ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.332] CloseHandle (hObject=0x5dc) returned 1
	[0084.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.333] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Music", lpFilePart=0x0) returned 0x22
	[0084.333] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Music", lpFilePart=0x0) returned 0x22
	[0084.334] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.335] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Music\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0084.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.335] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\documents\\my music\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.336] GetFileType (hFile=0x5dc) returned 0x1
	[0084.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.336] GetFileType (hFile=0x5dc) returned 0x1
	[0084.336] WriteFile (in: hFile=0x5dc, lpBuffer=0x265b8c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265b8c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.337] CloseHandle (hObject=0x5dc) returned 1
	[0084.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.337] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25
	[0084.337] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25
	[0084.338] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0084.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.339] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\documents\\my pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.340] GetFileType (hFile=0x5dc) returned 0x1
	[0084.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.340] GetFileType (hFile=0x5dc) returned 0x1
	[0084.340] WriteFile (in: hFile=0x5dc, lpBuffer=0x265ea2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265ea2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.341] CloseHandle (hObject=0x5dc) returned 1
	[0084.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23
	[0084.341] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0084.424] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.424] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0084.424] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1
	[0084.424] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1
	[0084.424] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.425] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0084.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.425] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23
	[0084.425] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0084.425] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.425] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0084.425] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1
	[0084.425] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1
	[0084.426] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0
	[0084.426] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0084.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.426] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0084.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.426] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.427] GetFileType (hFile=0x5dc) returned 0x1
	[0084.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.427] GetFileType (hFile=0x5dc) returned 0x1
	[0084.427] WriteFile (in: hFile=0x5dc, lpBuffer=0x2662398*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2662398*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.427] CloseHandle (hObject=0x5dc) returned 1
	[0084.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Videos", lpFilePart=0x0) returned 0x23
	[0084.428] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.429] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Videos", lpFilePart=0x0) returned 0x23
	[0084.429] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.430] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Videos\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0084.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.430] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\documents\\my videos\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.431] GetFileType (hFile=0x5dc) returned 0x1
	[0084.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.431] GetFileType (hFile=0x5dc) returned 0x1
	[0084.431] WriteFile (in: hFile=0x5dc, lpBuffer=0x26654b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26654b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.432] CloseHandle (hObject=0x5dc) returned 1
	[0084.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.432] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27
	[0084.432] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0084.433] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.433] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1
	[0084.433] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0
	[0084.433] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0084.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27
	[0084.433] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0084.433] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.434] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1
	[0084.434] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.434] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0084.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.434] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0084.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.434] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.434] GetFileType (hFile=0x5dc) returned 0x1
	[0084.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.434] GetFileType (hFile=0x5dc) returned 0x1
	[0084.434] WriteFile (in: hFile=0x5dc, lpBuffer=0x26689cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26689cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.435] CloseHandle (hObject=0x5dc) returned 1
	[0084.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.435] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r", lpFilePart=0x0) returned 0x21
	[0084.436] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb7d6fc0, ftCreationTime.dwHighDateTime=0x1d4ca60, ftLastAccessTime.dwLowDateTime=0x4de81550, ftLastAccessTime.dwHighDateTime=0x1d4c83e, ftLastWriteTime.dwLowDateTime=0x4de81550, ftLastWriteTime.dwHighDateTime=0x1d4c83e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0084.436] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb7d6fc0, ftCreationTime.dwHighDateTime=0x1d4ca60, ftLastAccessTime.dwLowDateTime=0x4de81550, ftLastAccessTime.dwHighDateTime=0x1d4c83e, ftLastWriteTime.dwLowDateTime=0x4de81550, ftLastWriteTime.dwHighDateTime=0x1d4c83e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.436] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59dcb080, ftCreationTime.dwHighDateTime=0x1d4c8b8, ftLastAccessTime.dwLowDateTime=0x544a6f10, ftLastAccessTime.dwHighDateTime=0x1d4c983, ftLastWriteTime.dwLowDateTime=0x544a6f10, ftLastWriteTime.dwHighDateTime=0x1d4c983, nFileSizeHigh=0x0, nFileSizeLow=0x97b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="HDpu5plBjwWMidt_.pptx", cAlternateFileName="HDPU5P~1.PPT")) returned 1
	[0084.436] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fa37ea0, ftCreationTime.dwHighDateTime=0x1d4cbb3, ftLastAccessTime.dwLowDateTime=0x23daccd0, ftLastAccessTime.dwHighDateTime=0x1d4cc0d, ftLastWriteTime.dwLowDateTime=0x23daccd0, ftLastWriteTime.dwHighDateTime=0x1d4cc0d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktreASm", cAlternateFileName="")) returned 1
	[0084.436] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d920e60, ftCreationTime.dwHighDateTime=0x1d4c8cd, ftLastAccessTime.dwLowDateTime=0x35f75dd0, ftLastAccessTime.dwHighDateTime=0x1d4c85b, ftLastWriteTime.dwLowDateTime=0x35f75dd0, ftLastWriteTime.dwHighDateTime=0x1d4c85b, nFileSizeHigh=0x0, nFileSizeLow=0x12882, dwReserved0=0x0, dwReserved1=0x0, cFileName="miTtzGYiNAehuqfzZt9h.odp", cAlternateFileName="MITTZG~1.ODP")) returned 1
	[0084.436] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd620ca50, ftCreationTime.dwHighDateTime=0x1d4d34e, ftLastAccessTime.dwLowDateTime=0xa8506eb0, ftLastAccessTime.dwHighDateTime=0x1d4c81c, ftLastWriteTime.dwLowDateTime=0xa8506eb0, ftLastWriteTime.dwHighDateTime=0x1d4c81c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oUItnP BO4BQH", cAlternateFileName="OUITNP~1")) returned 1
	[0084.436] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x441c51f0, ftCreationTime.dwHighDateTime=0x1d4c7e2, ftLastAccessTime.dwLowDateTime=0x6378c800, ftLastAccessTime.dwHighDateTime=0x1d4ce5c, ftLastWriteTime.dwLowDateTime=0x6378c800, ftLastWriteTime.dwHighDateTime=0x1d4ce5c, nFileSizeHigh=0x0, nFileSizeLow=0x12996, dwReserved0=0x0, dwReserved1=0x0, cFileName="sUhFFQihHPl4O.xlsx", cAlternateFileName="SUHFFQ~1.XLS")) returned 1
	[0084.437] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21310e0, ftCreationTime.dwHighDateTime=0x1d4d4da, ftLastAccessTime.dwLowDateTime=0xf93222c0, ftLastAccessTime.dwHighDateTime=0x1d4c5d7, ftLastWriteTime.dwLowDateTime=0xf93222c0, ftLastWriteTime.dwHighDateTime=0x1d4c5d7, nFileSizeHigh=0x0, nFileSizeLow=0x16245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tdh5Gw.odp", cAlternateFileName="")) returned 1
	[0084.437] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1495410, ftCreationTime.dwHighDateTime=0x1d4c662, ftLastAccessTime.dwLowDateTime=0x4c984670, ftLastAccessTime.dwHighDateTime=0x1d4d2f7, ftLastWriteTime.dwLowDateTime=0x4c984670, ftLastWriteTime.dwHighDateTime=0x1d4d2f7, nFileSizeHigh=0x0, nFileSizeLow=0x1493a, dwReserved0=0x0, dwReserved1=0x0, cFileName="vUVPg _uEcXm.pps", cAlternateFileName="VUVPG_~1.PPS")) returned 1
	[0084.437] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ad83d0, ftCreationTime.dwHighDateTime=0x1d4c688, ftLastAccessTime.dwLowDateTime=0xd01e2090, ftLastAccessTime.dwHighDateTime=0x1d4d1b8, ftLastWriteTime.dwLowDateTime=0xd01e2090, ftLastWriteTime.dwHighDateTime=0x1d4d1b8, nFileSizeHigh=0x0, nFileSizeLow=0xad20, dwReserved0=0x0, dwReserved1=0x0, cFileName="W22XRON4TBCDy.odp", cAlternateFileName="W22XRO~1.ODP")) returned 1
	[0084.437] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ad83d0, ftCreationTime.dwHighDateTime=0x1d4c688, ftLastAccessTime.dwLowDateTime=0xd01e2090, ftLastAccessTime.dwHighDateTime=0x1d4d1b8, ftLastWriteTime.dwLowDateTime=0xd01e2090, ftLastWriteTime.dwHighDateTime=0x1d4d1b8, nFileSizeHigh=0x0, nFileSizeLow=0xad20, dwReserved0=0x0, dwReserved1=0x0, cFileName="W22XRON4TBCDy.odp", cAlternateFileName="W22XRO~1.ODP")) returned 0
	[0084.437] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0084.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.437] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r", lpFilePart=0x0) returned 0x21
	[0084.437] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb7d6fc0, ftCreationTime.dwHighDateTime=0x1d4ca60, ftLastAccessTime.dwLowDateTime=0x4de81550, ftLastAccessTime.dwHighDateTime=0x1d4c83e, ftLastWriteTime.dwLowDateTime=0x4de81550, ftLastWriteTime.dwHighDateTime=0x1d4c83e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0084.437] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb7d6fc0, ftCreationTime.dwHighDateTime=0x1d4ca60, ftLastAccessTime.dwLowDateTime=0x4de81550, ftLastAccessTime.dwHighDateTime=0x1d4c83e, ftLastWriteTime.dwLowDateTime=0x4de81550, ftLastWriteTime.dwHighDateTime=0x1d4c83e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.438] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59dcb080, ftCreationTime.dwHighDateTime=0x1d4c8b8, ftLastAccessTime.dwLowDateTime=0x544a6f10, ftLastAccessTime.dwHighDateTime=0x1d4c983, ftLastWriteTime.dwLowDateTime=0x544a6f10, ftLastWriteTime.dwHighDateTime=0x1d4c983, nFileSizeHigh=0x0, nFileSizeLow=0x97b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="HDpu5plBjwWMidt_.pptx", cAlternateFileName="HDPU5P~1.PPT")) returned 1
	[0084.438] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fa37ea0, ftCreationTime.dwHighDateTime=0x1d4cbb3, ftLastAccessTime.dwLowDateTime=0x23daccd0, ftLastAccessTime.dwHighDateTime=0x1d4cc0d, ftLastWriteTime.dwLowDateTime=0x23daccd0, ftLastWriteTime.dwHighDateTime=0x1d4cc0d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktreASm", cAlternateFileName="")) returned 1
	[0084.438] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d920e60, ftCreationTime.dwHighDateTime=0x1d4c8cd, ftLastAccessTime.dwLowDateTime=0x35f75dd0, ftLastAccessTime.dwHighDateTime=0x1d4c85b, ftLastWriteTime.dwLowDateTime=0x35f75dd0, ftLastWriteTime.dwHighDateTime=0x1d4c85b, nFileSizeHigh=0x0, nFileSizeLow=0x12882, dwReserved0=0x0, dwReserved1=0x0, cFileName="miTtzGYiNAehuqfzZt9h.odp", cAlternateFileName="MITTZG~1.ODP")) returned 1
	[0084.438] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd620ca50, ftCreationTime.dwHighDateTime=0x1d4d34e, ftLastAccessTime.dwLowDateTime=0xa8506eb0, ftLastAccessTime.dwHighDateTime=0x1d4c81c, ftLastWriteTime.dwLowDateTime=0xa8506eb0, ftLastWriteTime.dwHighDateTime=0x1d4c81c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oUItnP BO4BQH", cAlternateFileName="OUITNP~1")) returned 1
	[0084.438] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x441c51f0, ftCreationTime.dwHighDateTime=0x1d4c7e2, ftLastAccessTime.dwLowDateTime=0x6378c800, ftLastAccessTime.dwHighDateTime=0x1d4ce5c, ftLastWriteTime.dwLowDateTime=0x6378c800, ftLastWriteTime.dwHighDateTime=0x1d4ce5c, nFileSizeHigh=0x0, nFileSizeLow=0x12996, dwReserved0=0x0, dwReserved1=0x0, cFileName="sUhFFQihHPl4O.xlsx", cAlternateFileName="SUHFFQ~1.XLS")) returned 1
	[0084.438] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21310e0, ftCreationTime.dwHighDateTime=0x1d4d4da, ftLastAccessTime.dwLowDateTime=0xf93222c0, ftLastAccessTime.dwHighDateTime=0x1d4c5d7, ftLastWriteTime.dwLowDateTime=0xf93222c0, ftLastWriteTime.dwHighDateTime=0x1d4c5d7, nFileSizeHigh=0x0, nFileSizeLow=0x16245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tdh5Gw.odp", cAlternateFileName="")) returned 1
	[0084.438] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1495410, ftCreationTime.dwHighDateTime=0x1d4c662, ftLastAccessTime.dwLowDateTime=0x4c984670, ftLastAccessTime.dwHighDateTime=0x1d4d2f7, ftLastWriteTime.dwLowDateTime=0x4c984670, ftLastWriteTime.dwHighDateTime=0x1d4d2f7, nFileSizeHigh=0x0, nFileSizeLow=0x1493a, dwReserved0=0x0, dwReserved1=0x0, cFileName="vUVPg _uEcXm.pps", cAlternateFileName="VUVPG_~1.PPS")) returned 1
	[0084.438] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ad83d0, ftCreationTime.dwHighDateTime=0x1d4c688, ftLastAccessTime.dwLowDateTime=0xd01e2090, ftLastAccessTime.dwHighDateTime=0x1d4d1b8, ftLastWriteTime.dwLowDateTime=0xd01e2090, ftLastWriteTime.dwHighDateTime=0x1d4d1b8, nFileSizeHigh=0x0, nFileSizeLow=0xad20, dwReserved0=0x0, dwReserved1=0x0, cFileName="W22XRON4TBCDy.odp", cAlternateFileName="W22XRO~1.ODP")) returned 1
	[0084.438] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.439] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0084.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.439] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0084.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.439] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.439] GetFileType (hFile=0x5dc) returned 0x1
	[0084.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.439] GetFileType (hFile=0x5dc) returned 0x1
	[0084.439] WriteFile (in: hFile=0x5dc, lpBuffer=0x266d13c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266d13c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.440] CloseHandle (hObject=0x5dc) returned 1
	[0084.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.440] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f
	[0084.440] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0084.441] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.441] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0084.441] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0084.441] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0084.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f
	[0084.441] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0084.441] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.441] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0084.442] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.442] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0084.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.442] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0084.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.442] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.442] GetFileType (hFile=0x5dc) returned 0x1
	[0084.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.442] GetFileType (hFile=0x5dc) returned 0x1
	[0084.442] WriteFile (in: hFile=0x5dc, lpBuffer=0x26703c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26703c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.443] CloseHandle (hObject=0x5dc) returned 1
	[0084.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.443] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L", lpFilePart=0x0) returned 0x27
	[0084.443] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x344455d0, ftCreationTime.dwHighDateTime=0x1d4cd6d, ftLastAccessTime.dwLowDateTime=0xd1719b0, ftLastAccessTime.dwHighDateTime=0x1d4c963, ftLastWriteTime.dwLowDateTime=0xd1719b0, ftLastWriteTime.dwHighDateTime=0x1d4c963, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0084.443] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x344455d0, ftCreationTime.dwHighDateTime=0x1d4cd6d, ftLastAccessTime.dwLowDateTime=0xd1719b0, ftLastAccessTime.dwHighDateTime=0x1d4c963, ftLastWriteTime.dwLowDateTime=0xd1719b0, ftLastWriteTime.dwHighDateTime=0x1d4c963, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.444] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323a6500, ftCreationTime.dwHighDateTime=0x1d4ccbd, ftLastAccessTime.dwLowDateTime=0x57897d50, ftLastAccessTime.dwHighDateTime=0x1d4cf3d, ftLastWriteTime.dwLowDateTime=0x57897d50, ftLastWriteTime.dwHighDateTime=0x1d4cf3d, nFileSizeHigh=0x0, nFileSizeLow=0x935, dwReserved0=0x0, dwReserved1=0x0, cFileName="5E6eznUlgQvyhz.mp3", cAlternateFileName="5E6EZN~1.MP3")) returned 1
	[0084.444] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1292f0, ftCreationTime.dwHighDateTime=0x1d4ca2a, ftLastAccessTime.dwLowDateTime=0x4ffe1570, ftLastAccessTime.dwHighDateTime=0x1d4d080, ftLastWriteTime.dwLowDateTime=0x4ffe1570, ftLastWriteTime.dwHighDateTime=0x1d4d080, nFileSizeHigh=0x0, nFileSizeLow=0xe123, dwReserved0=0x0, dwReserved1=0x0, cFileName="ku1ia7l1SnB.wav", cAlternateFileName="KU1IA7~1.WAV")) returned 1
	[0084.444] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751173a0, ftCreationTime.dwHighDateTime=0x1d4d4c9, ftLastAccessTime.dwLowDateTime=0xe4063990, ftLastAccessTime.dwHighDateTime=0x1d4c591, ftLastWriteTime.dwLowDateTime=0xe4063990, ftLastWriteTime.dwHighDateTime=0x1d4c591, nFileSizeHigh=0x0, nFileSizeLow=0x16d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wwEaoYlkV.mp3", cAlternateFileName="WWEAOY~1.MP3")) returned 1
	[0084.444] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751173a0, ftCreationTime.dwHighDateTime=0x1d4d4c9, ftLastAccessTime.dwLowDateTime=0xe4063990, ftLastAccessTime.dwHighDateTime=0x1d4c591, ftLastWriteTime.dwLowDateTime=0xe4063990, ftLastWriteTime.dwHighDateTime=0x1d4c591, nFileSizeHigh=0x0, nFileSizeLow=0x16d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wwEaoYlkV.mp3", cAlternateFileName="WWEAOY~1.MP3")) returned 0
	[0084.444] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0084.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.444] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L", lpFilePart=0x0) returned 0x27
	[0084.444] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x344455d0, ftCreationTime.dwHighDateTime=0x1d4cd6d, ftLastAccessTime.dwLowDateTime=0xd1719b0, ftLastAccessTime.dwHighDateTime=0x1d4c963, ftLastWriteTime.dwLowDateTime=0xd1719b0, ftLastWriteTime.dwHighDateTime=0x1d4c963, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0084.445] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x344455d0, ftCreationTime.dwHighDateTime=0x1d4cd6d, ftLastAccessTime.dwLowDateTime=0xd1719b0, ftLastAccessTime.dwHighDateTime=0x1d4c963, ftLastWriteTime.dwLowDateTime=0xd1719b0, ftLastWriteTime.dwHighDateTime=0x1d4c963, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.445] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323a6500, ftCreationTime.dwHighDateTime=0x1d4ccbd, ftLastAccessTime.dwLowDateTime=0x57897d50, ftLastAccessTime.dwHighDateTime=0x1d4cf3d, ftLastWriteTime.dwLowDateTime=0x57897d50, ftLastWriteTime.dwHighDateTime=0x1d4cf3d, nFileSizeHigh=0x0, nFileSizeLow=0x935, dwReserved0=0x0, dwReserved1=0x0, cFileName="5E6eznUlgQvyhz.mp3", cAlternateFileName="5E6EZN~1.MP3")) returned 1
	[0084.445] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1292f0, ftCreationTime.dwHighDateTime=0x1d4ca2a, ftLastAccessTime.dwLowDateTime=0x4ffe1570, ftLastAccessTime.dwHighDateTime=0x1d4d080, ftLastWriteTime.dwLowDateTime=0x4ffe1570, ftLastWriteTime.dwHighDateTime=0x1d4d080, nFileSizeHigh=0x0, nFileSizeLow=0xe123, dwReserved0=0x0, dwReserved1=0x0, cFileName="ku1ia7l1SnB.wav", cAlternateFileName="KU1IA7~1.WAV")) returned 1
	[0084.445] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751173a0, ftCreationTime.dwHighDateTime=0x1d4d4c9, ftLastAccessTime.dwLowDateTime=0xe4063990, ftLastAccessTime.dwHighDateTime=0x1d4c591, ftLastWriteTime.dwLowDateTime=0xe4063990, ftLastWriteTime.dwHighDateTime=0x1d4c591, nFileSizeHigh=0x0, nFileSizeLow=0x16d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wwEaoYlkV.mp3", cAlternateFileName="WWEAOY~1.MP3")) returned 1
	[0084.445] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.445] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0084.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.445] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0084.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.446] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.446] GetFileType (hFile=0x5dc) returned 0x1
	[0084.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.446] GetFileType (hFile=0x5dc) returned 0x1
	[0084.447] WriteFile (in: hFile=0x5dc, lpBuffer=0x2673ed8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2673ed8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.447] CloseHandle (hObject=0x5dc) returned 1
	[0084.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.448] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID", lpFilePart=0x0) returned 0x1f
	[0084.448] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d28f520, ftCreationTime.dwHighDateTime=0x1d4c908, ftLastAccessTime.dwLowDateTime=0x6f3dfb80, ftLastAccessTime.dwHighDateTime=0x1d4d157, ftLastWriteTime.dwLowDateTime=0x6f3dfb80, ftLastWriteTime.dwHighDateTime=0x1d4d157, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0084.448] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d28f520, ftCreationTime.dwHighDateTime=0x1d4c908, ftLastAccessTime.dwLowDateTime=0x6f3dfb80, ftLastAccessTime.dwHighDateTime=0x1d4d157, ftLastWriteTime.dwLowDateTime=0x6f3dfb80, ftLastWriteTime.dwHighDateTime=0x1d4d157, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.448] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3440c090, ftCreationTime.dwHighDateTime=0x1d4d5b6, ftLastAccessTime.dwLowDateTime=0x612b4470, ftLastAccessTime.dwHighDateTime=0x1d4d09f, ftLastWriteTime.dwLowDateTime=0x612b4470, ftLastWriteTime.dwHighDateTime=0x1d4d09f, nFileSizeHigh=0x0, nFileSizeLow=0x3972, dwReserved0=0x0, dwReserved1=0x0, cFileName="d VrEuJ9G.wav", cAlternateFileName="DVREUJ~1.WAV")) returned 1
	[0084.448] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48594fc0, ftCreationTime.dwHighDateTime=0x1d4cb4d, ftLastAccessTime.dwLowDateTime=0x55b722f0, ftLastAccessTime.dwHighDateTime=0x1d4c5a8, ftLastWriteTime.dwLowDateTime=0x55b722f0, ftLastWriteTime.dwHighDateTime=0x1d4c5a8, nFileSizeHigh=0x0, nFileSizeLow=0x16ed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="D-zE1l.wav", cAlternateFileName="")) returned 1
	[0084.448] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b8ada0, ftCreationTime.dwHighDateTime=0x1d4ce97, ftLastAccessTime.dwLowDateTime=0x405b49a0, ftLastAccessTime.dwHighDateTime=0x1d4c6e2, ftLastWriteTime.dwLowDateTime=0x405b49a0, ftLastWriteTime.dwHighDateTime=0x1d4c6e2, nFileSizeHigh=0x0, nFileSizeLow=0x68d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eYwNIxDud4HY76g.wav", cAlternateFileName="EYWNIX~1.WAV")) returned 1
	[0084.449] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fe9d00, ftCreationTime.dwHighDateTime=0x1d4c9f3, ftLastAccessTime.dwLowDateTime=0x2d210330, ftLastAccessTime.dwHighDateTime=0x1d4c94d, ftLastWriteTime.dwLowDateTime=0x2d210330, ftLastWriteTime.dwHighDateTime=0x1d4c94d, nFileSizeHigh=0x0, nFileSizeLow=0x15a87, dwReserved0=0x0, dwReserved1=0x0, cFileName="I177xLEAA77Y.m4a", cAlternateFileName="I177XL~1.M4A")) returned 1
	[0084.449] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb9c58d0, ftCreationTime.dwHighDateTime=0x1d4d21c, ftLastAccessTime.dwLowDateTime=0x10bc8610, ftLastAccessTime.dwHighDateTime=0x1d4c826, ftLastWriteTime.dwLowDateTime=0x10bc8610, ftLastWriteTime.dwHighDateTime=0x1d4c826, nFileSizeHigh=0x0, nFileSizeLow=0xa8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="mX5Rnn.m4a", cAlternateFileName="")) returned 1
	[0084.449] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6abe9890, ftCreationTime.dwHighDateTime=0x1d4d241, ftLastAccessTime.dwLowDateTime=0x9f680c40, ftLastAccessTime.dwHighDateTime=0x1d4d38e, ftLastWriteTime.dwLowDateTime=0x9f680c40, ftLastWriteTime.dwHighDateTime=0x1d4d38e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="naZPH6YCn7NCOR5mRo4", cAlternateFileName="NAZPH6~1")) returned 1
	[0084.449] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d9c710, ftCreationTime.dwHighDateTime=0x1d4c978, ftLastAccessTime.dwLowDateTime=0x88204070, ftLastAccessTime.dwHighDateTime=0x1d4d4d3, ftLastWriteTime.dwLowDateTime=0x88204070, ftLastWriteTime.dwHighDateTime=0x1d4d4d3, nFileSizeHigh=0x0, nFileSizeLow=0x3e43, dwReserved0=0x0, dwReserved1=0x0, cFileName="r5xsLdxporn_7EP.wav", cAlternateFileName="R5XSLD~1.WAV")) returned 1
	[0084.449] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42f3c400, ftCreationTime.dwHighDateTime=0x1d4d3b5, ftLastAccessTime.dwLowDateTime=0x181a2840, ftLastAccessTime.dwHighDateTime=0x1d4cfd8, ftLastWriteTime.dwLowDateTime=0x181a2840, ftLastWriteTime.dwHighDateTime=0x1d4cfd8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="U6h1N4h7-KU", cAlternateFileName="U6H1N4~1")) returned 1
	[0084.449] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.449] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0084.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID", lpFilePart=0x0) returned 0x1f
	[0084.450] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d28f520, ftCreationTime.dwHighDateTime=0x1d4c908, ftLastAccessTime.dwLowDateTime=0x6f3dfb80, ftLastAccessTime.dwHighDateTime=0x1d4d157, ftLastWriteTime.dwLowDateTime=0x6f3dfb80, ftLastWriteTime.dwHighDateTime=0x1d4d157, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0084.450] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d28f520, ftCreationTime.dwHighDateTime=0x1d4c908, ftLastAccessTime.dwLowDateTime=0x6f3dfb80, ftLastAccessTime.dwHighDateTime=0x1d4d157, ftLastWriteTime.dwLowDateTime=0x6f3dfb80, ftLastWriteTime.dwHighDateTime=0x1d4d157, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.450] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3440c090, ftCreationTime.dwHighDateTime=0x1d4d5b6, ftLastAccessTime.dwLowDateTime=0x612b4470, ftLastAccessTime.dwHighDateTime=0x1d4d09f, ftLastWriteTime.dwLowDateTime=0x612b4470, ftLastWriteTime.dwHighDateTime=0x1d4d09f, nFileSizeHigh=0x0, nFileSizeLow=0x3972, dwReserved0=0x0, dwReserved1=0x0, cFileName="d VrEuJ9G.wav", cAlternateFileName="DVREUJ~1.WAV")) returned 1
	[0084.450] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48594fc0, ftCreationTime.dwHighDateTime=0x1d4cb4d, ftLastAccessTime.dwLowDateTime=0x55b722f0, ftLastAccessTime.dwHighDateTime=0x1d4c5a8, ftLastWriteTime.dwLowDateTime=0x55b722f0, ftLastWriteTime.dwHighDateTime=0x1d4c5a8, nFileSizeHigh=0x0, nFileSizeLow=0x16ed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="D-zE1l.wav", cAlternateFileName="")) returned 1
	[0084.450] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b8ada0, ftCreationTime.dwHighDateTime=0x1d4ce97, ftLastAccessTime.dwLowDateTime=0x405b49a0, ftLastAccessTime.dwHighDateTime=0x1d4c6e2, ftLastWriteTime.dwLowDateTime=0x405b49a0, ftLastWriteTime.dwHighDateTime=0x1d4c6e2, nFileSizeHigh=0x0, nFileSizeLow=0x68d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eYwNIxDud4HY76g.wav", cAlternateFileName="EYWNIX~1.WAV")) returned 1
	[0084.450] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fe9d00, ftCreationTime.dwHighDateTime=0x1d4c9f3, ftLastAccessTime.dwLowDateTime=0x2d210330, ftLastAccessTime.dwHighDateTime=0x1d4c94d, ftLastWriteTime.dwLowDateTime=0x2d210330, ftLastWriteTime.dwHighDateTime=0x1d4c94d, nFileSizeHigh=0x0, nFileSizeLow=0x15a87, dwReserved0=0x0, dwReserved1=0x0, cFileName="I177xLEAA77Y.m4a", cAlternateFileName="I177XL~1.M4A")) returned 1
	[0084.450] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb9c58d0, ftCreationTime.dwHighDateTime=0x1d4d21c, ftLastAccessTime.dwLowDateTime=0x10bc8610, ftLastAccessTime.dwHighDateTime=0x1d4c826, ftLastWriteTime.dwLowDateTime=0x10bc8610, ftLastWriteTime.dwHighDateTime=0x1d4c826, nFileSizeHigh=0x0, nFileSizeLow=0xa8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="mX5Rnn.m4a", cAlternateFileName="")) returned 1
	[0084.450] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6abe9890, ftCreationTime.dwHighDateTime=0x1d4d241, ftLastAccessTime.dwLowDateTime=0x9f680c40, ftLastAccessTime.dwHighDateTime=0x1d4d38e, ftLastWriteTime.dwLowDateTime=0x9f680c40, ftLastWriteTime.dwHighDateTime=0x1d4d38e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="naZPH6YCn7NCOR5mRo4", cAlternateFileName="NAZPH6~1")) returned 1
	[0084.451] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d9c710, ftCreationTime.dwHighDateTime=0x1d4c978, ftLastAccessTime.dwLowDateTime=0x88204070, ftLastAccessTime.dwHighDateTime=0x1d4d4d3, ftLastWriteTime.dwLowDateTime=0x88204070, ftLastWriteTime.dwHighDateTime=0x1d4d4d3, nFileSizeHigh=0x0, nFileSizeLow=0x3e43, dwReserved0=0x0, dwReserved1=0x0, cFileName="r5xsLdxporn_7EP.wav", cAlternateFileName="R5XSLD~1.WAV")) returned 1
	[0084.451] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42f3c400, ftCreationTime.dwHighDateTime=0x1d4d3b5, ftLastAccessTime.dwLowDateTime=0x181a2840, ftLastAccessTime.dwHighDateTime=0x1d4cfd8, ftLastWriteTime.dwLowDateTime=0x181a2840, ftLastWriteTime.dwHighDateTime=0x1d4cfd8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="U6h1N4h7-KU", cAlternateFileName="U6H1N4~1")) returned 1
	[0084.451] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42f3c400, ftCreationTime.dwHighDateTime=0x1d4d3b5, ftLastAccessTime.dwLowDateTime=0x181a2840, ftLastAccessTime.dwHighDateTime=0x1d4cfd8, ftLastWriteTime.dwLowDateTime=0x181a2840, ftLastWriteTime.dwHighDateTime=0x1d4cfd8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="U6h1N4h7-KU", cAlternateFileName="U6H1N4~1")) returned 0
	[0084.451] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0084.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0084.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.451] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.452] GetFileType (hFile=0x5dc) returned 0x1
	[0084.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.452] GetFileType (hFile=0x5dc) returned 0x1
	[0084.452] WriteFile (in: hFile=0x5dc, lpBuffer=0x26784cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26784cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.453] CloseHandle (hObject=0x5dc) returned 1
	[0084.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.453] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o", lpFilePart=0x0) returned 0x25
	[0084.453] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8908ca90, ftCreationTime.dwHighDateTime=0x1d4d184, ftLastAccessTime.dwLowDateTime=0xbc245600, ftLastAccessTime.dwHighDateTime=0x1d4ce15, ftLastWriteTime.dwLowDateTime=0xbc245600, ftLastWriteTime.dwHighDateTime=0x1d4ce15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0084.453] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8908ca90, ftCreationTime.dwHighDateTime=0x1d4d184, ftLastAccessTime.dwLowDateTime=0xbc245600, ftLastAccessTime.dwHighDateTime=0x1d4ce15, ftLastWriteTime.dwLowDateTime=0xbc245600, ftLastWriteTime.dwHighDateTime=0x1d4ce15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.453] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681ad170, ftCreationTime.dwHighDateTime=0x1d4d341, ftLastAccessTime.dwLowDateTime=0xf32f9d90, ftLastAccessTime.dwHighDateTime=0x1d4cf59, ftLastWriteTime.dwLowDateTime=0xf32f9d90, ftLastWriteTime.dwHighDateTime=0x1d4cf59, nFileSizeHigh=0x0, nFileSizeLow=0x1635c, dwReserved0=0x0, dwReserved1=0x0, cFileName="0dgA.wav", cAlternateFileName="")) returned 1
	[0084.454] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa991fec0, ftCreationTime.dwHighDateTime=0x1d4d3f6, ftLastAccessTime.dwLowDateTime=0xb2a0370, ftLastAccessTime.dwHighDateTime=0x1d4d2ea, ftLastWriteTime.dwLowDateTime=0xb2a0370, ftLastWriteTime.dwHighDateTime=0x1d4d2ea, nFileSizeHigh=0x0, nFileSizeLow=0x14d5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="B NtwVErZ3 -d.wav", cAlternateFileName="BNTWVE~1.WAV")) returned 1
	[0084.454] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32cd91c0, ftCreationTime.dwHighDateTime=0x1d4d1f6, ftLastAccessTime.dwLowDateTime=0xb84dcd70, ftLastAccessTime.dwHighDateTime=0x1d4cd63, ftLastWriteTime.dwLowDateTime=0xb84dcd70, ftLastWriteTime.dwHighDateTime=0x1d4cd63, nFileSizeHigh=0x0, nFileSizeLow=0x5a16, dwReserved0=0x0, dwReserved1=0x0, cFileName="BAYBVg9W7kRdsNFw.mp3", cAlternateFileName="BAYBVG~1.MP3")) returned 1
	[0084.454] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32cd91c0, ftCreationTime.dwHighDateTime=0x1d4d1f6, ftLastAccessTime.dwLowDateTime=0xb84dcd70, ftLastAccessTime.dwHighDateTime=0x1d4cd63, ftLastWriteTime.dwLowDateTime=0xb84dcd70, ftLastWriteTime.dwHighDateTime=0x1d4cd63, nFileSizeHigh=0x0, nFileSizeLow=0x5a16, dwReserved0=0x0, dwReserved1=0x0, cFileName="BAYBVg9W7kRdsNFw.mp3", cAlternateFileName="BAYBVG~1.MP3")) returned 0
	[0084.454] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0084.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.454] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o", lpFilePart=0x0) returned 0x25
	[0084.454] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8908ca90, ftCreationTime.dwHighDateTime=0x1d4d184, ftLastAccessTime.dwLowDateTime=0xbc245600, ftLastAccessTime.dwHighDateTime=0x1d4ce15, ftLastWriteTime.dwLowDateTime=0xbc245600, ftLastWriteTime.dwHighDateTime=0x1d4ce15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0084.455] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8908ca90, ftCreationTime.dwHighDateTime=0x1d4d184, ftLastAccessTime.dwLowDateTime=0xbc245600, ftLastAccessTime.dwHighDateTime=0x1d4ce15, ftLastWriteTime.dwLowDateTime=0xbc245600, ftLastWriteTime.dwHighDateTime=0x1d4ce15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.455] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681ad170, ftCreationTime.dwHighDateTime=0x1d4d341, ftLastAccessTime.dwLowDateTime=0xf32f9d90, ftLastAccessTime.dwHighDateTime=0x1d4cf59, ftLastWriteTime.dwLowDateTime=0xf32f9d90, ftLastWriteTime.dwHighDateTime=0x1d4cf59, nFileSizeHigh=0x0, nFileSizeLow=0x1635c, dwReserved0=0x0, dwReserved1=0x0, cFileName="0dgA.wav", cAlternateFileName="")) returned 1
	[0084.455] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa991fec0, ftCreationTime.dwHighDateTime=0x1d4d3f6, ftLastAccessTime.dwLowDateTime=0xb2a0370, ftLastAccessTime.dwHighDateTime=0x1d4d2ea, ftLastWriteTime.dwLowDateTime=0xb2a0370, ftLastWriteTime.dwHighDateTime=0x1d4d2ea, nFileSizeHigh=0x0, nFileSizeLow=0x14d5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="B NtwVErZ3 -d.wav", cAlternateFileName="BNTWVE~1.WAV")) returned 1
	[0084.455] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32cd91c0, ftCreationTime.dwHighDateTime=0x1d4d1f6, ftLastAccessTime.dwLowDateTime=0xb84dcd70, ftLastAccessTime.dwHighDateTime=0x1d4cd63, ftLastWriteTime.dwLowDateTime=0xb84dcd70, ftLastWriteTime.dwHighDateTime=0x1d4cd63, nFileSizeHigh=0x0, nFileSizeLow=0x5a16, dwReserved0=0x0, dwReserved1=0x0, cFileName="BAYBVg9W7kRdsNFw.mp3", cAlternateFileName="BAYBVG~1.MP3")) returned 1
	[0084.455] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.455] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0084.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.455] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0084.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.455] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.674] GetFileType (hFile=0x5dc) returned 0x1
	[0084.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.675] GetFileType (hFile=0x5dc) returned 0x1
	[0084.675] WriteFile (in: hFile=0x5dc, lpBuffer=0x267bf0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267bf0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.676] CloseHandle (hObject=0x5dc) returned 1
	[0084.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.676] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N", lpFilePart=0x0) returned 0x1b
	[0084.676] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3165bf0, ftCreationTime.dwHighDateTime=0x1d4d1c0, ftLastAccessTime.dwLowDateTime=0xfffa1f30, ftLastAccessTime.dwHighDateTime=0x1d4cb19, ftLastWriteTime.dwLowDateTime=0xfffa1f30, ftLastWriteTime.dwHighDateTime=0x1d4cb19, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0084.676] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3165bf0, ftCreationTime.dwHighDateTime=0x1d4d1c0, ftLastAccessTime.dwLowDateTime=0xfffa1f30, ftLastAccessTime.dwHighDateTime=0x1d4cb19, ftLastWriteTime.dwLowDateTime=0xfffa1f30, ftLastWriteTime.dwHighDateTime=0x1d4cb19, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.676] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558a6620, ftCreationTime.dwHighDateTime=0x1d4d5d9, ftLastAccessTime.dwLowDateTime=0x80622910, ftLastAccessTime.dwHighDateTime=0x1d4d5c4, ftLastWriteTime.dwLowDateTime=0x80622910, ftLastWriteTime.dwHighDateTime=0x1d4d5c4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7E1l", cAlternateFileName="")) returned 1
	[0084.676] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x959d9cc0, ftCreationTime.dwHighDateTime=0x1d4d4c4, ftLastAccessTime.dwLowDateTime=0xf32c7c00, ftLastAccessTime.dwHighDateTime=0x1d4d409, ftLastWriteTime.dwLowDateTime=0xf32c7c00, ftLastWriteTime.dwHighDateTime=0x1d4d409, nFileSizeHigh=0x0, nFileSizeLow=0x1a35, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANdzXb0OomF HudYgx.wav", cAlternateFileName="ANDZXB~1.WAV")) returned 1
	[0084.676] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde2afd50, ftCreationTime.dwHighDateTime=0x1d4d246, ftLastAccessTime.dwLowDateTime=0xb3423bd0, ftLastAccessTime.dwHighDateTime=0x1d4c715, ftLastWriteTime.dwLowDateTime=0xb3423bd0, ftLastWriteTime.dwHighDateTime=0x1d4c715, nFileSizeHigh=0x0, nFileSizeLow=0x178da, dwReserved0=0x0, dwReserved1=0x0, cFileName="b-Q7CjhvA.wav", cAlternateFileName="B-Q7CJ~1.WAV")) returned 1
	[0084.677] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf747c60, ftCreationTime.dwHighDateTime=0x1d4cd5a, ftLastAccessTime.dwLowDateTime=0x15dfdf10, ftLastAccessTime.dwHighDateTime=0x1d4cbfb, ftLastWriteTime.dwLowDateTime=0x15dfdf10, ftLastWriteTime.dwHighDateTime=0x1d4cbfb, nFileSizeHigh=0x0, nFileSizeLow=0xacf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jIkdAC.wav", cAlternateFileName="")) returned 1
	[0084.677] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed9ffb0, ftCreationTime.dwHighDateTime=0x1d4ce1a, ftLastAccessTime.dwLowDateTime=0x4c9ae360, ftLastAccessTime.dwHighDateTime=0x1d4d1d7, ftLastWriteTime.dwLowDateTime=0x4c9ae360, ftLastWriteTime.dwHighDateTime=0x1d4d1d7, nFileSizeHigh=0x0, nFileSizeLow=0xb52f, dwReserved0=0x0, dwReserved1=0x0, cFileName="M750S.wav", cAlternateFileName="")) returned 1
	[0084.677] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed9ffb0, ftCreationTime.dwHighDateTime=0x1d4ce1a, ftLastAccessTime.dwLowDateTime=0x4c9ae360, ftLastAccessTime.dwHighDateTime=0x1d4d1d7, ftLastWriteTime.dwLowDateTime=0x4c9ae360, ftLastWriteTime.dwHighDateTime=0x1d4d1d7, nFileSizeHigh=0x0, nFileSizeLow=0xb52f, dwReserved0=0x0, dwReserved1=0x0, cFileName="M750S.wav", cAlternateFileName="")) returned 0
	[0084.677] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0084.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.677] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N", lpFilePart=0x0) returned 0x1b
	[0084.677] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3165bf0, ftCreationTime.dwHighDateTime=0x1d4d1c0, ftLastAccessTime.dwLowDateTime=0xfffa1f30, ftLastAccessTime.dwHighDateTime=0x1d4cb19, ftLastWriteTime.dwLowDateTime=0xfffa1f30, ftLastWriteTime.dwHighDateTime=0x1d4cb19, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0084.677] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3165bf0, ftCreationTime.dwHighDateTime=0x1d4d1c0, ftLastAccessTime.dwLowDateTime=0xfffa1f30, ftLastAccessTime.dwHighDateTime=0x1d4cb19, ftLastWriteTime.dwLowDateTime=0xfffa1f30, ftLastWriteTime.dwHighDateTime=0x1d4cb19, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.678] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558a6620, ftCreationTime.dwHighDateTime=0x1d4d5d9, ftLastAccessTime.dwLowDateTime=0x80622910, ftLastAccessTime.dwHighDateTime=0x1d4d5c4, ftLastWriteTime.dwLowDateTime=0x80622910, ftLastWriteTime.dwHighDateTime=0x1d4d5c4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7E1l", cAlternateFileName="")) returned 1
	[0084.678] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x959d9cc0, ftCreationTime.dwHighDateTime=0x1d4d4c4, ftLastAccessTime.dwLowDateTime=0xf32c7c00, ftLastAccessTime.dwHighDateTime=0x1d4d409, ftLastWriteTime.dwLowDateTime=0xf32c7c00, ftLastWriteTime.dwHighDateTime=0x1d4d409, nFileSizeHigh=0x0, nFileSizeLow=0x1a35, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANdzXb0OomF HudYgx.wav", cAlternateFileName="ANDZXB~1.WAV")) returned 1
	[0084.678] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde2afd50, ftCreationTime.dwHighDateTime=0x1d4d246, ftLastAccessTime.dwLowDateTime=0xb3423bd0, ftLastAccessTime.dwHighDateTime=0x1d4c715, ftLastWriteTime.dwLowDateTime=0xb3423bd0, ftLastWriteTime.dwHighDateTime=0x1d4c715, nFileSizeHigh=0x0, nFileSizeLow=0x178da, dwReserved0=0x0, dwReserved1=0x0, cFileName="b-Q7CjhvA.wav", cAlternateFileName="B-Q7CJ~1.WAV")) returned 1
	[0084.678] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf747c60, ftCreationTime.dwHighDateTime=0x1d4cd5a, ftLastAccessTime.dwLowDateTime=0x15dfdf10, ftLastAccessTime.dwHighDateTime=0x1d4cbfb, ftLastWriteTime.dwLowDateTime=0x15dfdf10, ftLastWriteTime.dwHighDateTime=0x1d4cbfb, nFileSizeHigh=0x0, nFileSizeLow=0xacf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jIkdAC.wav", cAlternateFileName="")) returned 1
	[0084.678] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed9ffb0, ftCreationTime.dwHighDateTime=0x1d4ce1a, ftLastAccessTime.dwLowDateTime=0x4c9ae360, ftLastAccessTime.dwHighDateTime=0x1d4d1d7, ftLastWriteTime.dwLowDateTime=0x4c9ae360, ftLastWriteTime.dwHighDateTime=0x1d4d1d7, nFileSizeHigh=0x0, nFileSizeLow=0xb52f, dwReserved0=0x0, dwReserved1=0x0, cFileName="M750S.wav", cAlternateFileName="")) returned 1
	[0084.678] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.678] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0084.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\Decrypt.txt", lpFilePart=0x0) returned 0x27
	[0084.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.678] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.679] GetFileType (hFile=0x5dc) returned 0x1
	[0084.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.679] GetFileType (hFile=0x5dc) returned 0x1
	[0084.679] WriteFile (in: hFile=0x5dc, lpBuffer=0x267fa38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267fa38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.679] CloseHandle (hObject=0x5dc) returned 1
	[0084.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.680] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24
	[0084.680] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0084.680] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.681] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0084.681] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0084.681] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0084.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24
	[0084.681] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0084.681] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.681] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0084.681] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.682] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0084.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0084.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.682] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.682] GetFileType (hFile=0x5dc) returned 0x1
	[0084.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.682] GetFileType (hFile=0x5dc) returned 0x1
	[0084.682] WriteFile (in: hFile=0x5dc, lpBuffer=0x2682e04*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2682e04*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.683] CloseHandle (hObject=0x5dc) returned 1
	[0084.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27
	[0084.683] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0084.684] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.684] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0084.684] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0084.684] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0084.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27
	[0084.684] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0084.684] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.685] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0084.685] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.685] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0084.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.685] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0084.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.685] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.686] GetFileType (hFile=0x5dc) returned 0x1
	[0084.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.686] GetFileType (hFile=0x5dc) returned 0x1
	[0084.686] WriteFile (in: hFile=0x5dc, lpBuffer=0x2686250*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2686250*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.687] CloseHandle (hObject=0x5dc) returned 1
	[0084.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.687] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W", lpFilePart=0x0) returned 0x24
	[0084.687] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b2d990, ftCreationTime.dwHighDateTime=0x1d4c6df, ftLastAccessTime.dwLowDateTime=0x9782d2c0, ftLastAccessTime.dwHighDateTime=0x1d4ca98, ftLastWriteTime.dwLowDateTime=0x9782d2c0, ftLastWriteTime.dwHighDateTime=0x1d4ca98, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0084.688] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b2d990, ftCreationTime.dwHighDateTime=0x1d4c6df, ftLastAccessTime.dwLowDateTime=0x9782d2c0, ftLastAccessTime.dwHighDateTime=0x1d4ca98, ftLastWriteTime.dwLowDateTime=0x9782d2c0, ftLastWriteTime.dwHighDateTime=0x1d4ca98, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.688] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81aacb90, ftCreationTime.dwHighDateTime=0x1d4d067, ftLastAccessTime.dwLowDateTime=0xd29c3320, ftLastAccessTime.dwHighDateTime=0x1d4d26c, ftLastWriteTime.dwLowDateTime=0xd29c3320, ftLastWriteTime.dwHighDateTime=0x1d4d26c, nFileSizeHigh=0x0, nFileSizeLow=0x161c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4RysTpj.mp4", cAlternateFileName="")) returned 1
	[0084.688] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3329320, ftCreationTime.dwHighDateTime=0x1d4d31d, ftLastAccessTime.dwLowDateTime=0x8cfd1a90, ftLastAccessTime.dwHighDateTime=0x1d4d3c6, ftLastWriteTime.dwLowDateTime=0x8cfd1a90, ftLastWriteTime.dwHighDateTime=0x1d4d3c6, nFileSizeHigh=0x0, nFileSizeLow=0xf9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8XHHAAAf7gogPDd.mkv", cAlternateFileName="A8XHHA~1.MKV")) returned 1
	[0084.688] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818e83f0, ftCreationTime.dwHighDateTime=0x1d4c585, ftLastAccessTime.dwLowDateTime=0x33e2b4a0, ftLastAccessTime.dwHighDateTime=0x1d4ccfb, ftLastWriteTime.dwLowDateTime=0x33e2b4a0, ftLastWriteTime.dwHighDateTime=0x1d4ccfb, nFileSizeHigh=0x0, nFileSizeLow=0x16f31, dwReserved0=0x0, dwReserved1=0x0, cFileName="bSgcnZtRMZtyrAw7o4Vh.avi", cAlternateFileName="BSGCNZ~1.AVI")) returned 1
	[0084.688] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7f0470, ftCreationTime.dwHighDateTime=0x1d4d44d, ftLastAccessTime.dwLowDateTime=0x99e97a50, ftLastAccessTime.dwHighDateTime=0x1d4cefd, ftLastWriteTime.dwLowDateTime=0x99e97a50, ftLastWriteTime.dwHighDateTime=0x1d4cefd, nFileSizeHigh=0x0, nFileSizeLow=0x17c7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERMY3.mp4", cAlternateFileName="")) returned 1
	[0084.688] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb7fe920, ftCreationTime.dwHighDateTime=0x1d4d3a1, ftLastAccessTime.dwLowDateTime=0x9a40ec90, ftLastAccessTime.dwHighDateTime=0x1d4ce62, ftLastWriteTime.dwLowDateTime=0x9a40ec90, ftLastWriteTime.dwHighDateTime=0x1d4ce62, nFileSizeHigh=0x0, nFileSizeLow=0x108c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lnJd5UQLlnAEy.mp4", cAlternateFileName="LNJD5U~1.MP4")) returned 1
	[0084.688] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278976a0, ftCreationTime.dwHighDateTime=0x1d4d023, ftLastAccessTime.dwLowDateTime=0xb7266070, ftLastAccessTime.dwHighDateTime=0x1d4cd8f, ftLastWriteTime.dwLowDateTime=0xb7266070, ftLastWriteTime.dwHighDateTime=0x1d4cd8f, nFileSizeHigh=0x0, nFileSizeLow=0x14ccb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPDM4.avi", cAlternateFileName="")) returned 1
	[0084.688] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75ed52d0, ftCreationTime.dwHighDateTime=0x1d4c722, ftLastAccessTime.dwLowDateTime=0x4b05f390, ftLastAccessTime.dwHighDateTime=0x1d4d59d, ftLastWriteTime.dwLowDateTime=0x4b05f390, ftLastWriteTime.dwHighDateTime=0x1d4d59d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vjv-EpWxcyYy7bdaz", cAlternateFileName="VJV-EP~1")) returned 1
	[0084.689] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce964e80, ftCreationTime.dwHighDateTime=0x1d4c9a9, ftLastAccessTime.dwLowDateTime=0xd87b4770, ftLastAccessTime.dwHighDateTime=0x1d4d061, ftLastWriteTime.dwLowDateTime=0xd87b4770, ftLastWriteTime.dwHighDateTime=0x1d4d061, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wRs6luVxjXk46_vbNEsf", cAlternateFileName="WRS6LU~1")) returned 1
	[0084.689] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb632d40, ftCreationTime.dwHighDateTime=0x1d4cecf, ftLastAccessTime.dwLowDateTime=0x982f9870, ftLastAccessTime.dwHighDateTime=0x1d4cae3, ftLastWriteTime.dwLowDateTime=0x982f9870, ftLastWriteTime.dwHighDateTime=0x1d4cae3, nFileSizeHigh=0x0, nFileSizeLow=0x167ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="XwNfi.mkv", cAlternateFileName="")) returned 1
	[0084.689] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc13d0800, ftCreationTime.dwHighDateTime=0x1d4d458, ftLastAccessTime.dwLowDateTime=0xc6d25240, ftLastAccessTime.dwHighDateTime=0x1d4ca6f, ftLastWriteTime.dwLowDateTime=0xc6d25240, ftLastWriteTime.dwHighDateTime=0x1d4ca6f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yYO9153Pz4zX5", cAlternateFileName="YYO915~1")) returned 1
	[0084.689] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0084.689] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0084.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.689] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W", lpFilePart=0x0) returned 0x24
	[0084.689] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b2d990, ftCreationTime.dwHighDateTime=0x1d4c6df, ftLastAccessTime.dwLowDateTime=0x9782d2c0, ftLastAccessTime.dwHighDateTime=0x1d4ca98, ftLastWriteTime.dwLowDateTime=0x9782d2c0, ftLastWriteTime.dwHighDateTime=0x1d4ca98, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0084.689] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b2d990, ftCreationTime.dwHighDateTime=0x1d4c6df, ftLastAccessTime.dwLowDateTime=0x9782d2c0, ftLastAccessTime.dwHighDateTime=0x1d4ca98, ftLastWriteTime.dwLowDateTime=0x9782d2c0, ftLastWriteTime.dwHighDateTime=0x1d4ca98, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0084.690] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81aacb90, ftCreationTime.dwHighDateTime=0x1d4d067, ftLastAccessTime.dwLowDateTime=0xd29c3320, ftLastAccessTime.dwHighDateTime=0x1d4d26c, ftLastWriteTime.dwLowDateTime=0xd29c3320, ftLastWriteTime.dwHighDateTime=0x1d4d26c, nFileSizeHigh=0x0, nFileSizeLow=0x161c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4RysTpj.mp4", cAlternateFileName="")) returned 1
	[0084.690] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3329320, ftCreationTime.dwHighDateTime=0x1d4d31d, ftLastAccessTime.dwLowDateTime=0x8cfd1a90, ftLastAccessTime.dwHighDateTime=0x1d4d3c6, ftLastWriteTime.dwLowDateTime=0x8cfd1a90, ftLastWriteTime.dwHighDateTime=0x1d4d3c6, nFileSizeHigh=0x0, nFileSizeLow=0xf9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8XHHAAAf7gogPDd.mkv", cAlternateFileName="A8XHHA~1.MKV")) returned 1
	[0084.690] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818e83f0, ftCreationTime.dwHighDateTime=0x1d4c585, ftLastAccessTime.dwLowDateTime=0x33e2b4a0, ftLastAccessTime.dwHighDateTime=0x1d4ccfb, ftLastWriteTime.dwLowDateTime=0x33e2b4a0, ftLastWriteTime.dwHighDateTime=0x1d4ccfb, nFileSizeHigh=0x0, nFileSizeLow=0x16f31, dwReserved0=0x0, dwReserved1=0x0, cFileName="bSgcnZtRMZtyrAw7o4Vh.avi", cAlternateFileName="BSGCNZ~1.AVI")) returned 1
	[0084.690] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7f0470, ftCreationTime.dwHighDateTime=0x1d4d44d, ftLastAccessTime.dwLowDateTime=0x99e97a50, ftLastAccessTime.dwHighDateTime=0x1d4cefd, ftLastWriteTime.dwLowDateTime=0x99e97a50, ftLastWriteTime.dwHighDateTime=0x1d4cefd, nFileSizeHigh=0x0, nFileSizeLow=0x17c7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERMY3.mp4", cAlternateFileName="")) returned 1
	[0084.690] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb7fe920, ftCreationTime.dwHighDateTime=0x1d4d3a1, ftLastAccessTime.dwLowDateTime=0x9a40ec90, ftLastAccessTime.dwHighDateTime=0x1d4ce62, ftLastWriteTime.dwLowDateTime=0x9a40ec90, ftLastWriteTime.dwHighDateTime=0x1d4ce62, nFileSizeHigh=0x0, nFileSizeLow=0x108c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lnJd5UQLlnAEy.mp4", cAlternateFileName="LNJD5U~1.MP4")) returned 1
	[0084.690] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278976a0, ftCreationTime.dwHighDateTime=0x1d4d023, ftLastAccessTime.dwLowDateTime=0xb7266070, ftLastAccessTime.dwHighDateTime=0x1d4cd8f, ftLastWriteTime.dwLowDateTime=0xb7266070, ftLastWriteTime.dwHighDateTime=0x1d4cd8f, nFileSizeHigh=0x0, nFileSizeLow=0x14ccb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPDM4.avi", cAlternateFileName="")) returned 1
	[0084.690] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75ed52d0, ftCreationTime.dwHighDateTime=0x1d4c722, ftLastAccessTime.dwLowDateTime=0x4b05f390, ftLastAccessTime.dwHighDateTime=0x1d4d59d, ftLastWriteTime.dwLowDateTime=0x4b05f390, ftLastWriteTime.dwHighDateTime=0x1d4d59d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vjv-EpWxcyYy7bdaz", cAlternateFileName="VJV-EP~1")) returned 1
	[0084.690] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce964e80, ftCreationTime.dwHighDateTime=0x1d4c9a9, ftLastAccessTime.dwLowDateTime=0xd87b4770, ftLastAccessTime.dwHighDateTime=0x1d4d061, ftLastWriteTime.dwLowDateTime=0xd87b4770, ftLastWriteTime.dwHighDateTime=0x1d4d061, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wRs6luVxjXk46_vbNEsf", cAlternateFileName="WRS6LU~1")) returned 1
	[0084.690] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb632d40, ftCreationTime.dwHighDateTime=0x1d4cecf, ftLastAccessTime.dwLowDateTime=0x982f9870, ftLastAccessTime.dwHighDateTime=0x1d4cae3, ftLastWriteTime.dwLowDateTime=0x982f9870, ftLastWriteTime.dwHighDateTime=0x1d4cae3, nFileSizeHigh=0x0, nFileSizeLow=0x167ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="XwNfi.mkv", cAlternateFileName="")) returned 1
	[0084.690] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc13d0800, ftCreationTime.dwHighDateTime=0x1d4d458, ftLastAccessTime.dwLowDateTime=0xc6d25240, ftLastAccessTime.dwHighDateTime=0x1d4ca6f, ftLastWriteTime.dwLowDateTime=0xc6d25240, ftLastWriteTime.dwHighDateTime=0x1d4ca6f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yYO9153Pz4zX5", cAlternateFileName="YYO915~1")) returned 1
	[0084.690] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc13d0800, ftCreationTime.dwHighDateTime=0x1d4d458, ftLastAccessTime.dwLowDateTime=0xc6d25240, ftLastAccessTime.dwHighDateTime=0x1d4ca6f, ftLastWriteTime.dwLowDateTime=0xc6d25240, ftLastWriteTime.dwHighDateTime=0x1d4ca6f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yYO9153Pz4zX5", cAlternateFileName="YYO915~1")) returned 0
	[0084.691] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0084.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0084.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0084.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0084.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.691] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.691] GetFileType (hFile=0x5dc) returned 0x1
	[0084.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.691] GetFileType (hFile=0x5dc) returned 0x1
	[0084.691] WriteFile (in: hFile=0x5dc, lpBuffer=0x268aff0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268aff0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.692] CloseHandle (hObject=0x5dc) returned 1
	[0084.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.692] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music", lpFilePart=0x0) returned 0x22
	[0084.692] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.693] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music", lpFilePart=0x0) returned 0x22
	[0084.694] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.695] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0084.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.695] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\My Music\\Decrypt.txt" (normalized: "c:\\users\\public\\documents\\my music\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.695] GetFileType (hFile=0x5dc) returned 0x1
	[0084.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.696] GetFileType (hFile=0x5dc) returned 0x1
	[0084.696] WriteFile (in: hFile=0x5dc, lpBuffer=0x268e10c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268e10c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.696] CloseHandle (hObject=0x5dc) returned 1
	[0084.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.697] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25
	[0084.697] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.698] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25
	[0084.698] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.699] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0084.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.699] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\Decrypt.txt" (normalized: "c:\\users\\public\\documents\\my pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.700] GetFileType (hFile=0x5dc) returned 0x1
	[0084.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.700] GetFileType (hFile=0x5dc) returned 0x1
	[0084.700] WriteFile (in: hFile=0x5dc, lpBuffer=0x2691270*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2691270*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.701] CloseHandle (hObject=0x5dc) returned 1
	[0084.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.701] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos", lpFilePart=0x0) returned 0x23
	[0084.701] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.702] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos", lpFilePart=0x0) returned 0x23
	[0084.702] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0084.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0084.703] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0084.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0084.704] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\My Videos\\Decrypt.txt" (normalized: "c:\\users\\public\\documents\\my videos\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0084.704] GetFileType (hFile=0x5dc) returned 0x1
	[0084.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0084.704] GetFileType (hFile=0x5dc) returned 0x1
	[0084.705] WriteFile (in: hFile=0x5dc, lpBuffer=0x269438c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269438c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0084.705] CloseHandle (hObject=0x5dc) returned 1
	[0084.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0084.705] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", lpFilePart=0x0) returned 0x51
	[0084.705] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0084.972] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.064] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0085.070] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0085.071] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0085.071] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0085.071] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.072] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", lpFilePart=0x0) returned 0x51
	[0085.072] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0085.073] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.073] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0085.073] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0085.073] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0085.073] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.073] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0085.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.074] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.075] GetFileType (hFile=0x5dc) returned 0x1
	[0085.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.075] GetFileType (hFile=0x5dc) returned 0x1
	[0085.075] WriteFile (in: hFile=0x5dc, lpBuffer=0x249df14*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x249df14*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.076] CloseHandle (hObject=0x5dc) returned 1
	[0085.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", lpFilePart=0x0) returned 0x52
	[0085.076] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0085.077] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.078] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0085.078] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0085.078] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0085.078] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0085.078] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0085.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.079] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", lpFilePart=0x0) returned 0x52
	[0085.079] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0085.080] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.080] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0085.080] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0085.080] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0085.080] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.080] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0085.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.081] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0085.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.081] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.082] GetFileType (hFile=0x5dc) returned 0x1
	[0085.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.082] GetFileType (hFile=0x5dc) returned 0x1
	[0085.082] WriteFile (in: hFile=0x5dc, lpBuffer=0x24a272c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24a272c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.083] CloseHandle (hObject=0x5dc) returned 1
	[0085.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.083] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", lpFilePart=0x0) returned 0x51
	[0085.084] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0085.084] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.084] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0085.085] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0085.085] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0085.085] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0085.085] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0085.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.086] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", lpFilePart=0x0) returned 0x51
	[0085.086] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.086] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.087] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0085.087] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0085.087] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0085.087] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.087] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.088] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.088] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.089] GetFileType (hFile=0x5dc) returned 0x1
	[0085.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.089] GetFileType (hFile=0x5dc) returned 0x1
	[0085.089] WriteFile (in: hFile=0x5dc, lpBuffer=0x24a6efc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24a6efc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.089] CloseHandle (hObject=0x5dc) returned 1
	[0085.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.090] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", lpFilePart=0x0) returned 0x52
	[0085.090] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0085.090] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.091] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0085.091] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0085.091] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0085.091] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0085.091] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0085.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.092] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", lpFilePart=0x0) returned 0x52
	[0085.092] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.093] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.093] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0085.093] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0085.093] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0085.093] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.093] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.094] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0085.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.094] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.095] GetFileType (hFile=0x5dc) returned 0x1
	[0085.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.095] GetFileType (hFile=0x5dc) returned 0x1
	[0085.095] WriteFile (in: hFile=0x5dc, lpBuffer=0x24ab714*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ab714*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.096] CloseHandle (hObject=0x5dc) returned 1
	[0085.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.096] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", lpFilePart=0x0) returned 0x51
	[0085.096] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0085.236] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.236] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd7b21800, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0085.236] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0085.236] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0085.237] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0085.237] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0085.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.238] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", lpFilePart=0x0) returned 0x51
	[0085.238] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0085.238] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.238] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd7b21800, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0085.239] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0085.239] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0085.239] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.239] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0085.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.240] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.240] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.240] GetFileType (hFile=0x5dc) returned 0x1
	[0085.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.240] GetFileType (hFile=0x5dc) returned 0x1
	[0085.241] WriteFile (in: hFile=0x5dc, lpBuffer=0x24affa4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24affa4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.241] CloseHandle (hObject=0x5dc) returned 1
	[0085.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.242] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", lpFilePart=0x0) returned 0x52
	[0085.242] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0085.251] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.251] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd54fbe00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0085.251] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0085.251] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0085.251] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0085.251] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0085.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.252] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", lpFilePart=0x0) returned 0x52
	[0085.252] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0085.253] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.253] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd54fbe00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0085.253] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0085.253] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0085.253] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.254] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0085.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.254] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0085.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.254] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.255] GetFileType (hFile=0x5dc) returned 0x1
	[0085.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.255] GetFileType (hFile=0x5dc) returned 0x1
	[0085.255] WriteFile (in: hFile=0x5dc, lpBuffer=0x24b47bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b47bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.256] CloseHandle (hObject=0x5dc) returned 1
	[0085.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.256] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpFilePart=0x0) returned 0x37
	[0085.256] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0085.257] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.257] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1
	[0085.257] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.257] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0085.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.257] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpFilePart=0x0) returned 0x37
	[0085.257] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0085.257] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.257] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1
	[0085.258] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0
	[0085.258] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0085.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.258] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0085.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.258] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.259] GetFileType (hFile=0x5dc) returned 0x1
	[0085.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.259] GetFileType (hFile=0x5dc) returned 0x1
	[0085.259] WriteFile (in: hFile=0x5dc, lpBuffer=0x24b7f6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b7f6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.260] CloseHandle (hObject=0x5dc) returned 1
	[0085.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.260] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration", lpFilePart=0x0) returned 0x3b
	[0085.260] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0085.260] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.260] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1
	[0085.260] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.260] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0085.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration", lpFilePart=0x0) returned 0x3b
	[0085.261] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0085.261] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.261] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1
	[0085.261] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0
	[0085.261] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0085.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0085.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.261] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\integration\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.262] GetFileType (hFile=0x5dc) returned 0x1
	[0085.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.262] GetFileType (hFile=0x5dc) returned 0x1
	[0085.262] WriteFile (in: hFile=0x5dc, lpBuffer=0x24bb8b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24bb8b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.262] CloseHandle (hObject=0x5dc) returned 1
	[0085.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.263] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpFilePart=0x0) returned 0x58
	[0085.263] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0085.263] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.263] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0085.263] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0085.263] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.263] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0085.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpFilePart=0x0) returned 0x58
	[0085.264] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0085.264] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.264] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0085.264] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0085.264] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0085.264] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0085.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0085.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.264] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.265] GetFileType (hFile=0x5dc) returned 0x1
	[0085.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.265] GetFileType (hFile=0x5dc) returned 0x1
	[0085.265] WriteFile (in: hFile=0x5dc, lpBuffer=0x24bfba8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24bfba8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.266] CloseHandle (hObject=0x5dc) returned 1
	[0085.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", lpFilePart=0x0) returned 0x58
	[0085.266] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0085.275] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.275] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0085.275] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0085.275] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.275] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0085.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.276] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", lpFilePart=0x0) returned 0x58
	[0085.276] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0085.276] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.276] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0085.276] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0085.276] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0085.276] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0085.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.276] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0085.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.277] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.277] GetFileType (hFile=0x5dc) returned 0x1
	[0085.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.277] GetFileType (hFile=0x5dc) returned 0x1
	[0085.277] WriteFile (in: hFile=0x5dc, lpBuffer=0x24c3ea0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c3ea0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.278] CloseHandle (hObject=0x5dc) returned 1
	[0085.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.278] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f
	[0085.278] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0085.279] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.279] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.279] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0085.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.279] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f
	[0085.279] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0085.279] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.280] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.280] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0085.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0085.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.280] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\machinekeys\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.280] GetFileType (hFile=0x5dc) returned 0x1
	[0085.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.280] GetFileType (hFile=0x5dc) returned 0x1
	[0085.280] WriteFile (in: hFile=0x5dc, lpBuffer=0x24c71d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c71d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.281] CloseHandle (hObject=0x5dc) returned 1
	[0085.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.281] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f
	[0085.281] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0085.282] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.282] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1
	[0085.282] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0
	[0085.282] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0085.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.283] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f
	[0085.283] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0085.283] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.283] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1
	[0085.283] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.283] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0085.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.284] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0085.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.284] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.284] GetFileType (hFile=0x5dc) returned 0x1
	[0085.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.284] GetFileType (hFile=0x5dc) returned 0x1
	[0085.284] WriteFile (in: hFile=0x5dc, lpBuffer=0x24cab6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24cab6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.285] CloseHandle (hObject=0x5dc) returned 1
	[0085.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.285] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c
	[0085.285] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0085.286] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.286] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1
	[0085.286] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 0
	[0085.286] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0085.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.286] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c
	[0085.286] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0085.286] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.286] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1
	[0085.286] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.287] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0085.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.287] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt", lpFilePart=0x0) returned 0x38
	[0085.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.287] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.287] GetFileType (hFile=0x5dc) returned 0x1
	[0085.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.287] GetFileType (hFile=0x5dc) returned 0x1
	[0085.287] WriteFile (in: hFile=0x5dc, lpBuffer=0x24ce484*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ce484*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.288] CloseHandle (hObject=0x5dc) returned 1
	[0085.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.288] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53
	[0085.288] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0085.435] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.435] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0085.435] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0085.436] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1
	[0085.436] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1
	[0085.436] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1
	[0085.436] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0
	[0085.436] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0085.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.437] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53
	[0085.437] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0085.437] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.438] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0085.438] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0085.438] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1
	[0085.438] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1
	[0085.438] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1
	[0085.438] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.438] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0085.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.439] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0085.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.439] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.440] GetFileType (hFile=0x5dc) returned 0x1
	[0085.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.440] GetFileType (hFile=0x5dc) returned 0x1
	[0085.440] WriteFile (in: hFile=0x5dc, lpBuffer=0x24d3280*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d3280*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.440] CloseHandle (hObject=0x5dc) returned 1
	[0085.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.441] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53
	[0085.441] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0085.441] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.441] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0085.441] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0085.441] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1
	[0085.441] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0
	[0085.441] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0085.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.442] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53
	[0085.442] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0085.442] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.442] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0085.442] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0085.442] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1
	[0085.442] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.442] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0085.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.442] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0085.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.442] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.443] GetFileType (hFile=0x5dc) returned 0x1
	[0085.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.443] GetFileType (hFile=0x5dc) returned 0x1
	[0085.443] WriteFile (in: hFile=0x5dc, lpBuffer=0x24d7890*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d7890*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.444] CloseHandle (hObject=0x5dc) returned 1
	[0085.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.444] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x51
	[0085.444] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0085.451] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.451] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0085.451] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0085.452] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1
	[0085.452] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1
	[0085.452] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0085.452] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1
	[0085.452] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1
	[0085.452] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1
	[0085.452] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0085.452] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1
	[0085.452] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0
	[0085.452] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0085.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.453] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x51
	[0085.453] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0085.454] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.454] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0085.454] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0085.454] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1
	[0085.454] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1
	[0085.454] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0085.454] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1
	[0085.454] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1
	[0085.454] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1
	[0085.454] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0085.454] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1
	[0085.455] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.455] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0085.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.456] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.456] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.456] GetFileType (hFile=0x5dc) returned 0x1
	[0085.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.456] GetFileType (hFile=0x5dc) returned 0x1
	[0085.456] WriteFile (in: hFile=0x5dc, lpBuffer=0x24dd8a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24dd8a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.457] CloseHandle (hObject=0x5dc) returned 1
	[0085.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.457] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x51
	[0085.457] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0085.459] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.459] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0085.459] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0085.459] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1
	[0085.459] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1
	[0085.459] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1
	[0085.459] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1
	[0085.459] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1
	[0085.460] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1
	[0085.460] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0085.460] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0
	[0085.460] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0085.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.461] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x51
	[0085.461] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0085.461] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.461] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0085.461] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0085.462] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1
	[0085.462] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1
	[0085.462] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1
	[0085.462] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1
	[0085.462] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1
	[0085.462] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1
	[0085.462] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0085.462] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.462] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0085.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.463] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.463] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.464] GetFileType (hFile=0x5dc) returned 0x1
	[0085.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.464] GetFileType (hFile=0x5dc) returned 0x1
	[0085.464] WriteFile (in: hFile=0x5dc, lpBuffer=0x24e35b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e35b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.464] CloseHandle (hObject=0x5dc) returned 1
	[0085.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", lpFilePart=0x0) returned 0x35
	[0085.465] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.465] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.465] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0085.465] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0
	[0085.465] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", lpFilePart=0x0) returned 0x35
	[0085.466] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0085.466] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.466] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0085.466] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.466] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0085.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0085.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.466] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.467] GetFileType (hFile=0x5dc) returned 0x1
	[0085.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.467] GetFileType (hFile=0x5dc) returned 0x1
	[0085.467] WriteFile (in: hFile=0x5dc, lpBuffer=0x24e6ec0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e6ec0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.468] CloseHandle (hObject=0x5dc) returned 1
	[0085.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", lpFilePart=0x0) returned 0x41
	[0085.468] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0085.468] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.468] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.468] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0085.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", lpFilePart=0x0) returned 0x41
	[0085.468] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0085.469] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.469] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.469] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0085.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0085.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.469] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\scenarioshutdownlogger\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.469] GetFileType (hFile=0x5dc) returned 0x1
	[0085.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.469] GetFileType (hFile=0x5dc) returned 0x1
	[0085.469] WriteFile (in: hFile=0x5dc, lpBuffer=0x24ea554*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ea554*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.470] CloseHandle (hObject=0x5dc) returned 1
	[0085.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.472] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", lpFilePart=0x0) returned 0x39
	[0085.472] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0085.473] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.473] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0085.473] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0
	[0085.473] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0085.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", lpFilePart=0x0) returned 0x39
	[0085.473] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.473] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.473] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0085.473] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.473] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0085.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.474] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.474] GetFileType (hFile=0x5dc) returned 0x1
	[0085.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.474] GetFileType (hFile=0x5dc) returned 0x1
	[0085.474] WriteFile (in: hFile=0x5dc, lpBuffer=0x24edf3c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24edf3c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.475] CloseHandle (hObject=0x5dc) returned 1
	[0085.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.475] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA", lpFilePart=0x0) returned 0x37
	[0085.475] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0085.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0085.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.477] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA", lpFilePart=0x0) returned 0x37
	[0085.477] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0085.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0085.478] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0085.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.478] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\tenantstorage\\p-aria\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0085.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511db20) returned 1
	[0085.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.640] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x44
	[0085.640] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0085.640] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.641] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.641] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0085.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.641] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x44
	[0085.641] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.641] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.641] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.641] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.642] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0085.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.642] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\applicationviewsrootnode\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.642] GetFileType (hFile=0x5dc) returned 0x1
	[0085.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.642] GetFileType (hFile=0x5dc) returned 0x1
	[0085.643] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f2ae0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f2ae0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.643] CloseHandle (hObject=0x5dc) returned 1
	[0085.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp", lpFilePart=0x0) returned 0x34
	[0085.644] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0085.644] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.644] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.644] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0085.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp", lpFilePart=0x0) returned 0x34
	[0085.644] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0085.645] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.645] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.645] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0085.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.645] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0085.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.645] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\temp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.645] GetFileType (hFile=0x5dc) returned 0x1
	[0085.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.645] GetFileType (hFile=0x5dc) returned 0x1
	[0085.646] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f5f24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f5f24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.646] CloseHandle (hObject=0x5dc) returned 1
	[0085.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm", lpFilePart=0x0) returned 0x2f
	[0085.647] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0085.647] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.647] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.647] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0085.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm", lpFilePart=0x0) returned 0x2f
	[0085.648] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0085.648] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.648] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.648] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0085.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0085.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.648] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\network\\connections\\cm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.649] GetFileType (hFile=0x5dc) returned 0x1
	[0085.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.649] GetFileType (hFile=0x5dc) returned 0x1
	[0085.649] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f9258*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f9258*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.650] CloseHandle (hObject=0x5dc) returned 1
	[0085.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old", lpFilePart=0x0) returned 0x33
	[0085.650] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0085.701] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.701] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.701] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0085.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.701] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old", lpFilePart=0x0) returned 0x33
	[0085.702] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.702] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.702] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.702] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.702] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0085.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.702] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\network\\connections\\cm_old\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.703] GetFileType (hFile=0x5dc) returned 0x1
	[0085.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.703] GetFileType (hFile=0x5dc) returned 0x1
	[0085.703] WriteFile (in: hFile=0x5dc, lpBuffer=0x24fc714*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24fc714*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.703] CloseHandle (hObject=0x5dc) returned 1
	[0085.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.704] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0085.706] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.706] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.706] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.706] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.706] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0085.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.707] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.707] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0085.707] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.707] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.707] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.707] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.707] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0085.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.708] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.708] GetFileType (hFile=0x5dc) returned 0x1
	[0085.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.708] GetFileType (hFile=0x5dc) returned 0x1
	[0085.708] WriteFile (in: hFile=0x5dc, lpBuffer=0x250084c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250084c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.709] CloseHandle (hObject=0x5dc) returned 1
	[0085.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.709] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.709] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0085.710] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.710] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.710] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.710] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.711] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0085.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.711] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.711] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0085.711] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.711] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.711] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.711] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.711] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0085.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.712] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.712] GetFileType (hFile=0x5dc) returned 0x1
	[0085.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.712] GetFileType (hFile=0x5dc) returned 0x1
	[0085.712] WriteFile (in: hFile=0x5dc, lpBuffer=0x2504984*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2504984*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.713] CloseHandle (hObject=0x5dc) returned 1
	[0085.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.713] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.714] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0085.714] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.714] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.714] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.715] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.715] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0085.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.715] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.715] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0085.715] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.715] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.715] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.716] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.716] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0085.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.716] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.716] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.716] GetFileType (hFile=0x5dc) returned 0x1
	[0085.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.716] GetFileType (hFile=0x5dc) returned 0x1
	[0085.716] WriteFile (in: hFile=0x5dc, lpBuffer=0x2508abc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2508abc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.717] CloseHandle (hObject=0x5dc) returned 1
	[0085.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.717] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.717] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0085.718] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.718] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.718] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.719] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.719] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0085.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.719] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0085.719] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.719] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.720] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.720] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.720] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0085.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.720] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.720] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.721] GetFileType (hFile=0x5dc) returned 0x1
	[0085.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.721] GetFileType (hFile=0x5dc) returned 0x1
	[0085.721] WriteFile (in: hFile=0x5dc, lpBuffer=0x250cbf4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250cbf4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.722] CloseHandle (hObject=0x5dc) returned 1
	[0085.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.722] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0085.723] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.723] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.723] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.723] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.723] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0085.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.724] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.724] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.724] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.724] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.724] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.724] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.725] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.725] GetFileType (hFile=0x5dc) returned 0x1
	[0085.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.725] GetFileType (hFile=0x5dc) returned 0x1
	[0085.725] WriteFile (in: hFile=0x5dc, lpBuffer=0x2510d2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2510d2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.729] CloseHandle (hObject=0x5dc) returned 1
	[0085.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.729] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0085.730] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.730] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.730] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.730] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.731] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0085.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.731] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.731] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0085.731] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.731] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.732] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.732] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.732] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0085.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.732] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0085.732] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.732] GetFileType (hFile=0x5dc) returned 0x1
	[0085.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0085.732] GetFileType (hFile=0x5dc) returned 0x1
	[0085.732] WriteFile (in: hFile=0x5dc, lpBuffer=0x2514e64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2514e64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.733] CloseHandle (hObject=0x5dc) returned 1
	[0085.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.734] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.734] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.734] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.734] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.735] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.735] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.735] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0085.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0085.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0085.735] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.735] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.735] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.735] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.736] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.736] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.736] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.736] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.736] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.830] GetFileType (hFile=0x5dc) returned 0x1
	[0085.830] GetFileType (hFile=0x5dc) returned 0x1
	[0085.830] WriteFile (in: hFile=0x5dc, lpBuffer=0x25190f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25190f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.831] CloseHandle (hObject=0x5dc) returned 1
	[0085.831] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.832] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0085.832] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.832] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.832] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.833] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.833] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0085.833] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.833] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0085.833] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.833] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.833] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.833] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.833] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0085.833] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.834] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.834] GetFileType (hFile=0x5dc) returned 0x1
	[0085.834] GetFileType (hFile=0x5dc) returned 0x1
	[0085.834] WriteFile (in: hFile=0x5dc, lpBuffer=0x251d22c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251d22c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.835] CloseHandle (hObject=0x5dc) returned 1
	[0085.835] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.835] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0085.835] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.836] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.836] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.836] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.836] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0085.836] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.836] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0085.836] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.836] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.836] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.836] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.837] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0085.837] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.837] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.837] GetFileType (hFile=0x5dc) returned 0x1
	[0085.837] GetFileType (hFile=0x5dc) returned 0x1
	[0085.837] WriteFile (in: hFile=0x5dc, lpBuffer=0x2521364*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2521364*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.838] CloseHandle (hObject=0x5dc) returned 1
	[0085.838] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.838] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0085.839] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.839] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.839] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.839] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.839] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0085.839] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.839] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0085.839] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.840] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.840] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.840] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.840] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0085.840] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.840] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.841] GetFileType (hFile=0x5dc) returned 0x1
	[0085.841] GetFileType (hFile=0x5dc) returned 0x1
	[0085.841] WriteFile (in: hFile=0x5dc, lpBuffer=0x252549c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x252549c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.841] CloseHandle (hObject=0x5dc) returned 1
	[0085.842] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0085.842] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.842] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.842] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.842] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.843] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0085.843] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.843] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0085.843] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.843] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.843] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.843] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.843] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0085.843] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.843] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.844] GetFileType (hFile=0x5dc) returned 0x1
	[0085.844] GetFileType (hFile=0x5dc) returned 0x1
	[0085.844] WriteFile (in: hFile=0x5dc, lpBuffer=0x25295d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25295d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.844] CloseHandle (hObject=0x5dc) returned 1
	[0085.845] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.845] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0085.845] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.846] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.846] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.846] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.846] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0085.846] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.846] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0085.846] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.846] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.846] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.846] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.846] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0085.847] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.847] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.847] GetFileType (hFile=0x5dc) returned 0x1
	[0085.847] GetFileType (hFile=0x5dc) returned 0x1
	[0085.847] WriteFile (in: hFile=0x5dc, lpBuffer=0x252d70c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x252d70c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.848] CloseHandle (hObject=0x5dc) returned 1
	[0085.848] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.848] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0085.849] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.849] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.849] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.849] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.849] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0085.850] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.850] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0085.850] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.850] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.850] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.850] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.850] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0085.850] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.850] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.851] GetFileType (hFile=0x5dc) returned 0x1
	[0085.851] GetFileType (hFile=0x5dc) returned 0x1
	[0085.851] WriteFile (in: hFile=0x5dc, lpBuffer=0x2531844*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2531844*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.851] CloseHandle (hObject=0x5dc) returned 1
	[0085.852] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.852] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0085.852] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.852] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.852] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.853] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.853] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0085.853] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.853] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.853] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.853] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.853] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.853] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.853] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.853] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.853] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.854] GetFileType (hFile=0x5dc) returned 0x1
	[0085.854] GetFileType (hFile=0x5dc) returned 0x1
	[0085.854] WriteFile (in: hFile=0x5dc, lpBuffer=0x253597c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253597c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.855] CloseHandle (hObject=0x5dc) returned 1
	[0085.855] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.855] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0085.855] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.855] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2270dc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.855] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.855] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.856] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0085.856] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.856] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0085.856] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.856] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2270dc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.856] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.856] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.856] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0085.856] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.856] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.857] GetFileType (hFile=0x5dc) returned 0x1
	[0085.857] GetFileType (hFile=0x5dc) returned 0x1
	[0085.857] WriteFile (in: hFile=0x5dc, lpBuffer=0x2539ab4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2539ab4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.858] CloseHandle (hObject=0x5dc) returned 1
	[0085.858] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.858] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0085.859] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.859] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.859] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.859] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.859] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0085.859] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.859] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0085.859] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.859] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.859] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.860] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.860] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0085.860] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.860] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.860] GetFileType (hFile=0x5dc) returned 0x1
	[0085.860] GetFileType (hFile=0x5dc) returned 0x1
	[0085.860] WriteFile (in: hFile=0x5dc, lpBuffer=0x253dbec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253dbec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.861] CloseHandle (hObject=0x5dc) returned 1
	[0085.861] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.861] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0085.862] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.862] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d244069, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.862] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.862] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.862] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0085.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.862] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0085.862] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.863] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d244069, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.863] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.863] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.863] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0085.863] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.863] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.863] GetFileType (hFile=0x5dc) returned 0x1
	[0085.863] GetFileType (hFile=0x5dc) returned 0x1
	[0085.863] WriteFile (in: hFile=0x5dc, lpBuffer=0x2541d24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2541d24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.864] CloseHandle (hObject=0x5dc) returned 1
	[0085.864] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.864] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0085.865] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.865] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.865] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.865] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0085.865] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0085.865] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov", lpFilePart=0x0) returned 0x51
	[0085.865] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.865] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.866] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0085.866] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0085.866] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.866] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.866] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0085.866] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.972] GetFileType (hFile=0x5dc) returned 0x1
	[0085.972] GetFileType (hFile=0x5dc) returned 0x1
	[0085.972] WriteFile (in: hFile=0x5dc, lpBuffer=0x2545f40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2545f40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.973] CloseHandle (hObject=0x5dc) returned 1
	[0085.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x31
	[0085.973] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.973] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.973] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0085.974] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.974] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.974] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x31
	[0085.974] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.974] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.974] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0085.974] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0
	[0085.974] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.974] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0085.974] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.974] GetFileType (hFile=0x5dc) returned 0x1
	[0085.975] GetFileType (hFile=0x5dc) returned 0x1
	[0085.975] WriteFile (in: hFile=0x5dc, lpBuffer=0x2549584*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2549584*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.975] CloseHandle (hObject=0x5dc) returned 1
	[0085.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x29
	[0085.976] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb99ea4ee, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0085.979] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb99ea4ee, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.979] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb99ea4ee, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.979] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0085.979] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x29
	[0085.979] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb99ea4ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb99ea4ee, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0085.979] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb99ea4ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb99ea4ee, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.979] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb99ea4ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb99ea4ee, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0085.979] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0085.980] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0085.980] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\temp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.981] GetFileType (hFile=0x5dc) returned 0x1
	[0085.981] GetFileType (hFile=0x5dc) returned 0x1
	[0085.981] WriteFile (in: hFile=0x5dc, lpBuffer=0x254c798*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254c798*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.981] CloseHandle (hObject=0x5dc) returned 1
	[0085.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c
	[0085.982] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.982] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.982] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.982] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.982] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0085.982] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c
	[0085.983] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0085.983] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.983] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.983] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.983] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.983] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0085.983] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x78
	[0085.983] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.983] GetFileType (hFile=0x5dc) returned 0x1
	[0085.983] GetFileType (hFile=0x5dc) returned 0x1
	[0085.983] WriteFile (in: hFile=0x5dc, lpBuffer=0x25510e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25510e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.984] CloseHandle (hObject=0x5dc) returned 1
	[0085.984] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x71
	[0085.984] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0085.985] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.985] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.985] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.985] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0085.985] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0085.985] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x71
	[0085.985] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.985] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.985] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.985] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.985] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.985] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.986] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7d
	[0085.986] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.986] GetFileType (hFile=0x5dc) returned 0x1
	[0085.986] GetFileType (hFile=0x5dc) returned 0x1
	[0085.986] WriteFile (in: hFile=0x5dc, lpBuffer=0x2555b90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2555b90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.987] CloseHandle (hObject=0x5dc) returned 1
	[0085.987] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6d
	[0085.987] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0085.987] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.987] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.987] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.987] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0085.988] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0085.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6d
	[0085.988] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0085.988] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.988] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.988] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.988] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.988] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0085.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x79
	[0085.988] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.989] GetFileType (hFile=0x5dc) returned 0x1
	[0085.989] GetFileType (hFile=0x5dc) returned 0x1
	[0085.989] WriteFile (in: hFile=0x5dc, lpBuffer=0x255a500*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255a500*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.990] CloseHandle (hObject=0x5dc) returned 1
	[0085.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x70
	[0085.990] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0085.990] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.990] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.990] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.991] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0085.991] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0085.991] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x70
	[0085.991] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0085.991] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.991] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.991] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.991] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.991] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0085.991] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7c
	[0085.991] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.992] GetFileType (hFile=0x5dc) returned 0x1
	[0085.992] GetFileType (hFile=0x5dc) returned 0x1
	[0085.992] WriteFile (in: hFile=0x5dc, lpBuffer=0x255ef78*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255ef78*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.992] CloseHandle (hObject=0x5dc) returned 1
	[0085.993] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6f
	[0085.993] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0085.993] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.993] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.993] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.993] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0085.993] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0085.993] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6f
	[0085.993] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0085.993] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.993] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.993] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.993] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.994] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0085.994] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7b
	[0085.994] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.994] GetFileType (hFile=0x5dc) returned 0x1
	[0085.994] GetFileType (hFile=0x5dc) returned 0x1
	[0085.994] WriteFile (in: hFile=0x5dc, lpBuffer=0x2563968*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2563968*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.995] CloseHandle (hObject=0x5dc) returned 1
	[0085.995] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x71
	[0085.995] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0085.995] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.995] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abe5b00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x8abe5b00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x8abe5b00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.995] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.995] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0085.995] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0085.995] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x71
	[0085.995] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0085.996] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.996] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abe5b00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x8abe5b00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x8abe5b00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.996] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.996] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.996] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0085.996] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7d
	[0085.996] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.997] GetFileType (hFile=0x5dc) returned 0x1
	[0085.997] GetFileType (hFile=0x5dc) returned 0x1
	[0085.997] WriteFile (in: hFile=0x5dc, lpBuffer=0x2568410*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2568410*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0085.997] CloseHandle (hObject=0x5dc) returned 1
	[0085.998] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6e
	[0085.998] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0085.998] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.998] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d2e00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x898d2e00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x898d2e00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.998] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.998] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0085.998] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0085.998] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6e
	[0085.998] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0085.998] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.998] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d2e00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x898d2e00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x898d2e00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0085.998] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0085.998] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.999] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0085.999] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7a
	[0085.999] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0085.999] GetFileType (hFile=0x5dc) returned 0x1
	[0085.999] GetFileType (hFile=0x5dc) returned 0x1
	[0085.999] WriteFile (in: hFile=0x5dc, lpBuffer=0x256cde0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256cde0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.000] CloseHandle (hObject=0x5dc) returned 1
	[0086.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x6f
	[0086.000] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0086.000] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.000] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1a600, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x98d1a600, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x98d1a600, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0086.000] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0086.000] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0086.000] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0086.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x6f
	[0086.000] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0086.000] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.001] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1a600, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x98d1a600, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x98d1a600, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0086.001] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0086.001] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0086.001] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0086.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7b
	[0086.001] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0086.073] GetFileType (hFile=0x5dc) returned 0x1
	[0086.073] GetFileType (hFile=0x5dc) returned 0x1
	[0086.074] WriteFile (in: hFile=0x5dc, lpBuffer=0x2571808*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2571808*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.074] CloseHandle (hObject=0x5dc) returned 1
	[0086.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c
	[0086.075] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0086.075] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.075] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966f4c00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x966f4c00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x966f4c00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0086.075] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0086.075] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0086.075] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0086.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c
	[0086.075] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0086.075] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.075] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966f4c00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x966f4c00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x966f4c00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0086.075] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0086.076] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0086.076] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0086.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x78
	[0086.076] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0086.076] GetFileType (hFile=0x5dc) returned 0x1
	[0086.076] GetFileType (hFile=0x5dc) returned 0x1
	[0086.076] WriteFile (in: hFile=0x5dc, lpBuffer=0x2576158*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2576158*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.077] CloseHandle (hObject=0x5dc) returned 1
	[0086.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6e
	[0086.077] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0086.077] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.077] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bd6800, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xa4bd6800, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa4bd6800, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0086.077] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0086.077] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0086.077] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0086.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6e
	[0086.077] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0086.078] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.078] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bd6800, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xa4bd6800, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa4bd6800, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0086.078] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0086.470] WriteFile (in: hFile=0x5dc, lpBuffer=0x249d340*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x249d340*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.473] WriteFile (in: hFile=0x5dc, lpBuffer=0x24a2358*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24a2358*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.475] WriteFile (in: hFile=0x5dc, lpBuffer=0x24a714c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24a714c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.477] WriteFile (in: hFile=0x5dc, lpBuffer=0x24ab340*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ab340*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.478] WriteFile (in: hFile=0x5dc, lpBuffer=0x24af3d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24af3d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.480] WriteFile (in: hFile=0x5dc, lpBuffer=0x24b2fcc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b2fcc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.481] WriteFile (in: hFile=0x5dc, lpBuffer=0x24b6ba4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b6ba4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.483] WriteFile (in: hFile=0x5dc, lpBuffer=0x24bb020*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24bb020*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.485] WriteFile (in: hFile=0x5dc, lpBuffer=0x24bf640*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24bf640*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.486] WriteFile (in: hFile=0x5dc, lpBuffer=0x24c3cd8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c3cd8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.488] WriteFile (in: hFile=0x5dc, lpBuffer=0x24c79d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c79d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.490] WriteFile (in: hFile=0x5dc, lpBuffer=0x24ccd0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ccd0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.491] WriteFile (in: hFile=0x5dc, lpBuffer=0x24d1a74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d1a74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.493] WriteFile (in: hFile=0x5dc, lpBuffer=0x24e8dfc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e8dfc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.495] WriteFile (in: hFile=0x5dc, lpBuffer=0x24ec7c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ec7c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.496] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f0fb8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f0fb8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.498] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f47e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f47e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.499] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f816c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f816c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.501] WriteFile (in: hFile=0x5dc, lpBuffer=0x24fc2d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24fc2d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.502] WriteFile (in: hFile=0x5dc, lpBuffer=0x24ffc80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24ffc80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.504] WriteFile (in: hFile=0x5dc, lpBuffer=0x2503db8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2503db8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.505] WriteFile (in: hFile=0x5dc, lpBuffer=0x2507ef0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2507ef0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.507] WriteFile (in: hFile=0x5dc, lpBuffer=0x250c028*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250c028*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.508] WriteFile (in: hFile=0x5dc, lpBuffer=0x2510160*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2510160*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.510] WriteFile (in: hFile=0x5dc, lpBuffer=0x2517c40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2517c40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.511] WriteFile (in: hFile=0x5dc, lpBuffer=0x251c660*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251c660*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.513] WriteFile (in: hFile=0x5dc, lpBuffer=0x2520798*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2520798*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.514] WriteFile (in: hFile=0x5dc, lpBuffer=0x25248d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25248d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.516] WriteFile (in: hFile=0x5dc, lpBuffer=0x2528a08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2528a08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.588] WriteFile (in: hFile=0x5dc, lpBuffer=0x2531ff8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2531ff8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.590] WriteFile (in: hFile=0x5dc, lpBuffer=0x2535a30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2535a30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.592] WriteFile (in: hFile=0x5dc, lpBuffer=0x25396f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25396f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.593] WriteFile (in: hFile=0x5dc, lpBuffer=0x253d020*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253d020*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.595] WriteFile (in: hFile=0x5dc, lpBuffer=0x2541158*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2541158*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.599] WriteFile (in: hFile=0x5dc, lpBuffer=0x25456ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25456ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.601] WriteFile (in: hFile=0x5dc, lpBuffer=0x25494d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25494d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.603] WriteFile (in: hFile=0x5dc, lpBuffer=0x254cd10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254cd10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.625] WriteFile (in: hFile=0x5dc, lpBuffer=0x2550c7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2550c7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.626] WriteFile (in: hFile=0x5dc, lpBuffer=0x25558f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25558f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.628] WriteFile (in: hFile=0x5dc, lpBuffer=0x255a518*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255a518*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.637] WriteFile (in: hFile=0x5dc, lpBuffer=0x255f138*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255f138*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.639] WriteFile (in: hFile=0x5dc, lpBuffer=0x2563d4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2563d4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.640] WriteFile (in: hFile=0x5dc, lpBuffer=0x2568944*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2568944*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.642] WriteFile (in: hFile=0x5dc, lpBuffer=0x256d5ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256d5ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.643] WriteFile (in: hFile=0x5dc, lpBuffer=0x2572260*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2572260*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.645] WriteFile (in: hFile=0x5dc, lpBuffer=0x2576e88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2576e88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.646] WriteFile (in: hFile=0x5dc, lpBuffer=0x257bca4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257bca4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.648] WriteFile (in: hFile=0x5dc, lpBuffer=0x25805e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25805e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.649] WriteFile (in: hFile=0x5dc, lpBuffer=0x2584f2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2584f2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.651] WriteFile (in: hFile=0x5dc, lpBuffer=0x2589870*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2589870*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.652] WriteFile (in: hFile=0x5dc, lpBuffer=0x258e254*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258e254*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.653] WriteFile (in: hFile=0x5dc, lpBuffer=0x2592b98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2592b98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.655] WriteFile (in: hFile=0x5dc, lpBuffer=0x25974dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25974dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.656] WriteFile (in: hFile=0x5dc, lpBuffer=0x259bec0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259bec0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.738] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a08cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a08cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.740] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a5210*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a5210*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.742] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a9bf4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a9bf4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.744] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ad5c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ad5c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.745] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b0bbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b0bbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511db20) returned 1
	[0086.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0086.756] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates", lpFilePart=0x0) returned 0x2f
	[0086.756] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0086.756] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.757] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bec9ddc, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6bec9ddc, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0086.757] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4771, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopSettings2013.xml", cAlternateFileName="")) returned 1
	[0086.757] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x173d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EaseOfAccessSettings2013.xml", cAlternateFileName="")) returned 1
	[0086.757] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc27, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013.xml", cAlternateFileName="")) returned 1
	[0086.757] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013Backup.xml", cAlternateFileName="")) returned 1
	[0086.757] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2010.xml", cAlternateFileName="")) returned 1
	[0086.758] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win32.xml", cAlternateFileName="")) returned 1
	[0086.758] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win64.xml", cAlternateFileName="")) returned 1
	[0086.758] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftNotepad.xml", cAlternateFileName="")) returned 1
	[0086.758] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win32.xml", cAlternateFileName="")) returned 1
	[0086.758] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win64.xml", cAlternateFileName="")) returned 1
	[0086.759] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin32.xml", cAlternateFileName="")) returned 1
	[0086.759] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin64.xml", cAlternateFileName="")) returned 1
	[0086.759] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win32.xml", cAlternateFileName="")) returned 1
	[0086.759] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win64.xml", cAlternateFileName="")) returned 1
	[0086.759] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win32.xml", cAlternateFileName="")) returned 1
	[0086.759] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win64.xml", cAlternateFileName="")) returned 1
	[0086.760] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin32.xml", cAlternateFileName="")) returned 1
	[0086.760] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin64.xml", cAlternateFileName="")) returned 1
	[0086.760] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win32.xml", cAlternateFileName="")) returned 1
	[0086.760] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win64.xml", cAlternateFileName="")) returned 1
	[0086.760] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin32.xml", cAlternateFileName="")) returned 1
	[0086.760] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin64.xml", cAlternateFileName="")) returned 1
	[0086.761] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin32.xml", cAlternateFileName="")) returned 1
	[0086.761] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin64.xml", cAlternateFileName="")) returned 1
	[0086.761] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win32.xml", cAlternateFileName="")) returned 1
	[0086.761] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win64.xml", cAlternateFileName="")) returned 1
	[0086.761] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftWordpad.xml", cAlternateFileName="")) returned 1
	[0086.761] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkPrinters.xml", cAlternateFileName="")) returned 1
	[0086.762] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingCredentialSettings.xml", cAlternateFileName="")) returned 1
	[0086.762] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThemeSettings2013.xml", cAlternateFileName="")) returned 1
	[0086.762] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VdiState.xml", cAlternateFileName="")) returned 1
	[0086.762] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VdiState.xml", cAlternateFileName="")) returned 0
	[0086.762] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0086.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0086.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0086.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0086.763] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates", lpFilePart=0x0) returned 0x2f
	[0086.763] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x6bec9ddc, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0086.763] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x6bec9ddc, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.763] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bec9ddc, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6bec9ddc, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0086.763] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4771, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopSettings2013.xml", cAlternateFileName="")) returned 1
	[0086.764] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x173d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EaseOfAccessSettings2013.xml", cAlternateFileName="")) returned 1
	[0086.764] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc27, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013.xml", cAlternateFileName="")) returned 1
	[0086.764] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013Backup.xml", cAlternateFileName="")) returned 1
	[0086.764] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2010.xml", cAlternateFileName="")) returned 1
	[0086.764] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win32.xml", cAlternateFileName="")) returned 1
	[0086.764] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win64.xml", cAlternateFileName="")) returned 1
	[0086.764] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftNotepad.xml", cAlternateFileName="")) returned 1
	[0086.765] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win32.xml", cAlternateFileName="")) returned 1
	[0086.765] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win64.xml", cAlternateFileName="")) returned 1
	[0086.765] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin32.xml", cAlternateFileName="")) returned 1
	[0086.765] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin64.xml", cAlternateFileName="")) returned 1
	[0086.765] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win32.xml", cAlternateFileName="")) returned 1
	[0086.765] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win64.xml", cAlternateFileName="")) returned 1
	[0086.765] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win32.xml", cAlternateFileName="")) returned 1
	[0086.765] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win64.xml", cAlternateFileName="")) returned 1
	[0086.766] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin32.xml", cAlternateFileName="")) returned 1
	[0086.766] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin64.xml", cAlternateFileName="")) returned 1
	[0086.766] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win32.xml", cAlternateFileName="")) returned 1
	[0086.766] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win64.xml", cAlternateFileName="")) returned 1
	[0086.766] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin32.xml", cAlternateFileName="")) returned 1
	[0086.766] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin64.xml", cAlternateFileName="")) returned 1
	[0086.766] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin32.xml", cAlternateFileName="")) returned 1
	[0086.766] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin64.xml", cAlternateFileName="")) returned 1
	[0086.767] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win32.xml", cAlternateFileName="")) returned 1
	[0086.767] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win64.xml", cAlternateFileName="")) returned 1
	[0086.767] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftWordpad.xml", cAlternateFileName="")) returned 1
	[0086.767] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkPrinters.xml", cAlternateFileName="")) returned 1
	[0086.767] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingCredentialSettings.xml", cAlternateFileName="")) returned 1
	[0086.767] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThemeSettings2013.xml", cAlternateFileName="")) returned 1
	[0086.767] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VdiState.xml", cAlternateFileName="")) returned 1
	[0086.767] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0086.768] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0086.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0086.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0086.768] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0086.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0086.768] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0086.769] GetFileType (hFile=0x5dc) returned 0x1
	[0086.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0086.769] GetFileType (hFile=0x5dc) returned 0x1
	[0086.769] WriteFile (in: hFile=0x5dc, lpBuffer=0x25bdf8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bdf8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.770] CloseHandle (hObject=0x5dc) returned 1
	[0086.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0086.770] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts", lpFilePart=0x0) returned 0x28
	[0086.770] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0086.770] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.770] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bec9ddc, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6bec9ddc, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0086.770] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterInboxTemplates.ps1", cAlternateFileName="")) returned 1
	[0086.771] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterInboxTemplates.ps1", cAlternateFileName="")) returned 0
	[0086.771] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0086.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0086.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0086.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0086.771] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts", lpFilePart=0x0) returned 0x28
	[0086.771] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x6bec9ddc, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0086.771] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x6bec9ddc, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.771] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bec9ddc, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6bec9ddc, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0086.771] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterInboxTemplates.ps1", cAlternateFileName="")) returned 1
	[0086.771] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0086.772] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0086.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0086.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0086.772] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0086.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0086.772] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\uev\\scripts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0086.772] GetFileType (hFile=0x5dc) returned 0x1
	[0086.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0086.773] GetFileType (hFile=0x5dc) returned 0x1
	[0086.773] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c1798*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c1798*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.773] CloseHandle (hObject=0x5dc) returned 1
	[0086.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0086.774] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Templates", lpFilePart=0x0) returned 0x2a
	[0086.774] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0086.774] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.774] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bec9ddc, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6bec9ddc, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0086.774] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x25ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate.xsd", cAlternateFileName="")) returned 1
	[0086.774] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013.xsd", cAlternateFileName="")) returned 1
	[0086.774] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013A.xsd", cAlternateFileName="")) returned 1
	[0086.774] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013A.xsd", cAlternateFileName="")) returned 0
	[0086.775] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0086.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0086.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0086.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0086.775] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Templates", lpFilePart=0x0) returned 0x2a
	[0086.775] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x6bec9ddc, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0086.775] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x6bec9ddc, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.775] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bec9ddc, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6bec9ddc, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bec9ddc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0086.775] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x25ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate.xsd", cAlternateFileName="")) returned 1
	[0086.775] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013.xsd", cAlternateFileName="")) returned 1
	[0086.775] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013A.xsd", cAlternateFileName="")) returned 1
	[0086.776] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0086.776] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0086.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0086.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0086.776] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0086.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0086.776] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0086.777] GetFileType (hFile=0x5dc) returned 0x1
	[0086.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0086.777] GetFileType (hFile=0x5dc) returned 0x1
	[0086.777] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c5788*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c5788*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.777] CloseHandle (hObject=0x5dc) returned 1
	[0086.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0086.778] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204", lpFilePart=0x0) returned 0x47
	[0086.778] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0086.778] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.778] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", cAlternateFileName="154E23~1.VSC")) returned 1
	[0086.778] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", cAlternateFileName="2F1A65~1.VSC")) returned 1
	[0086.778] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", cAlternateFileName="3CCD54~1.VSC")) returned 1
	[0086.778] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bef0040, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6bef0040, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0086.779] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 1
	[0086.779] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 0
	[0086.779] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0086.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0086.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0086.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0086.779] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204", lpFilePart=0x0) returned 0x47
	[0086.779] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6bef0040, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0086.779] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6bef0040, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.779] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", cAlternateFileName="154E23~1.VSC")) returned 1
	[0086.779] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", cAlternateFileName="2F1A65~1.VSC")) returned 1
	[0086.780] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", cAlternateFileName="3CCD54~1.VSC")) returned 1
	[0086.780] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bef0040, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6bef0040, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0086.780] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 1
	[0086.780] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0086.780] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0086.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0086.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0086.780] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0086.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0086.780] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0086.781] GetFileType (hFile=0x5dc) returned 0x1
	[0086.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0086.781] GetFileType (hFile=0x5dc) returned 0x1
	[0086.781] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ca6a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ca6a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0086.782] CloseHandle (hObject=0x5dc) returned 1
	[0086.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0086.782] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server", lpFilePart=0x0) returned 0x2c
	[0086.782] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0086.782] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.782] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bef0040, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6bef0040, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0086.783] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bef0040, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6bef0040, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0086.977] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0086.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0086.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0086.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0086.997] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server", lpFilePart=0x0) returned 0x2c
	[0086.998] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6bef0040, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0086.998] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6bef0040, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0086.998] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bef0040, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6bef0040, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6bef0040, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0086.998] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0086.998] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0086.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0086.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0086.998] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\Decrypt.txt", lpFilePart=0x0) returned 0x38
	[0086.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0086.998] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\winmsipc\\server\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0086.999] GetFileType (hFile=0x5dc) returned 0x1
	[0086.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0086.999] GetFileType (hFile=0x5dc) returned 0x1
	[0086.999] WriteFile (in: hFile=0x5dc, lpBuffer=0x25cdc2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cdc2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.000] CloseHandle (hObject=0x5dc) returned 1
	[0087.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.000] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles", lpFilePart=0x0) returned 0x2f
	[0087.000] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0087.000] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.001] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0087.001] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0087.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.001] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles", lpFilePart=0x0) returned 0x2f
	[0087.001] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0087.001] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.001] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0087.033] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0087.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.033] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0087.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.034] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\dmprofiles\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0087.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511db20) returned 1
	[0087.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.035] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x2d
	[0087.035] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0087.035] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.035] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0087.035] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0087.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.036] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x2d
	[0087.036] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0087.036] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.036] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0087.036] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0087.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.036] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0087.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.036] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\profiles\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0087.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511db20) returned 1
	[0087.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.037] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage", lpFilePart=0x0) returned 0x30
	[0087.038] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c0b4715, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0087.038] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c0b4715, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.038] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 1
	[0087.038] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c0b4715, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0b4715, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0b8248, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.038] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c0b4715, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0b4715, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0b8248, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0087.038] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0087.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.038] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage", lpFilePart=0x0) returned 0x30
	[0087.039] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0b4715, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0b4715, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0087.039] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0b4715, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0b4715, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.039] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 1
	[0087.039] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c0b4715, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0b4715, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0b8248, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.039] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.039] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0087.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.039] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0087.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.039] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\Decrypt.txt" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.040] GetFileType (hFile=0x5dc) returned 0x1
	[0087.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.040] GetFileType (hFile=0x5dc) returned 0x1
	[0087.040] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d3a4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d3a4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.041] CloseHandle (hObject=0x5dc) returned 1
	[0087.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.041] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64", lpFilePart=0x0) returned 0x2f
	[0087.041] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x6c0c0a9d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0087.041] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x6c0c0a9d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.041] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 1
	[0087.042] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c0c0a9d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0c0a9d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c456d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.042] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c0c0a9d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0c0a9d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c456d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0087.042] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0087.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.042] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64", lpFilePart=0x0) returned 0x2f
	[0087.042] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c0a9d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c0a9d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0087.042] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c0a9d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c0a9d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.042] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 1
	[0087.042] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c0c0a9d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0c0a9d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c456d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.043] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.043] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0087.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.043] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0087.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.043] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\Decrypt.txt" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.044] GetFileType (hFile=0x5dc) returned 0x1
	[0087.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.044] GetFileType (hFile=0x5dc) returned 0x1
	[0087.044] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d7370*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d7370*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.044] CloseHandle (hObject=0x5dc) returned 1
	[0087.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.045] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x27
	[0087.045] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0087.045] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.045] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c0c933b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.045] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1
	[0087.045] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1
	[0087.045] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1
	[0087.045] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 0
	[0087.045] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0087.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.046] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x27
	[0087.046] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0087.046] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.046] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c0c933b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.046] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1
	[0087.046] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1
	[0087.046] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1
	[0087.046] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.046] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0087.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.047] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\javapath\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0087.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.047] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\Decrypt.txt" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.047] GetFileType (hFile=0x5dc) returned 0x1
	[0087.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.047] GetFileType (hFile=0x5dc) returned 0x1
	[0087.047] WriteFile (in: hFile=0x5dc, lpBuffer=0x25daf0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25daf0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.048] CloseHandle (hObject=0x5dc) returned 1
	[0087.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.049] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984", lpFilePart=0x0) returned 0x35
	[0087.049] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0087.049] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.049] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c0c933b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6e381a17, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.049] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1
	[0087.049] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1
	[0087.049] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1
	[0087.049] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 0
	[0087.049] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0087.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.050] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984", lpFilePart=0x0) returned 0x35
	[0087.050] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0087.050] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0c933b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.050] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c0c933b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0c933b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6e381a17, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.050] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1
	[0087.050] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1
	[0087.050] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1
	[0087.050] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.050] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0087.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.051] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0087.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.051] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\Decrypt.txt" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.051] GetFileType (hFile=0x5dc) returned 0x1
	[0087.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.051] GetFileType (hFile=0x5dc) returned 0x1
	[0087.051] WriteFile (in: hFile=0x5dc, lpBuffer=0x25def08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25def08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.052] CloseHandle (hObject=0x5dc) returned 1
	[0087.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.052] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0087.052] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0087.052] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.053] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0ef817, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0ef817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.053] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.053] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.053] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0087.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.053] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0087.053] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c0ef817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0087.053] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c0ef817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.053] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0ef817, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0ef817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.054] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.054] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0087.054] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0087.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.054] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0087.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.054] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.055] GetFileType (hFile=0x5dc) returned 0x1
	[0087.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.055] GetFileType (hFile=0x5dc) returned 0x1
	[0087.055] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e33dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e33dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.055] CloseHandle (hObject=0x5dc) returned 1
	[0087.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.056] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0087.056] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0087.056] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.056] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0ef817, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0ef817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.056] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.056] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.056] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0087.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.057] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0087.057] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c0ef817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0087.057] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c0ef817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.057] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0ef817, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0ef817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.057] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.057] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0087.057] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0087.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.057] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0087.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.057] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.058] GetFileType (hFile=0x5dc) returned 0x1
	[0087.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.058] GetFileType (hFile=0x5dc) returned 0x1
	[0087.058] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e78e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e78e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.059] CloseHandle (hObject=0x5dc) returned 1
	[0087.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.059] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0087.059] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0087.059] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.059] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0ef817, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0ef817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.060] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.060] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.060] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0087.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.060] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0087.060] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c0ef817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0087.060] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c0ef817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.060] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0ef817, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c0ef817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c0ef817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.060] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.061] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0087.061] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0087.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0087.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.061] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.061] GetFileType (hFile=0x5dc) returned 0x1
	[0087.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.062] GetFileType (hFile=0x5dc) returned 0x1
	[0087.062] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ebe1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ebe1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.062] CloseHandle (hObject=0x5dc) returned 1
	[0087.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.062] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0087.063] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0087.063] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.063] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1ae597, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.063] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.063] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.063] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0087.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.063] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0087.063] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0087.064] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.064] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1ae597, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.064] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.173] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0087.173] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0087.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.173] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0087.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.173] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.200] GetFileType (hFile=0x5dc) returned 0x1
	[0087.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.201] GetFileType (hFile=0x5dc) returned 0x1
	[0087.201] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f04f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f04f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.201] CloseHandle (hObject=0x5dc) returned 1
	[0087.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.202] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0087.202] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0087.202] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.202] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1ae597, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.202] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.202] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.202] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0087.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.203] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0087.203] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0087.203] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.203] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1ae597, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.203] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.203] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0087.203] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0087.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.203] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0087.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.204] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.204] GetFileType (hFile=0x5dc) returned 0x1
	[0087.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.204] GetFileType (hFile=0x5dc) returned 0x1
	[0087.204] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f4a40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f4a40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.206] CloseHandle (hObject=0x5dc) returned 1
	[0087.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.206] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0087.206] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0087.206] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.206] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1ae597, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.206] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.207] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.207] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0087.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.207] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0087.207] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0087.207] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.207] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1ae597, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.207] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.207] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0087.208] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0087.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.208] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0087.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.208] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.208] GetFileType (hFile=0x5dc) returned 0x1
	[0087.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.208] GetFileType (hFile=0x5dc) returned 0x1
	[0087.209] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f8f4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f8f4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.209] CloseHandle (hObject=0x5dc) returned 1
	[0087.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.210] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0087.210] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0087.210] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.210] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1ae597, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.210] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.210] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.210] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0087.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.210] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0087.210] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0087.211] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.211] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1ae597, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1ae597, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1ae597, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.211] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.211] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0087.211] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0087.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.211] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0087.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.211] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.212] GetFileType (hFile=0x5dc) returned 0x1
	[0087.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.212] GetFileType (hFile=0x5dc) returned 0x1
	[0087.212] WriteFile (in: hFile=0x5dc, lpBuffer=0x25fd43c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fd43c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.213] CloseHandle (hObject=0x5dc) returned 1
	[0087.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.213] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0087.213] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0087.213] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.213] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1d4716, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.213] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.214] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.214] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0087.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.214] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0087.214] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0087.214] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.214] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1d4716, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.214] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.214] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0087.214] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0087.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.215] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0087.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.215] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.215] GetFileType (hFile=0x5dc) returned 0x1
	[0087.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.215] GetFileType (hFile=0x5dc) returned 0x1
	[0087.215] WriteFile (in: hFile=0x5dc, lpBuffer=0x260192c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260192c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.216] CloseHandle (hObject=0x5dc) returned 1
	[0087.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.216] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0087.216] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0087.217] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.217] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1d4716, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.217] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.217] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.217] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0087.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.217] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0087.217] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0087.217] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.217] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1d4716, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.217] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.218] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0087.218] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0087.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0087.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.218] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.218] GetFileType (hFile=0x5dc) returned 0x1
	[0087.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.219] GetFileType (hFile=0x5dc) returned 0x1
	[0087.219] WriteFile (in: hFile=0x5dc, lpBuffer=0x2605e00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2605e00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.219] CloseHandle (hObject=0x5dc) returned 1
	[0087.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.220] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0087.220] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0087.220] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.220] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1d4716, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.220] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.220] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.220] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0087.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.221] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0087.221] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0087.221] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.221] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1d4716, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.221] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.221] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0087.221] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0087.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.221] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0087.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.221] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.222] GetFileType (hFile=0x5dc) returned 0x1
	[0087.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.222] GetFileType (hFile=0x5dc) returned 0x1
	[0087.222] WriteFile (in: hFile=0x5dc, lpBuffer=0x260a2f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260a2f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.223] CloseHandle (hObject=0x5dc) returned 1
	[0087.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.223] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0087.223] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0087.223] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.223] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1d4716, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.223] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.223] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.224] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0087.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.224] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0087.224] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0087.224] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.224] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1d4716, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.224] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.224] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0087.224] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0087.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.224] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0087.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.224] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.225] GetFileType (hFile=0x5dc) returned 0x1
	[0087.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.225] GetFileType (hFile=0x5dc) returned 0x1
	[0087.225] WriteFile (in: hFile=0x5dc, lpBuffer=0x260e86c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260e86c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.226] CloseHandle (hObject=0x5dc) returned 1
	[0087.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.226] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0087.226] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0087.226] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.226] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1d4716, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.227] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.227] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.227] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0087.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.227] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0087.227] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0087.227] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.227] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1d4716, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6c1d4716, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6c1d4716, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0087.227] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0087.227] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0087.227] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0087.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.228] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0087.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.228] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.231] GetFileType (hFile=0x5dc) returned 0x1
	[0087.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.231] GetFileType (hFile=0x5dc) returned 0x1
	[0087.231] WriteFile (in: hFile=0x5dc, lpBuffer=0x2612d5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2612d5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.232] CloseHandle (hObject=0x5dc) returned 1
	[0087.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.232] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x2f
	[0087.232] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0087.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0087.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.233] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x2f
	[0087.233] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0087.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0087.234] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Application Data\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0087.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.235] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\application data\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.235] GetFileType (hFile=0x5dc) returned 0x1
	[0087.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.235] GetFileType (hFile=0x5dc) returned 0x1
	[0087.235] WriteFile (in: hFile=0x5dc, lpBuffer=0x2616028*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2616028*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.316] CloseHandle (hObject=0x5dc) returned 1
	[0087.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.316] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\History", lpFilePart=0x0) returned 0x26
	[0087.316] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0087.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0087.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.317] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\History", lpFilePart=0x0) returned 0x26
	[0087.317] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0087.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0087.319] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\History\\Decrypt.txt", lpFilePart=0x0) returned 0x32
	[0087.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.319] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\history\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.326] GetFileType (hFile=0x5dc) returned 0x1
	[0087.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.326] GetFileType (hFile=0x5dc) returned 0x1
	[0087.326] WriteFile (in: hFile=0x5dc, lpBuffer=0x261929c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261929c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.327] CloseHandle (hObject=0x5dc) returned 1
	[0087.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.327] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x28
	[0087.327] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3af063e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0087.327] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3af063e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.328] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa27e7c13, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa27e7c13, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1
	[0087.328] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0087.328] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c89cf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9e2bf1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0087.328] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsApps", cAlternateFileName="WINDOW~2")) returned 1
	[0087.328] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.328] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0087.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.328] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x28
	[0087.328] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3af063e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0087.328] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3af063e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.329] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa27e7c13, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa27e7c13, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1
	[0087.329] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0087.329] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c89cf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9e2bf1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0087.329] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsApps", cAlternateFileName="WINDOW~2")) returned 1
	[0087.329] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsApps", cAlternateFileName="WINDOW~2")) returned 0
	[0087.329] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0087.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.329] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0087.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.330] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.330] GetFileType (hFile=0x5dc) returned 0x1
	[0087.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.330] GetFileType (hFile=0x5dc) returned 0x1
	[0087.330] WriteFile (in: hFile=0x5dc, lpBuffer=0x261d040*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261d040*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.331] CloseHandle (hObject=0x5dc) returned 1
	[0087.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.331] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x23
	[0087.331] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0087.332] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.332] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0087.332] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0087.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.332] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x23
	[0087.332] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0087.332] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.333] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0087.333] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0087.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.333] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0087.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.333] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.333] GetFileType (hFile=0x5dc) returned 0x1
	[0087.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.333] GetFileType (hFile=0x5dc) returned 0x1
	[0087.333] WriteFile (in: hFile=0x5dc, lpBuffer=0x2620134*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2620134*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.334] CloseHandle (hObject=0x5dc) returned 1
	[0087.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.334] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x37
	[0087.334] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0087.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0087.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.335] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x37
	[0087.335] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0087.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0087.337] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0087.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.337] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\temporary internet files\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.337] GetFileType (hFile=0x5dc) returned 0x1
	[0087.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.337] GetFileType (hFile=0x5dc) returned 0x1
	[0087.337] WriteFile (in: hFile=0x5dc, lpBuffer=0x2623520*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2623520*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.338] CloseHandle (hObject=0x5dc) returned 1
	[0087.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.338] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2a
	[0087.338] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0087.339] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.339] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c8d333, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0087.339] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1
	[0087.339] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0087.339] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.339] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0087.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.339] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2a
	[0087.339] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0087.340] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.340] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c8d333, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0087.340] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1
	[0087.340] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0087.340] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0
	[0087.340] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0087.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.340] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0087.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.340] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.341] GetFileType (hFile=0x5dc) returned 0x1
	[0087.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.341] GetFileType (hFile=0x5dc) returned 0x1
	[0087.341] WriteFile (in: hFile=0x5dc, lpBuffer=0x2626f9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2626f9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.341] CloseHandle (hObject=0x5dc) returned 1
	[0087.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.342] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x31
	[0087.342] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0087.342] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.342] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0087.342] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.342] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0087.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.342] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x31
	[0087.342] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0087.343] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.343] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0087.343] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0
	[0087.343] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0087.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.343] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0087.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.343] CreateFileW (lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\default.migrated\\appdata\\local\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.343] GetFileType (hFile=0x5dc) returned 0x1
	[0087.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.343] GetFileType (hFile=0x5dc) returned 0x1
	[0087.344] WriteFile (in: hFile=0x5dc, lpBuffer=0x262a5e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262a5e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.344] CloseHandle (hObject=0x5dc) returned 1
	[0087.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.344] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x28
	[0087.344] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0087.345] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.345] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0087.345] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0087.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x28
	[0087.345] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0087.345] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.346] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0087.346] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0087.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0087.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.346] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\activesync\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.347] GetFileType (hFile=0x5dc) returned 0x1
	[0087.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.347] GetFileType (hFile=0x5dc) returned 0x1
	[0087.347] WriteFile (in: hFile=0x5dc, lpBuffer=0x262d7e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262d7e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.347] CloseHandle (hObject=0x5dc) returned 1
	[0087.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x23
	[0087.348] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0087.348] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.349] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0087.349] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroCef", cAlternateFileName="")) returned 1
	[0087.349] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0087.349] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.349] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0087.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.349] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x23
	[0087.349] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0087.349] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.349] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0087.350] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroCef", cAlternateFileName="")) returned 1
	[0087.350] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0087.350] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0
	[0087.350] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0087.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.350] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0087.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.350] GetFileType (hFile=0x5dc) returned 0x1
	[0087.350] GetFileType (hFile=0x5dc) returned 0x1
	[0087.351] WriteFile (in: hFile=0x5dc, lpBuffer=0x2630f5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2630f5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.351] CloseHandle (hObject=0x5dc) returned 1
	[0087.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x2e
	[0087.351] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0087.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x2e
	[0087.353] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0087.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0087.354] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0087.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.354] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\application data\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.355] GetFileType (hFile=0x5dc) returned 0x1
	[0087.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.355] GetFileType (hFile=0x5dc) returned 0x1
	[0087.355] WriteFile (in: hFile=0x5dc, lpBuffer=0x2634228*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2634228*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.355] CloseHandle (hObject=0x5dc) returned 1
	[0087.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\CEF", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\CEF", lpFilePart=0x0) returned 0x21
	[0087.356] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0087.356] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.356] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1
	[0087.356] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.356] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0087.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\CEF", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\CEF", lpFilePart=0x0) returned 0x21
	[0087.356] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0087.357] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.357] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1
	[0087.357] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0
	[0087.357] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0087.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.357] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0087.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.357] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cef\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.357] GetFileType (hFile=0x5dc) returned 0x1
	[0087.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.357] GetFileType (hFile=0x5dc) returned 0x1
	[0087.357] WriteFile (in: hFile=0x5dc, lpBuffer=0x2637568*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2637568*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.358] CloseHandle (hObject=0x5dc) returned 1
	[0087.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.358] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x23
	[0087.358] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0087.361] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.442] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x476c0de7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0087.442] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d619041, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unistore", cAlternateFileName="")) returned 1
	[0087.442] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1
	[0087.442] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.442] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0087.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.443] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x23
	[0087.443] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0087.443] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.443] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x476c0de7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0087.444] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d619041, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unistore", cAlternateFileName="")) returned 1
	[0087.444] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1
	[0087.444] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 0
	[0087.444] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0087.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.444] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0087.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.444] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.447] GetFileType (hFile=0x5dc) returned 0x1
	[0087.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.447] GetFileType (hFile=0x5dc) returned 0x1
	[0087.447] WriteFile (in: hFile=0x5dc, lpBuffer=0x263af08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263af08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.448] CloseHandle (hObject=0x5dc) returned 1
	[0087.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.448] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform", lpFilePart=0x0) returned 0x36
	[0087.448] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0087.449] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.449] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x435d76fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDPGlobalSettings.cdp", cAlternateFileName="CDPGLO~1.CDP")) returned 1
	[0087.449] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x435d76fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDPGlobalSettings.cdp", cAlternateFileName="CDPGLO~1.CDP")) returned 0
	[0087.449] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0087.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.449] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform", lpFilePart=0x0) returned 0x36
	[0087.449] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0087.450] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.450] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x435d76fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDPGlobalSettings.cdp", cAlternateFileName="CDPGLO~1.CDP")) returned 1
	[0087.450] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.450] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0087.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\Decrypt.txt", lpFilePart=0x0) returned 0x42
	[0087.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.450] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.450] GetFileType (hFile=0x5dc) returned 0x1
	[0087.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.450] GetFileType (hFile=0x5dc) returned 0x1
	[0087.451] WriteFile (in: hFile=0x5dc, lpBuffer=0x263e7c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263e7c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.451] CloseHandle (hObject=0x5dc) returned 1
	[0087.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x24
	[0087.452] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0087.452] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.452] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x4aa60657, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1
	[0087.452] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0087.452] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.452] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0087.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x24
	[0087.453] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0087.453] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.453] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x4aa60657, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1
	[0087.453] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0087.453] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0
	[0087.453] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0087.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.453] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0087.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.454] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.454] GetFileType (hFile=0x5dc) returned 0x1
	[0087.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.454] GetFileType (hFile=0x5dc) returned 0x1
	[0087.455] WriteFile (in: hFile=0x5dc, lpBuffer=0x2641e30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2641e30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.456] CloseHandle (hObject=0x5dc) returned 1
	[0087.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.456] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\History", lpFilePart=0x0) returned 0x25
	[0087.456] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\History\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0087.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0087.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.458] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\History", lpFilePart=0x0) returned 0x25
	[0087.458] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\History\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0087.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0087.459] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\History\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\History\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0087.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\History\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\history\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.460] GetFileType (hFile=0x5dc) returned 0x1
	[0087.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.460] GetFileType (hFile=0x5dc) returned 0x1
	[0087.460] WriteFile (in: hFile=0x5dc, lpBuffer=0x2644f94*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2644f94*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.461] CloseHandle (hObject=0x5dc) returned 1
	[0087.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.461] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x27
	[0087.461] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0087.461] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.461] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff5a990, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v2.0", cAlternateFileName="")) returned 1
	[0087.461] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4005dd03, ftCreationTime.dwHighDateTime=0x1d3272c, ftLastAccessTime.dwLowDateTime=0x97043032, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x97043032, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0", cAlternateFileName="")) returned 1
	[0087.462] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8dfe9793, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8dfe9793, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8e0ce49a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0_32", cAlternateFileName="CLR_V4~1.0_3")) returned 1
	[0087.462] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x39c1605f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x646a5b18, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x646a5b18, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0087.462] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9153cde, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc9153cde, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc9153cde, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0087.462] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc5e206cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0087.462] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4373c58d, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc5e21595, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4373c58d, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0087.462] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8280f106, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x8280f106, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x8280f106, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1
	[0087.462] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc71f3a6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc5e719bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdeb2fb6c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameDVR", cAlternateFileName="")) returned 1
	[0087.462] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xabf27288, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xabf27288, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1
	[0087.462] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdee04858, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc5ea402c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdee04858, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallAgent", cAlternateFileName="INSTAL~1")) returned 1
	[0087.463] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cfd5892, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9b374a10, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x9b374a10, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0087.463] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabb473f3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3c685c43, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x3c685c43, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0087.463] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd0db3a8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa3009cf0, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xa3009cf0, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0087.463] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x91e02a2a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x91e02a2a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1
	[0087.463] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827c2c6b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xdc6aa62a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdc6aa62a, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1
	[0087.463] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd63cb27, ftCreationTime.dwHighDateTime=0x1d327b2, ftLastAccessTime.dwLowDateTime=0xdd63cb27, ftLastAccessTime.dwHighDateTime=0x1d327b2, ftLastWriteTime.dwLowDateTime=0xdd63cb27, ftLastWriteTime.dwHighDateTime=0x1d327b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PenWorkspace", cAlternateFileName="PENWOR~1")) returned 1
	[0087.463] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc7d69cc9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1
	[0087.463] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43ffd581, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x43ffd581, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x43ffd581, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0087.464] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeaeec2c4, ftCreationTime.dwHighDateTime=0x1d327d4, ftLastAccessTime.dwLowDateTime=0xeaeec2c4, ftLastAccessTime.dwHighDateTime=0x1d327d4, ftLastWriteTime.dwLowDateTime=0xeaeec2c4, ftLastWriteTime.dwHighDateTime=0x1d327d4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1
	[0087.464] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc7e3414f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfcc934a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1
	[0087.464] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbee6232d, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xbee6232d, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xbee6232d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1
	[0087.464] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9fa64c01, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x9fa64c01, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0087.464] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3e54fc1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc88b17c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd3e54fc1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~3")) returned 1
	[0087.464] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x306b22ce, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x306b22ce, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~2")) returned 1
	[0087.464] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsApps", cAlternateFileName="WINDOW~1")) returned 1
	[0087.464] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.465] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0087.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x27
	[0087.488] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0087.488] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.488] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff5a990, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v2.0", cAlternateFileName="")) returned 1
	[0087.488] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4005dd03, ftCreationTime.dwHighDateTime=0x1d3272c, ftLastAccessTime.dwLowDateTime=0x97043032, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x97043032, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0", cAlternateFileName="")) returned 1
	[0087.488] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8dfe9793, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8dfe9793, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8e0ce49a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0_32", cAlternateFileName="CLR_V4~1.0_3")) returned 1
	[0087.488] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x39c1605f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x646a5b18, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x646a5b18, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0087.488] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9153cde, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc9153cde, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc9153cde, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0087.489] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc5e206cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0087.489] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4373c58d, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc5e21595, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4373c58d, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0087.489] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8280f106, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x8280f106, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x8280f106, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1
	[0087.489] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc71f3a6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc5e719bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdeb2fb6c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameDVR", cAlternateFileName="")) returned 1
	[0087.489] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xabf27288, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xabf27288, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1
	[0087.489] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdee04858, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc5ea402c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdee04858, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallAgent", cAlternateFileName="INSTAL~1")) returned 1
	[0087.489] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cfd5892, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9b374a10, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x9b374a10, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0087.490] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabb473f3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3c685c43, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x3c685c43, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0087.490] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd0db3a8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa3009cf0, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xa3009cf0, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0087.490] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x91e02a2a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x91e02a2a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1
	[0087.490] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827c2c6b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xdc6aa62a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdc6aa62a, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1
	[0087.490] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd63cb27, ftCreationTime.dwHighDateTime=0x1d327b2, ftLastAccessTime.dwLowDateTime=0xdd63cb27, ftLastAccessTime.dwHighDateTime=0x1d327b2, ftLastWriteTime.dwLowDateTime=0xdd63cb27, ftLastWriteTime.dwHighDateTime=0x1d327b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PenWorkspace", cAlternateFileName="PENWOR~1")) returned 1
	[0087.490] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc7d69cc9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1
	[0087.490] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43ffd581, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x43ffd581, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x43ffd581, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0087.490] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeaeec2c4, ftCreationTime.dwHighDateTime=0x1d327d4, ftLastAccessTime.dwLowDateTime=0xeaeec2c4, ftLastAccessTime.dwHighDateTime=0x1d327d4, ftLastWriteTime.dwLowDateTime=0xeaeec2c4, ftLastWriteTime.dwHighDateTime=0x1d327d4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1
	[0087.491] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc7e3414f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfcc934a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1
	[0087.491] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbee6232d, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xbee6232d, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xbee6232d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1
	[0087.491] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9fa64c01, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x9fa64c01, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0087.491] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3e54fc1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc88b17c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd3e54fc1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~3")) returned 1
	[0087.491] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x306b22ce, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x306b22ce, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~2")) returned 1
	[0087.491] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsApps", cAlternateFileName="WINDOW~1")) returned 1
	[0087.491] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsApps", cAlternateFileName="WINDOW~1")) returned 0
	[0087.491] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0087.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.492] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0087.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.492] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.492] GetFileType (hFile=0x5dc) returned 0x1
	[0087.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.492] GetFileType (hFile=0x5dc) returned 0x1
	[0087.492] WriteFile (in: hFile=0x5dc, lpBuffer=0x264c6c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264c6c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.493] CloseHandle (hObject=0x5dc) returned 1
	[0087.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.493] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge", lpFilePart=0x0) returned 0x2b
	[0087.493] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0087.493] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.493] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92addfb1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedCacheContainers", cAlternateFileName="SHARED~1")) returned 1
	[0087.494] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1
	[0087.494] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.494] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0087.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.494] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge", lpFilePart=0x0) returned 0x2b
	[0087.494] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0087.494] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.494] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92addfb1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedCacheContainers", cAlternateFileName="SHARED~1")) returned 1
	[0087.494] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1
	[0087.495] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0
	[0087.495] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0087.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0087.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.496] GetFileType (hFile=0x5dc) returned 0x1
	[0087.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.496] GetFileType (hFile=0x5dc) returned 0x1
	[0087.496] WriteFile (in: hFile=0x5dc, lpBuffer=0x264fef4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264fef4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.497] CloseHandle (hObject=0x5dc) returned 1
	[0087.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.497] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x25
	[0087.497] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0087.497] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.497] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1
	[0087.497] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1
	[0087.497] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.498] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0087.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.498] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x25
	[0087.498] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0087.498] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.498] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1
	[0087.498] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1
	[0087.498] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 0
	[0087.498] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0087.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.499] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0087.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.499] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0087.499] GetFileType (hFile=0x5dc) returned 0x1
	[0087.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.499] GetFileType (hFile=0x5dc) returned 0x1
	[0087.499] WriteFile (in: hFile=0x5dc, lpBuffer=0x26534d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26534d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.500] CloseHandle (hObject=0x5dc) returned 1
	[0087.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.500] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages", lpFilePart=0x0) returned 0x26
	[0087.500] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0087.500] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.501] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy", cAlternateFileName="1527C7~1")) returned 1
	[0087.501] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9E2F88E3.Twitter_wgeqdkkx372wm", cAlternateFileName="9E2F88~1.TWI")) returned 1
	[0087.501] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1206ac31, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1
	[0087.501] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy", cAlternateFileName="C5E252~1")) returned 1
	[0087.501] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CortanaListenUIApp_cw5n1h2txyewy", cAlternateFileName="CORTAN~1")) returned 1
	[0087.606] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopLearning_cw5n1h2txyewy", cAlternateFileName="DESKTO~2")) returned 1
	[0087.606] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopView_cw5n1h2txyewy", cAlternateFileName="DESKTO~1")) returned 1
	[0087.606] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f1d90f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f1d90f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy", cAlternateFileName="E2A4F9~1")) returned 1
	[0087.606] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EnvironmentsApp_cw5n1h2txyewy", cAlternateFileName="ENVIRO~1")) returned 1
	[0087.606] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HoloCamera_cw5n1h2txyewy", cAlternateFileName="HOLOCA~1")) returned 1
	[0087.606] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HoloItemPlayerApp_cw5n1h2txyewy", cAlternateFileName="HOLOIT~1")) returned 1
	[0087.606] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HoloShell_cw5n1h2txyewy", cAlternateFileName="HOLOSH~1")) returned 1
	[0087.606] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12383999, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12383999, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.3DB")) returned 1
	[0087.606] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4609348, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd4609348, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BRO")) returned 1
	[0087.607] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80471ab5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AccountsControl_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ACC")) returned 1
	[0087.607] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda8902b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.Xaml_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.XAM")) returned 1
	[0087.607] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.APP")) returned 1
	[0087.607] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc89dadb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.BIN")) returned 1
	[0087.607] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xa0d44ca, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xa0d44ca, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.BIN")) returned 1
	[0087.607] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.BIN")) returned 1
	[0087.607] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31f6a27, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x31f6a27, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.BIN")) returned 1
	[0087.607] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d17b532, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BioEnrollment_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BIO")) returned 1
	[0087.607] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x131e209, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x131e209, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.COM")) returned 1
	[0087.607] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffc77b6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffc77b6a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ConnectivityStore_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.CON")) returned 1
	[0087.608] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CredDialogHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CRE")) returned 1
	[0087.608] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DesktopAppInstaller_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.DES")) returned 1
	[0087.608] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd81bc01, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd81bc01, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.GET")) returned 1
	[0087.609] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b44678d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.LockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.LOC")) returned 1
	[0087.609] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfbf856cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbf856cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MES")) returned 1
	[0087.609] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe", cAlternateFileName="MIC2FD~1.MIC")) returned 1
	[0087.609] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc92abfb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftEdge_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MIC")) returned 1
	[0087.609] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf9428887, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9428887, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.MIC")) returned 1
	[0087.609] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdba259a9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdba259a9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.MIC")) returned 1
	[0087.609] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.MIC")) returned 1
	[0087.609] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MSPaint_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MSP")) returned 1
	[0087.609] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf27b049c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33b4c3b0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33b4c3b0, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_8")) returned 1
	[0087.610] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33dfacc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33dfacc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.1_8")) returned 1
	[0087.610] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebee37c7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.3_8")) returned 1
	[0087.610] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266a19e6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x34036ffb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34036ffb, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.6_8")) returned 1
	[0087.610] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34273354, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34273354, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_8")) returned 1
	[0087.610] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x344af7fa, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x344af7fa, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.1_8")) returned 1
	[0087.610] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb85500d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.3_8")) returned 1
	[0087.610] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94b424e4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.4_8")) returned 1
	[0087.610] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28b9688c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3509b345, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3509b345, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.6_8")) returned 1
	[0087.610] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x8d747894, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8d974b3f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.OneNote_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ONE")) returned 1
	[0087.610] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd6e72acf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Sway_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.SWA")) returned 1
	[0087.611] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.OneConnect_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.ONE")) returned 1
	[0087.611] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4774ad5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd4774ad5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PEO")) returned 1
	[0087.612] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f7086bb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f7086bb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PPIProjection_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PPI")) returned 1
	[0087.612] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b121dc6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b2eb9cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Services.Store.Engagement_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ENG")) returned 1
	[0087.612] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x88a3d6df, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x88e698d0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SkypeApp_kzf8qxf38zg5c", cAlternateFileName="MICROS~1.SKY")) returned 1
	[0087.612] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.StorePurchaseApp_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.STO")) returned 1
	[0087.612] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35ff46f7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35ff46f7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VCLibs.140.00_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.00_")) returned 1
	[0087.612] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Wallet_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.WAL")) returned 1
	[0087.612] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CHX")) returned 1
	[0087.612] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7975de94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ASS")) returned 1
	[0087.612] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd05a99ea, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd05a99ea, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CLO")) returned 1
	[0087.612] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddff7455, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddff7455, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy", cAlternateFileName="MICROS~2.CON")) returned 1
	[0087.612] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdade5d03, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdade5d03, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Cortana_cw5n1h2txyewy", cAlternateFileName="MICROS~1.COR")) returned 1
	[0087.613] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy", cAlternateFileName="MICROS~1.HOL")) returned 1
	[0087.613] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.MOD")) returned 1
	[0087.613] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy", cAlternateFileName="MICROS~2.OOB")) returned 1
	[0087.613] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy", cAlternateFileName="MICROS~1.OOB")) returned 1
	[0087.613] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x73a62109, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ParentalControls_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PAR")) returned 1
	[0087.613] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xecaaa968, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Photos_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PHO")) returned 1
	[0087.613] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.SecHealthUI_cw5n1h2txyewy", cAlternateFileName="MICROS~3.SEC")) returned 1
	[0087.613] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8333af6e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70e206ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SEC")) returned 1
	[0087.613] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702a7000, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702a7000, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy", cAlternateFileName="MICROS~2.SEC")) returned 1
	[0087.614] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd6e44f49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd6e44f49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SHE")) returned 1
	[0087.614] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.WindowPicker_cw5n1h2txyewy", cAlternateFileName="MI948A~1.WIN")) returned 1
	[0087.614] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8769207c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsAlarms_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.WIN")) returned 1
	[0087.614] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4d85f5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc2086555, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc2086555, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCalculator_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.WIN")) returned 1
	[0087.614] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef547375, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef81c039, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCamera_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.WIN")) returned 1
	[0087.614] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf1aae2a1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf1aae2a1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.windowscommunicationsapps_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.WIN")) returned 1
	[0087.614] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed548e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbede9823, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbede9823, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe", cAlternateFileName="MIDE9E~1.WIN")) returned 1
	[0087.614] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbd8024eb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd8024eb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsMaps_8wekyb3d8bbwe", cAlternateFileName="MID92F~1.WIN")) returned 1
	[0087.614] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsPhone_8wekyb3d8bbwe", cAlternateFileName="MI7D5A~1.WIN")) returned 1
	[0087.614] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x96d8829d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe", cAlternateFileName="MIA6CE~1.WIN")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef8b4999, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsStore_8wekyb3d8bbwe", cAlternateFileName="MI052B~1.WIN")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x950534fc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxApp_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.XBO")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91227223, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f58a0ab, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxGameCallableUI_cw5n1h2txyewy", cAlternateFileName="MICROS~2.XBO")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x936165c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x936165c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxGameOverlay_8wekyb3d8bbwe", cAlternateFileName="MIF834~1.XBO")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf22e0430, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf22e0430, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxIdentityProvider_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.XBO")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.XBO")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9120e63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x913b2022, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ZuneMusic_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ZUN")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8efa262b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8f25108d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ZuneVideo_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.ZUN")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x788510a7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x789ce851, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.ContactSupport_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.CON")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb3df96, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a8cfa4e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a8cfa4e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.devicesflow_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.DEV")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b315bfa, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd8832b29, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd8832b29, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.immersivecontrolpanel_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.IMM")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x77c3f1ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77c3f1ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.MiracastView_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.MIR")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x715dffc9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x715dffc9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.PrintDialog_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.PRI")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3af37fe8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3af37fe8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows_ie_ac_001", cAlternateFileName="WINDOW~1")) returned 1
	[0087.615] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.615] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0087.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages", lpFilePart=0x0) returned 0x26
	[0087.616] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0087.616] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.616] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy", cAlternateFileName="1527C7~1")) returned 1
	[0087.616] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9E2F88E3.Twitter_wgeqdkkx372wm", cAlternateFileName="9E2F88~1.TWI")) returned 1
	[0087.616] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1206ac31, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1
	[0087.616] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy", cAlternateFileName="C5E252~1")) returned 1
	[0087.616] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CortanaListenUIApp_cw5n1h2txyewy", cAlternateFileName="CORTAN~1")) returned 1
	[0087.616] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopLearning_cw5n1h2txyewy", cAlternateFileName="DESKTO~2")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopView_cw5n1h2txyewy", cAlternateFileName="DESKTO~1")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f1d90f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f1d90f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy", cAlternateFileName="E2A4F9~1")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EnvironmentsApp_cw5n1h2txyewy", cAlternateFileName="ENVIRO~1")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HoloCamera_cw5n1h2txyewy", cAlternateFileName="HOLOCA~1")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HoloItemPlayerApp_cw5n1h2txyewy", cAlternateFileName="HOLOIT~1")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HoloShell_cw5n1h2txyewy", cAlternateFileName="HOLOSH~1")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12383999, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12383999, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.3DB")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4609348, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd4609348, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BRO")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80471ab5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AccountsControl_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ACC")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda8902b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.Xaml_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.XAM")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.APP")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc89dadb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.BIN")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xa0d44ca, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xa0d44ca, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.BIN")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.BIN")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31f6a27, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x31f6a27, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.BIN")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d17b532, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BioEnrollment_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BIO")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x131e209, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x131e209, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.COM")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffc77b6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffc77b6a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ConnectivityStore_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.CON")) returned 1
	[0087.617] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CredDialogHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CRE")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DesktopAppInstaller_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.DES")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd81bc01, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd81bc01, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.GET")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b44678d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.LockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.LOC")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfbf856cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbf856cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MES")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe", cAlternateFileName="MIC2FD~1.MIC")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc92abfb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftEdge_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MIC")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf9428887, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9428887, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.MIC")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdba259a9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdba259a9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.MIC")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.MIC")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MSPaint_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MSP")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf27b049c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33b4c3b0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33b4c3b0, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_8")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33dfacc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33dfacc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.1_8")) returned 1
	[0087.618] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebee37c7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.3_8")) returned 1
	[0087.619] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266a19e6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x34036ffb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34036ffb, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.6_8")) returned 1
	[0087.619] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34273354, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34273354, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_8")) returned 1
	[0087.619] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x344af7fa, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x344af7fa, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.1_8")) returned 1
	[0087.619] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb85500d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.3_8")) returned 1
	[0087.619] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94b424e4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.4_8")) returned 1
	[0087.619] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28b9688c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3509b345, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3509b345, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.6_8")) returned 1
	[0087.619] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x8d747894, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8d974b3f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.OneNote_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ONE")) returned 1
	[0087.619] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd6e72acf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Sway_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.SWA")) returned 1
	[0087.619] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.OneConnect_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.ONE")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4774ad5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd4774ad5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PEO")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f7086bb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f7086bb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PPIProjection_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PPI")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b121dc6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b2eb9cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Services.Store.Engagement_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ENG")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x88a3d6df, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x88e698d0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SkypeApp_kzf8qxf38zg5c", cAlternateFileName="MICROS~1.SKY")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.StorePurchaseApp_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.STO")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35ff46f7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35ff46f7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VCLibs.140.00_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.00_")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Wallet_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.WAL")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CHX")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7975de94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ASS")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd05a99ea, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd05a99ea, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CLO")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddff7455, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddff7455, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy", cAlternateFileName="MICROS~2.CON")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdade5d03, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdade5d03, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Cortana_cw5n1h2txyewy", cAlternateFileName="MICROS~1.COR")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy", cAlternateFileName="MICROS~1.HOL")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.MOD")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy", cAlternateFileName="MICROS~2.OOB")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy", cAlternateFileName="MICROS~1.OOB")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x73a62109, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ParentalControls_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PAR")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xecaaa968, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Photos_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PHO")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.SecHealthUI_cw5n1h2txyewy", cAlternateFileName="MICROS~3.SEC")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8333af6e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70e206ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SEC")) returned 1
	[0087.620] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702a7000, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702a7000, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy", cAlternateFileName="MICROS~2.SEC")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd6e44f49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd6e44f49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SHE")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.WindowPicker_cw5n1h2txyewy", cAlternateFileName="MI948A~1.WIN")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8769207c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsAlarms_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.WIN")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4d85f5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc2086555, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc2086555, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCalculator_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.WIN")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef547375, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef81c039, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCamera_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.WIN")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf1aae2a1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf1aae2a1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.windowscommunicationsapps_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.WIN")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed548e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbede9823, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbede9823, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe", cAlternateFileName="MIDE9E~1.WIN")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbd8024eb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd8024eb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsMaps_8wekyb3d8bbwe", cAlternateFileName="MID92F~1.WIN")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsPhone_8wekyb3d8bbwe", cAlternateFileName="MI7D5A~1.WIN")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x96d8829d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe", cAlternateFileName="MIA6CE~1.WIN")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef8b4999, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsStore_8wekyb3d8bbwe", cAlternateFileName="MI052B~1.WIN")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x950534fc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxApp_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.XBO")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91227223, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f58a0ab, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxGameCallableUI_cw5n1h2txyewy", cAlternateFileName="MICROS~2.XBO")) returned 1
	[0087.621] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x936165c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x936165c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxGameOverlay_8wekyb3d8bbwe", cAlternateFileName="MIF834~1.XBO")) returned 1
	[0087.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.625] WriteFile (in: hFile=0x5dc, lpBuffer=0x266e83c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266e83c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.629] WriteFile (in: hFile=0x5dc, lpBuffer=0x2671ab0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2671ab0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.630] WriteFile (in: hFile=0x5dc, lpBuffer=0x2674fd8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2674fd8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.632] WriteFile (in: hFile=0x5dc, lpBuffer=0x267db14*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267db14*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0087.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0087.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temporary Internet Files\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temporary Internet Files\\Decrypt.txt", lpFilePart=0x0) returned 0x42
	[0087.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.636] WriteFile (in: hFile=0x5dc, lpBuffer=0x2680f00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2680f00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.637] WriteFile (in: hFile=0x5dc, lpBuffer=0x2684410*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2684410*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.639] WriteFile (in: hFile=0x5dc, lpBuffer=0x2687964*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2687964*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.641] WriteFile (in: hFile=0x5dc, lpBuffer=0x268abc8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268abc8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.978] WriteFile (in: hFile=0x5dc, lpBuffer=0x24b7c90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b7c90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.979] WriteFile (in: hFile=0x5dc, lpBuffer=0x24bb578*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24bb578*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.981] WriteFile (in: hFile=0x5dc, lpBuffer=0x24be77c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24be77c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0087.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0087.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0087.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0087.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0087.983] WriteFile (in: hFile=0x5dc, lpBuffer=0x24c1ae4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c1ae4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0087.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0088.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0088.141] WriteFile (in: hFile=0x5dc, lpBuffer=0x24c5c90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c5c90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0088.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0088.143] WriteFile (in: hFile=0x5dc, lpBuffer=0x24c9218*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c9218*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0088.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0088.145] WriteFile (in: hFile=0x5dc, lpBuffer=0x24d16c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d16c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0088.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0088.147] WriteFile (in: hFile=0x5dc, lpBuffer=0x24d4d9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d4d9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0088.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0088.149] WriteFile (in: hFile=0x5dc, lpBuffer=0x24d81bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d81bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0088.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0088.151] WriteFile (in: hFile=0x5dc, lpBuffer=0x24db4d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24db4d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0088.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0088.153] WriteFile (in: hFile=0x5dc, lpBuffer=0x24dea50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24dea50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0088.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0088.155] WriteFile (in: hFile=0x5dc, lpBuffer=0x24e2af4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e2af4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0088.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0088.157] WriteFile (in: hFile=0x5dc, lpBuffer=0x24e6bcc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24e6bcc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0088.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0088.159] WriteFile (in: hFile=0x5dc, lpBuffer=0x24eabcc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24eabcc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0088.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0088.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0088.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0088.161] WriteFile (in: hFile=0x5dc, lpBuffer=0x24eec8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24eec8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0088.162] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f34ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f34ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.166] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f7128*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f7128*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.167] WriteFile (in: hFile=0x5dc, lpBuffer=0x24fb87c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24fb87c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.168] WriteFile (in: hFile=0x5dc, lpBuffer=0x2500010*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2500010*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.170] WriteFile (in: hFile=0x5dc, lpBuffer=0x2503bd4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2503bd4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.222] WriteFile (in: hFile=0x5dc, lpBuffer=0x25075bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25075bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.348] WriteFile (in: hFile=0x5dc, lpBuffer=0x250cda8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250cda8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.353] WriteFile (in: hFile=0x5dc, lpBuffer=0x251252c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251252c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.464] WriteFile (in: hFile=0x5dc, lpBuffer=0x25168d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25168d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.631] WriteFile (in: hFile=0x5dc, lpBuffer=0x251ac38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251ac38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.632] WriteFile (in: hFile=0x5dc, lpBuffer=0x251eb20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251eb20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.633] WriteFile (in: hFile=0x5dc, lpBuffer=0x2522a08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2522a08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.634] WriteFile (in: hFile=0x5dc, lpBuffer=0x25269ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25269ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.664] WriteFile (in: hFile=0x5dc, lpBuffer=0x252aea4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x252aea4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.665] WriteFile (in: hFile=0x5dc, lpBuffer=0x252ee88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x252ee88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.666] WriteFile (in: hFile=0x5dc, lpBuffer=0x2532e6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2532e6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.668] WriteFile (in: hFile=0x5dc, lpBuffer=0x2536e50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2536e50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.669] WriteFile (in: hFile=0x5dc, lpBuffer=0x253b39c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253b39c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.670] WriteFile (in: hFile=0x5dc, lpBuffer=0x253f820*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253f820*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.671] WriteFile (in: hFile=0x5dc, lpBuffer=0x25438e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25438e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.672] WriteFile (in: hFile=0x5dc, lpBuffer=0x25479a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25479a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.673] WriteFile (in: hFile=0x5dc, lpBuffer=0x254ba6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254ba6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.675] WriteFile (in: hFile=0x5dc, lpBuffer=0x254fb30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254fb30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.676] WriteFile (in: hFile=0x5dc, lpBuffer=0x2553b8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2553b8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.678] WriteFile (in: hFile=0x5dc, lpBuffer=0x2557c50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2557c50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0088.679] WriteFile (in: hFile=0x5dc, lpBuffer=0x255bd14*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255bd14*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.327] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a3e74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a3e74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.329] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a7f38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a7f38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.331] WriteFile (in: hFile=0x5dc, lpBuffer=0x26abf1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26abf1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.364] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b1eb8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b1eb8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.372] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f36bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f36bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.373] CloseHandle (hObject=0x5dc) returned 1
	[0089.373] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", lpFilePart=0x0) returned 0x56
	[0089.373] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.374] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.374] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0bb0e1, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d0bb0e1, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.374] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0089.374] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0089.374] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0089.376] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0089.376] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.377] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", lpFilePart=0x0) returned 0x56
	[0089.377] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x6d0bb0e1, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0089.377] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x6d0bb0e1, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.377] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0bb0e1, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d0bb0e1, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.377] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0089.377] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0089.378] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0089.378] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.378] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0089.378] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0089.379] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.380] GetFileType (hFile=0x5dc) returned 0x1
	[0089.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.380] GetFileType (hFile=0x5dc) returned 0x1
	[0089.380] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f83f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f83f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.381] CloseHandle (hObject=0x5dc) returned 1
	[0089.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.381] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", lpFilePart=0x0) returned 0x55
	[0089.381] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0089.381] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.382] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0bb0e1, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d0bb0e1, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.382] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0089.382] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0089.382] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0089.382] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0089.382] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0089.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.383] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", lpFilePart=0x0) returned 0x55
	[0089.383] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x6d0bb0e1, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0089.383] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x6d0bb0e1, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.383] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0bb0e1, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d0bb0e1, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.383] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0089.383] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0089.384] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0089.384] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.384] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0089.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.384] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.384] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.385] GetFileType (hFile=0x5dc) returned 0x1
	[0089.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.385] GetFileType (hFile=0x5dc) returned 0x1
	[0089.385] WriteFile (in: hFile=0x5dc, lpBuffer=0x24fd0d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24fd0d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.386] CloseHandle (hObject=0x5dc) returned 1
	[0089.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.386] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", lpFilePart=0x0) returned 0x56
	[0089.386] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0089.387] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.387] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0bb0e1, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d0bb0e1, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d0e12ef, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.387] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0089.387] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0089.387] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0089.388] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0089.388] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0089.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.388] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", lpFilePart=0x0) returned 0x56
	[0089.388] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x6d0bb0e1, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.388] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x6d0bb0e1, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d0bb0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.389] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0bb0e1, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d0bb0e1, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d0e12ef, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.389] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0089.389] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0089.389] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0089.389] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.389] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.389] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0089.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.390] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.390] GetFileType (hFile=0x5dc) returned 0x1
	[0089.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.391] GetFileType (hFile=0x5dc) returned 0x1
	[0089.391] WriteFile (in: hFile=0x5dc, lpBuffer=0x2501e0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2501e0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.391] CloseHandle (hObject=0x5dc) returned 1
	[0089.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.392] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", lpFilePart=0x0) returned 0x55
	[0089.392] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6d238a6b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0089.392] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6d238a6b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.392] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d238a6b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d238a6b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d238a6b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.393] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd7b21800, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0089.393] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0089.393] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0089.393] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0089.393] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0089.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.393] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", lpFilePart=0x0) returned 0x55
	[0089.393] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d238a6b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d238a6b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0089.394] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d238a6b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d238a6b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.394] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d238a6b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d238a6b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d238a6b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.394] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd7b21800, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0089.394] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0089.394] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0089.395] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.395] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0089.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.395] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.395] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.426] GetFileType (hFile=0x5dc) returned 0x1
	[0089.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.426] GetFileType (hFile=0x5dc) returned 0x1
	[0089.426] WriteFile (in: hFile=0x5dc, lpBuffer=0x2506aec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2506aec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.427] CloseHandle (hObject=0x5dc) returned 1
	[0089.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.427] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", lpFilePart=0x0) returned 0x56
	[0089.428] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0089.428] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.428] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d25eb9e, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.428] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd54fbe00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0089.428] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0089.428] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0089.429] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0089.429] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0089.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.429] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", lpFilePart=0x0) returned 0x56
	[0089.429] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0089.429] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.430] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d25eb9e, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.430] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd54fbe00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0089.430] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0089.430] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0089.430] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.430] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0089.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.430] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0089.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.430] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.431] GetFileType (hFile=0x5dc) returned 0x1
	[0089.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.431] GetFileType (hFile=0x5dc) returned 0x1
	[0089.431] WriteFile (in: hFile=0x5dc, lpBuffer=0x250b824*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250b824*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.432] CloseHandle (hObject=0x5dc) returned 1
	[0089.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.433] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpFilePart=0x0) returned 0x3b
	[0089.433] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0089.433] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.433] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d25eb9e, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.433] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1
	[0089.433] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.433] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0089.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.434] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpFilePart=0x0) returned 0x3b
	[0089.512] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0089.512] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.513] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d25eb9e, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.513] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1
	[0089.513] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0
	[0089.513] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0089.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.513] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0089.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.513] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.514] GetFileType (hFile=0x5dc) returned 0x1
	[0089.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.514] GetFileType (hFile=0x5dc) returned 0x1
	[0089.514] WriteFile (in: hFile=0x5dc, lpBuffer=0x250f4b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250f4b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.515] CloseHandle (hObject=0x5dc) returned 1
	[0089.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.515] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration", lpFilePart=0x0) returned 0x3f
	[0089.515] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0089.515] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.516] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d25eb9e, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.516] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1
	[0089.516] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.516] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0089.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.516] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration", lpFilePart=0x0) returned 0x3f
	[0089.516] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0089.516] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.517] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d25eb9e, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.517] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1
	[0089.517] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0
	[0089.517] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0089.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.517] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0089.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.517] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\integration\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.518] GetFileType (hFile=0x5dc) returned 0x1
	[0089.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.518] GetFileType (hFile=0x5dc) returned 0x1
	[0089.518] WriteFile (in: hFile=0x5dc, lpBuffer=0x2513238*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2513238*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.519] CloseHandle (hObject=0x5dc) returned 1
	[0089.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.519] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpFilePart=0x0) returned 0x5c
	[0089.519] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0089.519] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.520] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d25eb9e, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.520] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0089.520] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0089.520] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.520] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0089.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.520] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpFilePart=0x0) returned 0x5c
	[0089.520] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0089.521] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.521] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d25eb9e, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d25eb9e, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d25eb9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.521] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0089.521] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0089.521] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0089.521] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0089.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.521] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0089.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.521] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.522] GetFileType (hFile=0x5dc) returned 0x1
	[0089.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.523] GetFileType (hFile=0x5dc) returned 0x1
	[0089.523] WriteFile (in: hFile=0x5dc, lpBuffer=0x2517a7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2517a7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.524] CloseHandle (hObject=0x5dc) returned 1
	[0089.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.524] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", lpFilePart=0x0) returned 0x5c
	[0089.524] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0089.524] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.524] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d284d43, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d284d43, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.525] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0089.525] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0089.525] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.525] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0089.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.525] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", lpFilePart=0x0) returned 0x5c
	[0089.525] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x6d284d43, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.525] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x6d284d43, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.525] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d284d43, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d284d43, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.526] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0089.526] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0089.526] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0089.526] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.526] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0089.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.526] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.527] GetFileType (hFile=0x5dc) returned 0x1
	[0089.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.527] GetFileType (hFile=0x5dc) returned 0x1
	[0089.527] WriteFile (in: hFile=0x5dc, lpBuffer=0x251c2c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251c2c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.528] CloseHandle (hObject=0x5dc) returned 1
	[0089.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.528] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33
	[0089.528] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0089.529] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.529] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d284d43, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d284d43, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.529] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d284d43, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d284d43, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0089.529] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0089.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.529] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33
	[0089.530] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6d284d43, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0089.530] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6d284d43, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.530] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d284d43, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d284d43, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d284d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.530] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.530] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0089.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.530] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0089.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.530] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.531] GetFileType (hFile=0x5dc) returned 0x1
	[0089.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.531] GetFileType (hFile=0x5dc) returned 0x1
	[0089.532] WriteFile (in: hFile=0x5dc, lpBuffer=0x251f9ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251f9ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.532] CloseHandle (hObject=0x5dc) returned 1
	[0089.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.533] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x33
	[0089.533] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0089.533] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.533] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2aaf30, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d2aaf30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.533] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1
	[0089.533] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0
	[0089.533] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0089.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.534] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x33
	[0089.534] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6d2aaf30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0089.534] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6d2aaf30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.534] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2aaf30, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d2aaf30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.534] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1
	[0089.534] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.534] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0089.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.534] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0089.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.534] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.535] GetFileType (hFile=0x5dc) returned 0x1
	[0089.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.535] GetFileType (hFile=0x5dc) returned 0x1
	[0089.535] WriteFile (in: hFile=0x5dc, lpBuffer=0x2523704*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2523704*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.536] CloseHandle (hObject=0x5dc) returned 1
	[0089.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.536] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x30
	[0089.536] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0089.536] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.537] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1
	[0089.537] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2aaf30, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d2aaf30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.537] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2aaf30, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d2aaf30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0089.537] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0089.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.537] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x30
	[0089.537] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x6d2aaf30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0089.537] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x6d2aaf30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.537] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1
	[0089.537] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2aaf30, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d2aaf30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d2aaf30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.538] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.538] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0089.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.538] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0089.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.538] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.539] GetFileType (hFile=0x5dc) returned 0x1
	[0089.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.539] GetFileType (hFile=0x5dc) returned 0x1
	[0089.539] WriteFile (in: hFile=0x5dc, lpBuffer=0x2527338*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2527338*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.540] CloseHandle (hObject=0x5dc) returned 1
	[0089.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.540] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x57
	[0089.540] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d4287a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0089.540] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d4287a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.540] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0089.540] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0089.540] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d4287a4, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d4287a4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d4287a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.540] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1
	[0089.541] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1
	[0089.541] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1
	[0089.541] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0
	[0089.541] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0089.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.541] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x57
	[0089.541] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d4287a4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d4287a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.541] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d4287a4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d4287a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.541] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0089.542] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0089.542] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d4287a4, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d4287a4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d4287a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.542] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1
	[0089.542] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1
	[0089.542] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1
	[0089.542] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.542] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.542] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0089.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.542] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.543] GetFileType (hFile=0x5dc) returned 0x1
	[0089.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.543] GetFileType (hFile=0x5dc) returned 0x1
	[0089.543] WriteFile (in: hFile=0x5dc, lpBuffer=0x252c694*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x252c694*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.544] CloseHandle (hObject=0x5dc) returned 1
	[0089.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.544] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x57
	[0089.544] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d4287a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0089.545] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d4287a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.545] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0089.545] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0089.545] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d4287a4, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d4287a4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d4287a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.545] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1
	[0089.545] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0
	[0089.545] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0089.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.545] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x57
	[0089.545] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d4287a4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d4287a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0089.546] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d4287a4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d4287a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.546] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0089.546] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0089.546] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d4287a4, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d4287a4, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d4287a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.546] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1
	[0089.546] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.546] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0089.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.546] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0089.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.546] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.548] GetFileType (hFile=0x5dc) returned 0x1
	[0089.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.548] GetFileType (hFile=0x5dc) returned 0x1
	[0089.548] WriteFile (in: hFile=0x5dc, lpBuffer=0x25311c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25311c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.549] CloseHandle (hObject=0x5dc) returned 1
	[0089.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.549] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x55
	[0089.549] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.549] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.549] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d44e956, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.549] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0089.549] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0089.549] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1
	[0089.550] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1
	[0089.550] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0089.550] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1
	[0089.550] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1
	[0089.550] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1
	[0089.550] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0089.550] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1
	[0089.550] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0
	[0089.550] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.551] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x55
	[0089.551] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0089.551] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.551] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d44e956, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.551] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0089.551] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0089.551] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1
	[0089.551] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1
	[0089.551] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0089.551] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1
	[0089.551] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1
	[0089.551] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1
	[0089.551] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0089.552] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1
	[0089.552] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.552] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0089.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.552] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.552] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.553] GetFileType (hFile=0x5dc) returned 0x1
	[0089.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.553] GetFileType (hFile=0x5dc) returned 0x1
	[0089.553] WriteFile (in: hFile=0x5dc, lpBuffer=0x25377c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25377c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.553] CloseHandle (hObject=0x5dc) returned 1
	[0089.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.554] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x55
	[0089.554] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0089.554] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.554] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d44e956, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.554] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0089.554] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0089.554] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1
	[0089.554] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1
	[0089.554] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1
	[0089.554] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1
	[0089.554] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1
	[0089.555] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1
	[0089.555] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0089.555] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0
	[0089.555] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0089.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.555] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x55
	[0089.555] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0089.555] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.555] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d44e956, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.555] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0089.555] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0089.555] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1
	[0089.556] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1
	[0089.556] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1
	[0089.556] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1
	[0089.556] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1
	[0089.556] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1
	[0089.556] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0089.556] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.556] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0089.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.556] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.556] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.557] GetFileType (hFile=0x5dc) returned 0x1
	[0089.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.557] GetFileType (hFile=0x5dc) returned 0x1
	[0089.557] WriteFile (in: hFile=0x5dc, lpBuffer=0x253daf8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253daf8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.558] CloseHandle (hObject=0x5dc) returned 1
	[0089.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", lpFilePart=0x0) returned 0x39
	[0089.558] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0089.558] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.558] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0089.558] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d44e956, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.558] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d44e956, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0089.558] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0089.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.660] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", lpFilePart=0x0) returned 0x39
	[0089.660] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.660] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.660] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0089.660] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d44e956, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.660] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.660] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.660] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0089.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.660] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\autologger\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.661] GetFileType (hFile=0x5dc) returned 0x1
	[0089.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.661] GetFileType (hFile=0x5dc) returned 0x1
	[0089.661] WriteFile (in: hFile=0x5dc, lpBuffer=0x254179c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254179c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.662] CloseHandle (hObject=0x5dc) returned 1
	[0089.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.662] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", lpFilePart=0x0) returned 0x45
	[0089.662] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0089.662] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.662] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d44e956, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d474c40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.662] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d44e956, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d474c40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0089.662] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0089.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.663] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", lpFilePart=0x0) returned 0x45
	[0089.663] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0089.663] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d44e956, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.663] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d44e956, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d44e956, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d474c40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.663] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.663] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0089.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.663] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0089.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.663] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\scenarioshutdownlogger\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.664] GetFileType (hFile=0x5dc) returned 0x1
	[0089.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.664] GetFileType (hFile=0x5dc) returned 0x1
	[0089.664] WriteFile (in: hFile=0x5dc, lpBuffer=0x2545278*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2545278*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.665] CloseHandle (hObject=0x5dc) returned 1
	[0089.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.665] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", lpFilePart=0x0) returned 0x3d
	[0089.665] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x6d474c40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.665] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x6d474c40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.665] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0089.665] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d474c40, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d474c40, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d474c40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.665] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d474c40, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d474c40, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d474c40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0089.665] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.666] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", lpFilePart=0x0) returned 0x3d
	[0089.666] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d474c40, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d474c40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0089.666] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6d474c40, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d474c40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.666] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0089.666] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d474c40, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d474c40, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d474c40, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.666] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.666] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0089.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.666] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0089.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.666] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.667] GetFileType (hFile=0x5dc) returned 0x1
	[0089.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.667] GetFileType (hFile=0x5dc) returned 0x1
	[0089.667] WriteFile (in: hFile=0x5dc, lpBuffer=0x254901c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254901c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.668] CloseHandle (hObject=0x5dc) returned 1
	[0089.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.669] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA", lpFilePart=0x0) returned 0x3b
	[0089.669] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0089.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0089.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.670] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA", lpFilePart=0x0) returned 0x3b
	[0089.670] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0089.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f240) returned 1
	[0089.672] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0089.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.672] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\tenantstorage\\p-aria\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0089.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511db20) returned 1
	[0089.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.676] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x48
	[0089.676] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x6d5f24c0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0089.676] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x6d5f24c0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.676] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d5f24c0, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d5f24c0, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.676] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d5f24c0, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d5f24c0, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0089.676] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0089.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.677] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x48
	[0089.677] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6d5f24c0, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d5f24c0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0089.677] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6d5f24c0, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d5f24c0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.677] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d5f24c0, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d5f24c0, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.677] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.677] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0089.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.677] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0089.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.678] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.678] GetFileType (hFile=0x5dc) returned 0x1
	[0089.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.678] GetFileType (hFile=0x5dc) returned 0x1
	[0089.678] WriteFile (in: hFile=0x5dc, lpBuffer=0x254df4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254df4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.679] CloseHandle (hObject=0x5dc) returned 1
	[0089.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.679] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp", lpFilePart=0x0) returned 0x38
	[0089.679] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.680] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.680] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d618816, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d618816, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.680] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d618816, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d618816, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0089.680] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.680] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp", lpFilePart=0x0) returned 0x38
	[0089.680] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x6d618816, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0089.680] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x6d618816, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.681] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d618816, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d618816, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.681] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.681] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0089.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.681] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0089.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.681] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\temp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.682] GetFileType (hFile=0x5dc) returned 0x1
	[0089.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.682] GetFileType (hFile=0x5dc) returned 0x1
	[0089.682] WriteFile (in: hFile=0x5dc, lpBuffer=0x2551778*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2551778*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.683] CloseHandle (hObject=0x5dc) returned 1
	[0089.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.683] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm", lpFilePart=0x0) returned 0x33
	[0089.683] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0089.684] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.684] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d618816, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d618816, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.684] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d618816, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d618816, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0089.684] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0089.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.685] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm", lpFilePart=0x0) returned 0x33
	[0089.685] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6d618816, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.685] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6d618816, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.685] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d618816, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d618816, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d618816, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.685] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.685] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.686] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0089.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.686] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\cm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.687] GetFileType (hFile=0x5dc) returned 0x1
	[0089.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.687] GetFileType (hFile=0x5dc) returned 0x1
	[0089.687] WriteFile (in: hFile=0x5dc, lpBuffer=0x2554e64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2554e64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.688] CloseHandle (hObject=0x5dc) returned 1
	[0089.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.688] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old", lpFilePart=0x0) returned 0x37
	[0089.688] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d68ae44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0089.688] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d68ae44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.689] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d68ae44, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d68ae44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d68ae44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.689] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d68ae44, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d68ae44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d68ae44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0089.689] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0089.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.689] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old", lpFilePart=0x0) returned 0x37
	[0089.689] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x6d68ae44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d68ae44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.690] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x6d68ae44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d68ae44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.690] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d68ae44, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d68ae44, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d68ae44, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.690] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.690] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.690] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0089.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.690] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\cm_old\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.691] GetFileType (hFile=0x5dc) returned 0x1
	[0089.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.691] GetFileType (hFile=0x5dc) returned 0x1
	[0089.692] WriteFile (in: hFile=0x5dc, lpBuffer=0x2558630*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2558630*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.692] CloseHandle (hObject=0x5dc) returned 1
	[0089.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.693] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.693] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0089.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b0f89, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d6b0f89, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.694] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0089.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.694] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.694] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d6b0f89, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0089.695] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d6b0f89, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.695] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b0f89, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d6b0f89, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.695] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.695] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.695] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.695] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0089.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.696] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.696] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.696] GetFileType (hFile=0x5dc) returned 0x1
	[0089.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.697] GetFileType (hFile=0x5dc) returned 0x1
	[0089.697] WriteFile (in: hFile=0x5dc, lpBuffer=0x255cc58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255cc58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.697] CloseHandle (hObject=0x5dc) returned 1
	[0089.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.697] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.698] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0089.698] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.698] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b0f89, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d6b0f89, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.698] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.698] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.698] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.699] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0089.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.699] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.699] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d6b0f89, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0089.699] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d6b0f89, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.765] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b0f89, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d6b0f89, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.765] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.765] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.765] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.765] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0089.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.765] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.766] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.767] GetFileType (hFile=0x5dc) returned 0x1
	[0089.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.767] GetFileType (hFile=0x5dc) returned 0x1
	[0089.767] WriteFile (in: hFile=0x5dc, lpBuffer=0x25613f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25613f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.768] CloseHandle (hObject=0x5dc) returned 1
	[0089.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.768] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.768] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0089.769] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.769] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b0f89, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d6b0f89, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.769] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.769] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.769] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.769] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0089.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.770] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.770] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d6b0f89, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0089.770] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d6b0f89, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.770] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b0f89, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d6b0f89, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6b0f89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.770] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.771] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.771] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.771] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0089.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.771] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.771] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.772] GetFileType (hFile=0x5dc) returned 0x1
	[0089.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.772] GetFileType (hFile=0x5dc) returned 0x1
	[0089.772] WriteFile (in: hFile=0x5dc, lpBuffer=0x2565a1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2565a1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.773] CloseHandle (hObject=0x5dc) returned 1
	[0089.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.773] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.773] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0089.773] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.774] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6d7198, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d6d7198, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.774] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.774] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.774] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.774] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0089.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.774] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.774] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d6d7198, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.775] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d6d7198, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.775] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6d7198, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d6d7198, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.775] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.775] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.775] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.775] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.776] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.776] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.777] GetFileType (hFile=0x5dc) returned 0x1
	[0089.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.777] GetFileType (hFile=0x5dc) returned 0x1
	[0089.777] WriteFile (in: hFile=0x5dc, lpBuffer=0x256a044*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256a044*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.778] CloseHandle (hObject=0x5dc) returned 1
	[0089.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.778] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.778] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0089.778] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.779] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6d7198, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d6d7198, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.779] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.779] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.779] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.779] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0089.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.779] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.779] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d6d7198, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.779] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d6d7198, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.780] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6d7198, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d6d7198, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.780] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.780] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.780] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.780] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.780] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.780] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.781] GetFileType (hFile=0x5dc) returned 0x1
	[0089.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.781] GetFileType (hFile=0x5dc) returned 0x1
	[0089.781] WriteFile (in: hFile=0x5dc, lpBuffer=0x256e66c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256e66c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.782] CloseHandle (hObject=0x5dc) returned 1
	[0089.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.782] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.783] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0089.783] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.783] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6d7198, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d6d7198, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.783] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.783] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.783] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.783] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0089.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.784] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.784] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d6d7198, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0089.784] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d6d7198, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.784] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6d7198, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d6d7198, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d6d7198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.784] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.784] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.785] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.785] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0089.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.785] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.785] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.786] GetFileType (hFile=0x5dc) returned 0x1
	[0089.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.786] GetFileType (hFile=0x5dc) returned 0x1
	[0089.786] WriteFile (in: hFile=0x5dc, lpBuffer=0x2572c94*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2572c94*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.787] CloseHandle (hObject=0x5dc) returned 1
	[0089.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.787] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0089.788] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.788] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7e224d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.788] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.788] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.788] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.788] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0089.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.788] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0089.789] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.789] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7e224d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.789] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.789] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.789] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.789] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0089.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.790] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.790] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.790] GetFileType (hFile=0x5dc) returned 0x1
	[0089.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.791] GetFileType (hFile=0x5dc) returned 0x1
	[0089.791] WriteFile (in: hFile=0x5dc, lpBuffer=0x25772bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25772bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.791] CloseHandle (hObject=0x5dc) returned 1
	[0089.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.792] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.792] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0089.792] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.792] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7e224d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.792] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.793] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.793] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.793] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0089.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.793] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.793] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0089.794] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.794] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7e224d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.794] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.794] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.794] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.794] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0089.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0089.794] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0089.794] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.795] GetFileType (hFile=0x5dc) returned 0x1
	[0089.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0089.796] GetFileType (hFile=0x5dc) returned 0x1
	[0089.796] WriteFile (in: hFile=0x5dc, lpBuffer=0x257b8e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257b8e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.797] CloseHandle (hObject=0x5dc) returned 1
	[0089.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0089.797] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.797] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0089.797] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.798] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7e224d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.798] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.798] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.798] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.798] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0089.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0089.798] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.798] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0089.798] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.799] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7e224d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.799] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.799] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.799] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.799] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0089.799] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.799] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.800] GetFileType (hFile=0x5dc) returned 0x1
	[0089.800] GetFileType (hFile=0x5dc) returned 0x1
	[0089.800] WriteFile (in: hFile=0x5dc, lpBuffer=0x257ff0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257ff0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.800] CloseHandle (hObject=0x5dc) returned 1
	[0089.801] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.801] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0089.801] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.801] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7e224d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.801] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.801] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.801] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.801] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0089.802] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.802] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0089.802] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.802] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7e224d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.802] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.802] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.802] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.802] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0089.857] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.903] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.904] GetFileType (hFile=0x5dc) returned 0x1
	[0089.904] GetFileType (hFile=0x5dc) returned 0x1
	[0089.904] WriteFile (in: hFile=0x5dc, lpBuffer=0x25845fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25845fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.905] CloseHandle (hObject=0x5dc) returned 1
	[0089.905] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.905] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0089.906] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.906] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7e224d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.906] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.906] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.906] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.906] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0089.906] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.906] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0089.907] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.907] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7e224d, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d7e224d, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d7e224d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.907] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.907] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.907] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.907] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0089.907] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.907] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.908] GetFileType (hFile=0x5dc) returned 0x1
	[0089.908] GetFileType (hFile=0x5dc) returned 0x1
	[0089.908] WriteFile (in: hFile=0x5dc, lpBuffer=0x2588c24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2588c24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.909] CloseHandle (hObject=0x5dc) returned 1
	[0089.909] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.909] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0089.909] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.909] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8084e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.909] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.910] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.910] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.910] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0089.910] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.910] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0089.910] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.910] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8084e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.910] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.910] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.910] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.911] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0089.911] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.911] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.911] GetFileType (hFile=0x5dc) returned 0x1
	[0089.911] GetFileType (hFile=0x5dc) returned 0x1
	[0089.911] WriteFile (in: hFile=0x5dc, lpBuffer=0x258d24c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258d24c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.912] CloseHandle (hObject=0x5dc) returned 1
	[0089.912] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.912] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0089.913] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.913] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8084e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.913] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.913] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.913] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.913] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0089.913] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.913] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0089.913] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.914] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8084e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.914] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.914] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.914] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.914] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0089.914] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.914] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.915] GetFileType (hFile=0x5dc) returned 0x1
	[0089.915] GetFileType (hFile=0x5dc) returned 0x1
	[0089.915] WriteFile (in: hFile=0x5dc, lpBuffer=0x2595880*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2595880*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.916] CloseHandle (hObject=0x5dc) returned 1
	[0089.916] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.916] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0089.916] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.916] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8084e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.916] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.917] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.917] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.917] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0089.917] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.917] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0089.917] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.917] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8084e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.917] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.918] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.918] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.918] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0089.918] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.918] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.919] GetFileType (hFile=0x5dc) returned 0x1
	[0089.919] GetFileType (hFile=0x5dc) returned 0x1
	[0089.919] WriteFile (in: hFile=0x5dc, lpBuffer=0x2599ea8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2599ea8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.920] CloseHandle (hObject=0x5dc) returned 1
	[0089.920] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.920] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0089.920] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.920] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8084e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.920] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2270dc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.920] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.920] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.920] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0089.921] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.921] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0089.921] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.921] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8084e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.921] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2270dc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.921] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.921] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.921] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0089.921] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.921] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.922] GetFileType (hFile=0x5dc) returned 0x1
	[0089.922] GetFileType (hFile=0x5dc) returned 0x1
	[0089.922] WriteFile (in: hFile=0x5dc, lpBuffer=0x259e4d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259e4d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.923] CloseHandle (hObject=0x5dc) returned 1
	[0089.923] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.923] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0089.923] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.923] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8084e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d82e817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.924] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.924] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.924] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.924] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0089.924] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.924] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0089.924] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d8084e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.924] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8084e8, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d8084e8, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d82e817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.924] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.924] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.924] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.924] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0089.925] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.925] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.925] GetFileType (hFile=0x5dc) returned 0x1
	[0089.925] GetFileType (hFile=0x5dc) returned 0x1
	[0089.926] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a2af8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a2af8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.926] CloseHandle (hObject=0x5dc) returned 1
	[0089.926] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.926] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d82e817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0089.927] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d82e817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.927] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d82e817, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d82e817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d82e817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.927] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d244069, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.927] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.927] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.927] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0089.927] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.927] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d82e817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d82e817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0089.927] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d82e817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d82e817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.927] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d82e817, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d82e817, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d82e817, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.928] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d244069, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.928] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.928] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.928] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0089.928] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.928] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.929] GetFileType (hFile=0x5dc) returned 0x1
	[0089.929] GetFileType (hFile=0x5dc) returned 0x1
	[0089.929] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a7120*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a7120*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.929] CloseHandle (hObject=0x5dc) returned 1
	[0089.930] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.930] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0089.930] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.930] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d93989b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.930] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.930] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.930] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0089.930] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0089.930] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov", lpFilePart=0x0) returned 0x55
	[0089.930] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0089.931] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.931] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d93989b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.931] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0089.931] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0089.931] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.931] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0089.931] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0089.931] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.932] GetFileType (hFile=0x5dc) returned 0x1
	[0089.932] GetFileType (hFile=0x5dc) returned 0x1
	[0089.932] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ab748*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ab748*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.933] CloseHandle (hObject=0x5dc) returned 1
	[0089.933] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x35
	[0089.933] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0089.933] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.933] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d93989b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.933] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0089.933] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.933] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0089.934] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x35
	[0089.934] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0089.935] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.935] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d93989b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.935] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0089.935] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0
	[0089.935] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0089.935] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0089.935] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.988] GetFileType (hFile=0x5dc) returned 0x1
	[0089.989] GetFileType (hFile=0x5dc) returned 0x1
	[0089.989] WriteFile (in: hFile=0x5dc, lpBuffer=0x25af2ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25af2ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.989] CloseHandle (hObject=0x5dc) returned 1
	[0089.990] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x2d
	[0089.990] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb99ea4ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0089.990] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb99ea4ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.990] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d93989b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.990] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d93989b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0089.990] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0089.990] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x2d
	[0089.990] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0089.991] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.991] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d93989b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.991] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.991] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0089.991] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0089.991] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.992] GetFileType (hFile=0x5dc) returned 0x1
	[0089.992] GetFileType (hFile=0x5dc) returned 0x1
	[0089.992] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b2888*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b2888*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.993] CloseHandle (hObject=0x5dc) returned 1
	[0089.993] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70
	[0089.993] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0089.993] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.994] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0089.994] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d93989b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.994] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0089.994] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0089.994] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0089.994] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70
	[0089.994] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0089.994] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.994] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0089.994] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d93989b, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d93989b, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d93989b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.994] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0089.995] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.995] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0089.995] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7c
	[0089.995] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.996] GetFileType (hFile=0x5dc) returned 0x1
	[0089.996] GetFileType (hFile=0x5dc) returned 0x1
	[0089.996] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b77a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b77a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0089.997] CloseHandle (hObject=0x5dc) returned 1
	[0089.997] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x75
	[0089.997] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0089.997] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.997] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0089.997] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d95fa8c, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d95fa8c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.997] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0089.997] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0089.997] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0089.997] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x75
	[0089.997] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6d95fa8c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0089.998] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6d95fa8c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.998] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0089.998] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d95fa8c, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d95fa8c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0089.998] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0089.998] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0089.998] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0089.998] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x81
	[0089.998] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0089.999] GetFileType (hFile=0x5dc) returned 0x1
	[0089.999] GetFileType (hFile=0x5dc) returned 0x1
	[0089.999] WriteFile (in: hFile=0x5dc, lpBuffer=0x25bc840*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bc840*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.000] CloseHandle (hObject=0x5dc) returned 1
	[0090.000] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x71
	[0090.000] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0090.000] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.000] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0090.000] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d95fa8c, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d95fa8c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0090.000] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0090.000] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0090.000] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0090.000] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x71
	[0090.001] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6d95fa8c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0090.001] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x6d95fa8c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.001] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0090.001] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d95fa8c, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x6d95fa8c, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0090.001] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0090.001] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.001] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0090.001] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7d
	[0090.001] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0090.002] GetFileType (hFile=0x5dc) returned 0x1
	[0090.002] GetFileType (hFile=0x5dc) returned 0x1
	[0090.002] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c1780*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c1780*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.003] CloseHandle (hObject=0x5dc) returned 1
	[0090.076] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x74
	[0090.076] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0090.077] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6d95fa8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.081] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c67e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c67e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.081] CloseHandle (hObject=0x5dc) returned 1
	[0090.082] WriteFile (in: hFile=0x5dc, lpBuffer=0x25cb7b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cb7b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.084] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d0850*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d0850*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.085] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d5800*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d5800*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.087] WriteFile (in: hFile=0x5dc, lpBuffer=0x25da808*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25da808*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.088] WriteFile (in: hFile=0x5dc, lpBuffer=0x25df728*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25df728*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.090] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e46d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e46d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.092] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e97d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e97d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.093] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ee7d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ee7d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.216] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f6be8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f6be8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.220] WriteFile (in: hFile=0x5dc, lpBuffer=0x24fb8d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24fb8d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.221] WriteFile (in: hFile=0x5dc, lpBuffer=0x2500600*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2500600*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.222] WriteFile (in: hFile=0x5dc, lpBuffer=0x25052ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25052ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.224] WriteFile (in: hFile=0x5dc, lpBuffer=0x250a018*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250a018*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.225] WriteFile (in: hFile=0x5dc, lpBuffer=0x250dddc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250dddc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.227] WriteFile (in: hFile=0x5dc, lpBuffer=0x2511b18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2511b18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.235] WriteFile (in: hFile=0x5dc, lpBuffer=0x2515ddc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2515ddc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.236] WriteFile (in: hFile=0x5dc, lpBuffer=0x251a620*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251a620*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.241] WriteFile (in: hFile=0x5dc, lpBuffer=0x251ed28*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251ed28*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.242] WriteFile (in: hFile=0x5dc, lpBuffer=0x2522b90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2522b90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.244] WriteFile (in: hFile=0x5dc, lpBuffer=0x2526630*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2526630*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.245] WriteFile (in: hFile=0x5dc, lpBuffer=0x252baa8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x252baa8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.247] WriteFile (in: hFile=0x5dc, lpBuffer=0x25305e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25305e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.248] WriteFile (in: hFile=0x5dc, lpBuffer=0x2535fd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2535fd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.249] WriteFile (in: hFile=0x5dc, lpBuffer=0x253a044*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253a044*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.251] WriteFile (in: hFile=0x5dc, lpBuffer=0x253dd88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253dd88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.252] WriteFile (in: hFile=0x5dc, lpBuffer=0x2541298*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2541298*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.253] WriteFile (in: hFile=0x5dc, lpBuffer=0x254468c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254468c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.255] WriteFile (in: hFile=0x5dc, lpBuffer=0x25482e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25482e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.256] WriteFile (in: hFile=0x5dc, lpBuffer=0x254c7c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254c7c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.258] WriteFile (in: hFile=0x5dc, lpBuffer=0x2550178*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2550178*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.259] WriteFile (in: hFile=0x5dc, lpBuffer=0x2553924*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2553924*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.295] WriteFile (in: hFile=0x5dc, lpBuffer=0x255b47c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255b47c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.297] WriteFile (in: hFile=0x5dc, lpBuffer=0x255fc18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255fc18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.298] WriteFile (in: hFile=0x5dc, lpBuffer=0x2564240*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2564240*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.299] WriteFile (in: hFile=0x5dc, lpBuffer=0x256a3a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256a3a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.301] WriteFile (in: hFile=0x5dc, lpBuffer=0x256e2ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256e2ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.303] WriteFile (in: hFile=0x5dc, lpBuffer=0x25720c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25720c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.305] WriteFile (in: hFile=0x5dc, lpBuffer=0x25766f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25766f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.306] WriteFile (in: hFile=0x5dc, lpBuffer=0x257ad18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257ad18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.308] WriteFile (in: hFile=0x5dc, lpBuffer=0x257f340*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257f340*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.311] WriteFile (in: hFile=0x5dc, lpBuffer=0x2583968*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2583968*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.312] WriteFile (in: hFile=0x5dc, lpBuffer=0x2588058*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2588058*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.317] WriteFile (in: hFile=0x5dc, lpBuffer=0x258d7f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258d7f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.343] WriteFile (in: hFile=0x5dc, lpBuffer=0x25955f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25955f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.345] WriteFile (in: hFile=0x5dc, lpBuffer=0x25992dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25992dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.346] WriteFile (in: hFile=0x5dc, lpBuffer=0x259d904*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259d904*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.351] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a4770*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a4770*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.356] WriteFile (in: hFile=0x5dc, lpBuffer=0x25aab7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25aab7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.388] WriteFile (in: hFile=0x5dc, lpBuffer=0x25aea2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25aea2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.399] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b46d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b46d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.500] WriteFile (in: hFile=0x5dc, lpBuffer=0x25baf7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25baf7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.521] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c0aec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c0aec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.532] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c6344*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c6344*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.545] WriteFile (in: hFile=0x5dc, lpBuffer=0x25cc4c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cc4c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.594] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d1b14*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d1b14*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.622] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d8f50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d8f50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.627] WriteFile (in: hFile=0x5dc, lpBuffer=0x25dea94*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25dea94*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.635] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e4244*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e4244*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.640] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e9a1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e9a1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.641] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f0e34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f0e34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.647] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f6618*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f6618*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.649] WriteFile (in: hFile=0x5dc, lpBuffer=0x25fa2b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fa2b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.653] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ff938*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ff938*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.661] WriteFile (in: hFile=0x5dc, lpBuffer=0x2604f5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2604f5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.665] WriteFile (in: hFile=0x5dc, lpBuffer=0x260a420*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260a420*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.704] WriteFile (in: hFile=0x5dc, lpBuffer=0x260fa8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260fa8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.709] WriteFile (in: hFile=0x5dc, lpBuffer=0x26150b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26150b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.714] WriteFile (in: hFile=0x5dc, lpBuffer=0x261a7b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261a7b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.719] WriteFile (in: hFile=0x5dc, lpBuffer=0x261fd58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261fd58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.724] WriteFile (in: hFile=0x5dc, lpBuffer=0x262561c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262561c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.735] WriteFile (in: hFile=0x5dc, lpBuffer=0x262ad80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262ad80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.740] WriteFile (in: hFile=0x5dc, lpBuffer=0x2630724*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2630724*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.776] WriteFile (in: hFile=0x5dc, lpBuffer=0x2635e3c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2635e3c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.782] WriteFile (in: hFile=0x5dc, lpBuffer=0x263b2a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263b2a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.783] WriteFile (in: hFile=0x5dc, lpBuffer=0x26407e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26407e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.791] WriteFile (in: hFile=0x5dc, lpBuffer=0x26460a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26460a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.792] WriteFile (in: hFile=0x5dc, lpBuffer=0x264b7ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264b7ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.829] WriteFile (in: hFile=0x5dc, lpBuffer=0x26510d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26510d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.841] WriteFile (in: hFile=0x5dc, lpBuffer=0x2656e54*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2656e54*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.846] WriteFile (in: hFile=0x5dc, lpBuffer=0x265c858*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265c858*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.874] WriteFile (in: hFile=0x5dc, lpBuffer=0x2661d84*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2661d84*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.885] WriteFile (in: hFile=0x5dc, lpBuffer=0x26674f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26674f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.899] WriteFile (in: hFile=0x5dc, lpBuffer=0x266cc5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266cc5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.902] WriteFile (in: hFile=0x5dc, lpBuffer=0x2670ab8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2670ab8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0090.908] WriteFile (in: hFile=0x5dc, lpBuffer=0x2676224*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2676224*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.083] WriteFile (in: hFile=0x5dc, lpBuffer=0x24f8474*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f8474*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.092] WriteFile (in: hFile=0x5dc, lpBuffer=0x2500600*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2500600*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.094] WriteFile (in: hFile=0x5dc, lpBuffer=0x25052ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25052ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.095] WriteFile (in: hFile=0x5dc, lpBuffer=0x250a018*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x250a018*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.101] WriteFile (in: hFile=0x5dc, lpBuffer=0x2510f08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2510f08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.114] WriteFile (in: hFile=0x5dc, lpBuffer=0x25174a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25174a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.123] WriteFile (in: hFile=0x5dc, lpBuffer=0x251e230*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251e230*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.156] WriteFile (in: hFile=0x5dc, lpBuffer=0x2525a20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2525a20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.161] WriteFile (in: hFile=0x5dc, lpBuffer=0x252db6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x252db6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.174] WriteFile (in: hFile=0x5dc, lpBuffer=0x2535fd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2535fd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.179] WriteFile (in: hFile=0x5dc, lpBuffer=0x253cec8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x253cec8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.204] WriteFile (in: hFile=0x5dc, lpBuffer=0x2542468*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2542468*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.244] WriteFile (in: hFile=0x5dc, lpBuffer=0x25482e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25482e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0091.529] WriteFile (in: hFile=0x5dc, lpBuffer=0x254ec74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x254ec74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0094.047] WriteFile (in: hFile=0x5dc, lpBuffer=0x2558564*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2558564*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0094.048] WriteFile (in: hFile=0x5dc, lpBuffer=0x255e8d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x255e8d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0094.570] WriteFile (in: hFile=0x5dc, lpBuffer=0x2568868*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2568868*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0094.574] WriteFile (in: hFile=0x5dc, lpBuffer=0x256e460*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x256e460*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.082] WriteFile (in: hFile=0x5dc, lpBuffer=0x257490c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257490c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.140] WriteFile (in: hFile=0x5dc, lpBuffer=0x257ad18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257ad18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.146] WriteFile (in: hFile=0x5dc, lpBuffer=0x2581b84*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2581b84*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.152] WriteFile (in: hFile=0x5dc, lpBuffer=0x2588058*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2588058*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.165] WriteFile (in: hFile=0x5dc, lpBuffer=0x25941d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25941d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.212] WriteFile (in: hFile=0x5dc, lpBuffer=0x259aa04*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259aa04*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.228] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a1f2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a1f2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.229] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a7b84*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a7b84*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.252] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ad040*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ad040*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.253] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b28f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b28f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.255] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b7cac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b7cac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.256] WriteFile (in: hFile=0x5dc, lpBuffer=0x25bd5ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bd5ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.257] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c308c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c308c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.258] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c9f08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c9f08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.262] WriteFile (in: hFile=0x5dc, lpBuffer=0x25cef8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cef8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.263] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d43a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d43a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.264] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d8f50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d8f50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.266] WriteFile (in: hFile=0x5dc, lpBuffer=0x25dde84*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25dde84*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.267] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e2e28*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e2e28*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.268] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e8b14*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e8b14*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.271] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ee33c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ee33c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.272] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f36ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f36ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.273] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f8018*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f8018*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.274] WriteFile (in: hFile=0x5dc, lpBuffer=0x25fca8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fca8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.276] WriteFile (in: hFile=0x5dc, lpBuffer=0x26020e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26020e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.277] WriteFile (in: hFile=0x5dc, lpBuffer=0x2607664*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2607664*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.278] WriteFile (in: hFile=0x5dc, lpBuffer=0x260cc58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260cc58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.280] WriteFile (in: hFile=0x5dc, lpBuffer=0x2612234*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2612234*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.281] WriteFile (in: hFile=0x5dc, lpBuffer=0x26178c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26178c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.283] WriteFile (in: hFile=0x5dc, lpBuffer=0x261cf24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261cf24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.284] WriteFile (in: hFile=0x5dc, lpBuffer=0x2622638*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2622638*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.296] WriteFile (in: hFile=0x5dc, lpBuffer=0x2627e5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2627e5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.297] WriteFile (in: hFile=0x5dc, lpBuffer=0x262d6c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262d6c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.298] WriteFile (in: hFile=0x5dc, lpBuffer=0x2633008*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2633008*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.300] WriteFile (in: hFile=0x5dc, lpBuffer=0x2638514*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2638514*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.301] WriteFile (in: hFile=0x5dc, lpBuffer=0x263d9e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263d9e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.302] WriteFile (in: hFile=0x5dc, lpBuffer=0x26430c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26430c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.304] WriteFile (in: hFile=0x5dc, lpBuffer=0x26488b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26488b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.305] WriteFile (in: hFile=0x5dc, lpBuffer=0x264e0bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264e0bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.306] WriteFile (in: hFile=0x5dc, lpBuffer=0x2653be8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2653be8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.307] WriteFile (in: hFile=0x5dc, lpBuffer=0x26597cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26597cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.310] WriteFile (in: hFile=0x5dc, lpBuffer=0x265eff8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265eff8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.312] WriteFile (in: hFile=0x5dc, lpBuffer=0x2664584*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2664584*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.313] WriteFile (in: hFile=0x5dc, lpBuffer=0x2669cf0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2669cf0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.314] WriteFile (in: hFile=0x5dc, lpBuffer=0x266e71c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266e71c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.330] WriteFile (in: hFile=0x5dc, lpBuffer=0x2674c48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2674c48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.332] WriteFile (in: hFile=0x5dc, lpBuffer=0x2678dbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2678dbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.333] WriteFile (in: hFile=0x5dc, lpBuffer=0x267c0f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267c0f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.334] WriteFile (in: hFile=0x5dc, lpBuffer=0x267f6b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267f6b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.335] WriteFile (in: hFile=0x5dc, lpBuffer=0x2682a98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2682a98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.338] WriteFile (in: hFile=0x5dc, lpBuffer=0x26869b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26869b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.339] WriteFile (in: hFile=0x5dc, lpBuffer=0x268a070*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268a070*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.340] WriteFile (in: hFile=0x5dc, lpBuffer=0x268d56c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268d56c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.368] WriteFile (in: hFile=0x5dc, lpBuffer=0x2691ff4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2691ff4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.382] WriteFile (in: hFile=0x5dc, lpBuffer=0x2695ed8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2695ed8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.383] WriteFile (in: hFile=0x5dc, lpBuffer=0x269a054*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269a054*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.385] WriteFile (in: hFile=0x5dc, lpBuffer=0x269d5c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269d5c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.389] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a18ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a18ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.390] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a5efc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a5efc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.392] WriteFile (in: hFile=0x5dc, lpBuffer=0x26aa060*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26aa060*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.393] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ae494*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ae494*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.395] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b24c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b24c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.397] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b61d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b61d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.399] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bbec4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bbec4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.401] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c1c28*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c1c28*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.403] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c63b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c63b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.405] WriteFile (in: hFile=0x5dc, lpBuffer=0x26caba8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26caba8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.407] WriteFile (in: hFile=0x5dc, lpBuffer=0x26cef90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cef90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.409] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d3378*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d3378*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.411] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d7854*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d7854*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.412] WriteFile (in: hFile=0x5dc, lpBuffer=0x26dc220*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26dc220*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.438] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e06fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e06fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.440] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e4bd8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e4bd8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.441] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e90b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e90b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.443] WriteFile (in: hFile=0x5dc, lpBuffer=0x26edaf0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26edaf0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.445] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f248c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f248c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.446] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f6a28*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f6a28*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.448] WriteFile (in: hFile=0x5dc, lpBuffer=0x26fafc4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fafc4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.450] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ff560*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ff560*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.483] WriteFile (in: hFile=0x5dc, lpBuffer=0x2703afc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2703afc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.485] WriteFile (in: hFile=0x5dc, lpBuffer=0x2708028*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2708028*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.486] WriteFile (in: hFile=0x5dc, lpBuffer=0x270c5c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270c5c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.488] WriteFile (in: hFile=0x5dc, lpBuffer=0x2710b60*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2710b60*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.525] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpFilePart=0x0) returned 0x5d
	[0095.525] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6f9369e2, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6f9369e2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0095.525] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x6f9369e2, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x6f9369e2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.525] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900a4472, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900a4472, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="0__CON~1.PRO")) returned 1
	[0095.525] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x0, dwReserved1=0x0, cFileName="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", cAlternateFileName="100__C~1.PRO")) returned 1
	[0095.525] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="101__C~1.PRO")) returned 1
	[0095.525] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", cAlternateFileName="102__C~1.PRO")) returned 1
	[0095.525] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", cAlternateFileName="103__C~1.PRO")) returned 1
	[0095.525] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="104__C~1.PRO")) returned 1
	[0095.525] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="105__C~1.PRO")) returned 1
	[0095.525] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", cAlternateFileName="106__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x0, cFileName="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", cAlternateFileName="107__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="108__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", cAlternateFileName="109__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90116bb1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90116bb1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90116bb1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="10__CO~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="110__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", cAlternateFileName="111__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="112__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="113__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", cAlternateFileName="114__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="115__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="116__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="117__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="118__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="119__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="11__CO~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="120__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", cAlternateFileName="121__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", cAlternateFileName="122__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", cAlternateFileName="123__C~1.PRO")) returned 1
	[0095.526] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="124__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="125__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="126__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27f, dwReserved0=0x0, dwReserved1=0x0, cFileName="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="127__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="128__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="129__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", cAlternateFileName="12__CO~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="130__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x0, cFileName="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="131__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="132__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x0, dwReserved1=0x0, cFileName="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="133__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="134__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="135__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="136__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="137__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="138__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="139__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", cAlternateFileName="13__CO~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="140__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x0, cFileName="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", cAlternateFileName="141__C~1.PRO")) returned 1
	[0095.527] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", cAlternateFileName="142__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", cAlternateFileName="143__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", cAlternateFileName="144__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", cAlternateFileName="145__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="146__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="147__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", cAlternateFileName="148__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", cAlternateFileName="149__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", cAlternateFileName="14__CO~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x0, cFileName="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="150__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x0, dwReserved1=0x0, cFileName="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="151__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="152__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", cAlternateFileName="153__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="154__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", cAlternateFileName="155__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="156__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="157__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="158__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="159__C~1.PRO")) returned 1
	[0095.528] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", cAlternateFileName="15__CO~1.PRO")) returned 1
	[0095.529] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", cAlternateFileName="160__C~1.PRO")) returned 1
	[0095.529] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="161__C~1.PRO")) returned 1
	[0095.529] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2df, dwReserved0=0x0, dwReserved1=0x0, cFileName="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", cAlternateFileName="162__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="163__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="164__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", cAlternateFileName="165__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", cAlternateFileName="166__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", cAlternateFileName="167__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", cAlternateFileName="168__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", cAlternateFileName="169__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", cAlternateFileName="16__CO~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", cAlternateFileName="170__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", cAlternateFileName="171__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", cAlternateFileName="172__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x0, cFileName="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", cAlternateFileName="173__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="174__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="175__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", cAlternateFileName="176__C~1.PRO")) returned 1
	[0095.687] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", cAlternateFileName="177__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", cAlternateFileName="178__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", cAlternateFileName="179__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", cAlternateFileName="17__CO~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", cAlternateFileName="180__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="181__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="182__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="183__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="184__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", cAlternateFileName="185__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", cAlternateFileName="186__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", cAlternateFileName="187__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", cAlternateFileName="188__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="189__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="18__CE~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="190__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="191__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="192__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="193__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="194__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="195__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="196__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="197__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="198__C~1.PRO")) returned 1
	[0095.688] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="199__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="19__CE~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="1__CON~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="200__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x308, dwReserved0=0x0, dwReserved1=0x0, cFileName="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="201__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="202__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="203__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="204__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="205__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x0, dwReserved1=0x0, cFileName="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="206__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="207__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="208__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="209__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="20__CO~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="210__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="211__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="212__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="213__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="214__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="215__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="216__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", cAlternateFileName="217__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x313, dwReserved0=0x0, dwReserved1=0x0, cFileName="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="218__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", cAlternateFileName="219__C~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="21__CO~1.PRO")) returned 1
	[0095.689] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="220__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x312, dwReserved0=0x0, dwReserved1=0x0, cFileName="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="221__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="222__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="223__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", cAlternateFileName="224__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", cAlternateFileName="225__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x343, dwReserved0=0x0, dwReserved1=0x0, cFileName="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="226__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="227__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="228__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="229__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="22__CO~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", cAlternateFileName="230__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="231__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", cAlternateFileName="232__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", cAlternateFileName="233__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="234__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="235__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x0, dwReserved1=0x0, cFileName="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="236__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="237__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908d698d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="238__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908d698d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="239__C~1.PRO")) returned 1
	[0095.690] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="23__CO~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908fcbf9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", cAlternateFileName="240__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908fcbf9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", cAlternateFileName="241__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", cAlternateFileName="242__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="243__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x302, dwReserved0=0x0, dwReserved1=0x0, cFileName="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="244__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="245__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", cAlternateFileName="246__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x0, dwReserved1=0x0, cFileName="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", cAlternateFileName="247__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", cAlternateFileName="248__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="249__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="24__CE~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="250__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="251__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="252__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x0, dwReserved1=0x0, cFileName="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", cAlternateFileName="253__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="254__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="255__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="256__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="257__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="258__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="259__C~1.PRO")) returned 1
	[0095.691] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="25__CE~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="260__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="261__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="262__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="263__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", cAlternateFileName="264__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", cAlternateFileName="265__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", cAlternateFileName="266__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="267__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", cAlternateFileName="268__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="269__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="26__CO~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x317, dwReserved0=0x0, dwReserved1=0x0, cFileName="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", cAlternateFileName="270__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x0, dwReserved1=0x0, cFileName="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", cAlternateFileName="271__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x0, dwReserved1=0x0, cFileName="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", cAlternateFileName="272__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", cAlternateFileName="273__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a541c1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a541c1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a541c1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", cAlternateFileName="274__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a541c1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a541c1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a541c1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", cAlternateFileName="275__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="276__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", cAlternateFileName="277__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", cAlternateFileName="278__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", cAlternateFileName="279__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="27__CO~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", cAlternateFileName="280__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", cAlternateFileName="281__C~1.PRO")) returned 1
	[0095.692] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", cAlternateFileName="282__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2df, dwReserved0=0x0, dwReserved1=0x0, cFileName="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", cAlternateFileName="283__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", cAlternateFileName="284__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", cAlternateFileName="285__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", cAlternateFileName="286__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", cAlternateFileName="287__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", cAlternateFileName="288__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", cAlternateFileName="289__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="28__CO~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", cAlternateFileName="290__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", cAlternateFileName="291__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x0, dwReserved1=0x0, cFileName="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="292__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", cAlternateFileName="293__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="294__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", cAlternateFileName="295__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", cAlternateFileName="296__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="297__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="298__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="299__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x0, dwReserved1=0x0, cFileName="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="29__CO~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="2__CON~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="300__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="301__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", cAlternateFileName="302__C~1.PRO")) returned 1
	[0095.693] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="303__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="304__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", cAlternateFileName="305__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", cAlternateFileName="306__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x0, dwReserved1=0x0, cFileName="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", cAlternateFileName="307__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x0, cFileName="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", cAlternateFileName="308__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="309__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35b, dwReserved0=0x0, dwReserved1=0x0, cFileName="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="30__CO~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", cAlternateFileName="310__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", cAlternateFileName="311__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", cAlternateFileName="312__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", cAlternateFileName="313__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="314__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28f, dwReserved0=0x0, dwReserved1=0x0, cFileName="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="315__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="316__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="317__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="318__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", cAlternateFileName="319__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x363, dwReserved0=0x0, dwReserved1=0x0, cFileName="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="31__CO~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", cAlternateFileName="320__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", cAlternateFileName="321__C~1.PRO")) returned 1
	[0095.694] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", cAlternateFileName="322__C~1.PRO")) returned 1
	[0095.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.702] WriteFile (in: hFile=0x5dc, lpBuffer=0x2582ca4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2582ca4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.704] WriteFile (in: hFile=0x5dc, lpBuffer=0x2587240*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2587240*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.706] WriteFile (in: hFile=0x5dc, lpBuffer=0x258b71c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258b71c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.708] WriteFile (in: hFile=0x5dc, lpBuffer=0x2591ad4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2591ad4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.711] WriteFile (in: hFile=0x5dc, lpBuffer=0x25953f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25953f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.713] WriteFile (in: hFile=0x5dc, lpBuffer=0x259978c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259978c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.715] WriteFile (in: hFile=0x5dc, lpBuffer=0x259d41c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259d41c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.782] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a2300*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a2300*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.858] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a598c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a598c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.860] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a931c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a931c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.862] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ac820*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ac820*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.865] WriteFile (in: hFile=0x5dc, lpBuffer=0x25aff84*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25aff84*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.870] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b658c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b658c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.872] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b9ed8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b9ed8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.889] WriteFile (in: hFile=0x5dc, lpBuffer=0x25be6f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25be6f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.892] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c24bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c24bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.895] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c5d90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c5d90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.910] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d1cf8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d1cf8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.922] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d64b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d64b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.924] WriteFile (in: hFile=0x5dc, lpBuffer=0x25da084*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25da084*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.926] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ddc54*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ddc54*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.928] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e184c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e184c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.930] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e5620*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e5620*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.941] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ea9d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ea9d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.943] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ee7ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ee7ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.945] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f1ef0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f1ef0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.948] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f5cac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f5cac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.949] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f9580*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f9580*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.952] WriteFile (in: hFile=0x5dc, lpBuffer=0x25fd1dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fd1dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.954] WriteFile (in: hFile=0x5dc, lpBuffer=0x2600bf4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2600bf4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0095.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0095.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0095.955] WriteFile (in: hFile=0x5dc, lpBuffer=0x2604468*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2604468*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0095.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0095.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0095.959] WriteFile (in: hFile=0x5dc, lpBuffer=0x260b37c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260b37c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.087] WriteFile (in: hFile=0x5dc, lpBuffer=0x2612a50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2612a50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.089] WriteFile (in: hFile=0x5dc, lpBuffer=0x26166e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26166e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.154] WriteFile (in: hFile=0x5dc, lpBuffer=0x262d6dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262d6dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.156] WriteFile (in: hFile=0x5dc, lpBuffer=0x2630d10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2630d10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.187] WriteFile (in: hFile=0x5dc, lpBuffer=0x264b4f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264b4f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.210] WriteFile (in: hFile=0x5dc, lpBuffer=0x267e450*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267e450*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.225] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b181c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b181c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.264] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b5390*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b5390*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.266] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b9054*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b9054*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.268] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bc7ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bc7ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.270] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c05f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c05f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.272] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c3dbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c3dbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.273] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c7270*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c7270*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.280] WriteFile (in: hFile=0x5dc, lpBuffer=0x26cb2e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cb2e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.282] WriteFile (in: hFile=0x5dc, lpBuffer=0x26cf0c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cf0c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.284] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d2f18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d2f18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.285] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d68f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d68f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.288] WriteFile (in: hFile=0x5dc, lpBuffer=0x26da994*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26da994*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.290] WriteFile (in: hFile=0x5dc, lpBuffer=0x26dea34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26dea34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.292] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e2ad4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e2ad4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.293] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e6b74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e6b74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.296] WriteFile (in: hFile=0x5dc, lpBuffer=0x26eafd4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26eafd4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.297] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ef004*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ef004*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.358] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f310c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f310c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.359] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f6610*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f6610*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.361] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f9e88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f9e88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.363] WriteFile (in: hFile=0x5dc, lpBuffer=0x26fd4ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fd4ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.376] WriteFile (in: hFile=0x5dc, lpBuffer=0x270218c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270218c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.378] WriteFile (in: hFile=0x5dc, lpBuffer=0x2705e20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2705e20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.379] WriteFile (in: hFile=0x5dc, lpBuffer=0x2709b64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2709b64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.380] WriteFile (in: hFile=0x5dc, lpBuffer=0x270d8a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270d8a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.381] WriteFile (in: hFile=0x5dc, lpBuffer=0x271164c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271164c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.382] WriteFile (in: hFile=0x5dc, lpBuffer=0x2715c6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2715c6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.383] WriteFile (in: hFile=0x5dc, lpBuffer=0x2719a20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2719a20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.385] WriteFile (in: hFile=0x5dc, lpBuffer=0x271d714*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271d714*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.391] WriteFile (in: hFile=0x5dc, lpBuffer=0x2721db4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2721db4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.393] WriteFile (in: hFile=0x5dc, lpBuffer=0x2725688*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2725688*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.394] WriteFile (in: hFile=0x5dc, lpBuffer=0x272900c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272900c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.396] WriteFile (in: hFile=0x5dc, lpBuffer=0x272c990*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272c990*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.397] WriteFile (in: hFile=0x5dc, lpBuffer=0x2730374*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2730374*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.438] WriteFile (in: hFile=0x5dc, lpBuffer=0x2734d74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2734d74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.439] WriteFile (in: hFile=0x5dc, lpBuffer=0x2738768*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2738768*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.441] WriteFile (in: hFile=0x5dc, lpBuffer=0x273c09c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273c09c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.443] WriteFile (in: hFile=0x5dc, lpBuffer=0x273fa24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273fa24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.456] WriteFile (in: hFile=0x5dc, lpBuffer=0x2744704*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2744704*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.457] WriteFile (in: hFile=0x5dc, lpBuffer=0x2748398*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2748398*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.459] WriteFile (in: hFile=0x5dc, lpBuffer=0x274c0dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274c0dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.460] WriteFile (in: hFile=0x5dc, lpBuffer=0x274fe20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274fe20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.462] WriteFile (in: hFile=0x5dc, lpBuffer=0x2753bc4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2753bc4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.463] WriteFile (in: hFile=0x5dc, lpBuffer=0x27581e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27581e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.464] WriteFile (in: hFile=0x5dc, lpBuffer=0x275bf98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275bf98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.465] WriteFile (in: hFile=0x5dc, lpBuffer=0x275fc8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275fc8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.470] WriteFile (in: hFile=0x5dc, lpBuffer=0x27643cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27643cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.473] WriteFile (in: hFile=0x5dc, lpBuffer=0x2767d00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2767d00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.475] WriteFile (in: hFile=0x5dc, lpBuffer=0x276b6e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276b6e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.477] WriteFile (in: hFile=0x5dc, lpBuffer=0x276f0c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276f0c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.478] WriteFile (in: hFile=0x5dc, lpBuffer=0x2772b0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2772b0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.479] WriteFile (in: hFile=0x5dc, lpBuffer=0x2776cac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2776cac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.480] WriteFile (in: hFile=0x5dc, lpBuffer=0x277a700*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277a700*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.509] WriteFile (in: hFile=0x5dc, lpBuffer=0x277e208*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277e208*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.588] WriteFile (in: hFile=0x5dc, lpBuffer=0x27828f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27828f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.590] WriteFile (in: hFile=0x5dc, lpBuffer=0x27861b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27861b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.592] WriteFile (in: hFile=0x5dc, lpBuffer=0x2789ae8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2789ae8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.594] WriteFile (in: hFile=0x5dc, lpBuffer=0x278d41c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278d41c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.595] WriteFile (in: hFile=0x5dc, lpBuffer=0x2790db0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2790db0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.596] WriteFile (in: hFile=0x5dc, lpBuffer=0x2794e80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2794e80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.597] WriteFile (in: hFile=0x5dc, lpBuffer=0x2798864*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2798864*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.599] WriteFile (in: hFile=0x5dc, lpBuffer=0x279c188*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279c188*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.608] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a0668*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a0668*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.610] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a3e6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a3e6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.612] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a76e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a76e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.614] WriteFile (in: hFile=0x5dc, lpBuffer=0x27aaf54*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27aaf54*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.615] WriteFile (in: hFile=0x5dc, lpBuffer=0x27ae828*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ae828*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.616] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b27f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b27f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.618] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b611c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b611c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.619] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b9980*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b9980*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.655] WriteFile (in: hFile=0x5dc, lpBuffer=0x27be660*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27be660*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.657] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c22f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c22f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.659] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c6038*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c6038*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.661] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c9d7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c9d7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.662] WriteFile (in: hFile=0x5dc, lpBuffer=0x27cdb20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27cdb20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.664] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d2140*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d2140*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.665] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d5ef4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d5ef4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.666] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d9be8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d9be8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.768] WriteFile (in: hFile=0x5dc, lpBuffer=0x25812bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25812bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.770] WriteFile (in: hFile=0x5dc, lpBuffer=0x25857ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25857ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.772] WriteFile (in: hFile=0x5dc, lpBuffer=0x2589ca8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2589ca8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.796] WriteFile (in: hFile=0x5dc, lpBuffer=0x258d5dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258d5dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.797] WriteFile (in: hFile=0x5dc, lpBuffer=0x25917e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25917e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.799] WriteFile (in: hFile=0x5dc, lpBuffer=0x25958b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25958b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.800] WriteFile (in: hFile=0x5dc, lpBuffer=0x259b1dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259b1dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.802] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a0bf4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a0bf4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.809] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a513c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a513c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.812] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a902c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a902c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.814] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ac890*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ac890*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.816] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b4240*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b4240*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.817] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b8778*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b8778*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.819] WriteFile (in: hFile=0x5dc, lpBuffer=0x25bdb7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bdb7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.822] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c1970*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c1970*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.823] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c5184*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c5184*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.868] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c990c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c990c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.871] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d1924*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d1924*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.872] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d5b34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d5b34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.873] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d9cfc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d9cfc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.875] WriteFile (in: hFile=0x5dc, lpBuffer=0x25dd8cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25dd8cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.876] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e1b4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e1b4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.877] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e574c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e574c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.879] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ec4b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ec4b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.880] WriteFile (in: hFile=0x5dc, lpBuffer=0x25efb44*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25efb44*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.882] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f39c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f39c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.883] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f71d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f71d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.886] WriteFile (in: hFile=0x5dc, lpBuffer=0x25fba28*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fba28*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.887] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ff6d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ff6d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.889] WriteFile (in: hFile=0x5dc, lpBuffer=0x2603624*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2603624*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.890] WriteFile (in: hFile=0x5dc, lpBuffer=0x2609c2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2609c2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.891] WriteFile (in: hFile=0x5dc, lpBuffer=0x260d430*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260d430*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.905] WriteFile (in: hFile=0x5dc, lpBuffer=0x26129e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26129e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.907] WriteFile (in: hFile=0x5dc, lpBuffer=0x2616578*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2616578*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.908] WriteFile (in: hFile=0x5dc, lpBuffer=0x261eea0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261eea0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.929] WriteFile (in: hFile=0x5dc, lpBuffer=0x262bea0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262bea0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.930] WriteFile (in: hFile=0x5dc, lpBuffer=0x262f8f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262f8f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0096.998] WriteFile (in: hFile=0x5dc, lpBuffer=0x263448c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263448c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.000] WriteFile (in: hFile=0x5dc, lpBuffer=0x2637f30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2637f30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.001] WriteFile (in: hFile=0x5dc, lpBuffer=0x2649c60*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2649c60*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.006] WriteFile (in: hFile=0x5dc, lpBuffer=0x264e9ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264e9ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.044] WriteFile (in: hFile=0x5dc, lpBuffer=0x2652460*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2652460*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.045] WriteFile (in: hFile=0x5dc, lpBuffer=0x265e008*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265e008*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.047] WriteFile (in: hFile=0x5dc, lpBuffer=0x2670d90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2670d90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.049] WriteFile (in: hFile=0x5dc, lpBuffer=0x267c328*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267c328*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.076] WriteFile (in: hFile=0x5dc, lpBuffer=0x26818e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26818e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.077] WriteFile (in: hFile=0x5dc, lpBuffer=0x2689938*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2689938*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.082] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a4324*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a4324*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.087] WriteFile (in: hFile=0x5dc, lpBuffer=0x26af6f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26af6f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.089] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b3ee0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b3ee0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.090] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b84f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b84f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.092] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bc0a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bc0a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.093] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c02a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c02a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.098] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c5024*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c5024*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.100] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c9b58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c9b58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.101] WriteFile (in: hFile=0x5dc, lpBuffer=0x26cd9dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cd9dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.113] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d2b4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d2b4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.153] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d760c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d760c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.155] WriteFile (in: hFile=0x5dc, lpBuffer=0x26db14c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26db14c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.157] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ded8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ded8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.158] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e295c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e295c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.160] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e6768*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e6768*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.166] WriteFile (in: hFile=0x5dc, lpBuffer=0x26eb54c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26eb54c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.167] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ef1a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ef1a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.168] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f2d48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f2d48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.182] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f7e24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f7e24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.183] WriteFile (in: hFile=0x5dc, lpBuffer=0x26fb808*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fb808*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.213] WriteFile (in: hFile=0x5dc, lpBuffer=0x2700314*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2700314*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.215] WriteFile (in: hFile=0x5dc, lpBuffer=0x2703d68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2703d68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.216] WriteFile (in: hFile=0x5dc, lpBuffer=0x270781c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270781c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.229] WriteFile (in: hFile=0x5dc, lpBuffer=0x270c38c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270c38c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.264] WriteFile (in: hFile=0x5dc, lpBuffer=0x270fe90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270fe90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.266] WriteFile (in: hFile=0x5dc, lpBuffer=0x271504c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271504c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.272] WriteFile (in: hFile=0x5dc, lpBuffer=0x271978c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271978c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.274] WriteFile (in: hFile=0x5dc, lpBuffer=0x271d0c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271d0c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.275] WriteFile (in: hFile=0x5dc, lpBuffer=0x2720f30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2720f30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.277] WriteFile (in: hFile=0x5dc, lpBuffer=0x2724914*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2724914*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.279] WriteFile (in: hFile=0x5dc, lpBuffer=0x2728358*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2728358*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.283] WriteFile (in: hFile=0x5dc, lpBuffer=0x272cdf8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272cdf8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.285] WriteFile (in: hFile=0x5dc, lpBuffer=0x273084c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273084c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.287] WriteFile (in: hFile=0x5dc, lpBuffer=0x27349c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27349c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.354] WriteFile (hFile=0x5dc, lpBuffer=0x27391a4, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0) 
	[0097.354] WriteFile (in: hFile=0x5dc, lpBuffer=0x27391a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27391a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.355] WriteFile (in: hFile=0x5dc, lpBuffer=0x273d92c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273d92c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.357] WriteFile (in: hFile=0x5dc, lpBuffer=0x2741c7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2741c7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.360] WriteFile (in: hFile=0x5dc, lpBuffer=0x27456c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27456c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.361] WriteFile (in: hFile=0x5dc, lpBuffer=0x2749164*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2749164*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.368] WriteFile (in: hFile=0x5dc, lpBuffer=0x274dca4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274dca4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.370] WriteFile (in: hFile=0x5dc, lpBuffer=0x2751758*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2751758*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.372] WriteFile (in: hFile=0x5dc, lpBuffer=0x27569b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27569b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.378] WriteFile (in: hFile=0x5dc, lpBuffer=0x275b1b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275b1b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.380] WriteFile (in: hFile=0x5dc, lpBuffer=0x275eb98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275eb98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.382] WriteFile (in: hFile=0x5dc, lpBuffer=0x2763078*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2763078*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.383] WriteFile (in: hFile=0x5dc, lpBuffer=0x2766acc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2766acc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.405] WriteFile (in: hFile=0x5dc, lpBuffer=0x276a580*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276a580*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.411] WriteFile (in: hFile=0x5dc, lpBuffer=0x276f0f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276f0f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.414] WriteFile (in: hFile=0x5dc, lpBuffer=0x2772bf4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2772bf4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.416] WriteFile (in: hFile=0x5dc, lpBuffer=0x2776904*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2776904*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.422] WriteFile (in: hFile=0x5dc, lpBuffer=0x277b1a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277b1a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.424] WriteFile (in: hFile=0x5dc, lpBuffer=0x278021c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278021c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.426] WriteFile (in: hFile=0x5dc, lpBuffer=0x2783cd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2783cd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.429] WriteFile (in: hFile=0x5dc, lpBuffer=0x2787784*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2787784*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.431] WriteFile (in: hFile=0x5dc, lpBuffer=0x278b298*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278b298*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.438] WriteFile (in: hFile=0x5dc, lpBuffer=0x278fea8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278fea8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.440] WriteFile (in: hFile=0x5dc, lpBuffer=0x27942e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27942e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.483] WriteFile (in: hFile=0x5dc, lpBuffer=0x2797d84*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2797d84*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.490] WriteFile (in: hFile=0x5dc, lpBuffer=0x279c564*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279c564*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.492] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a0328*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a0328*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.494] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a47f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a47f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.496] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a8238*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a8238*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.497] WriteFile (in: hFile=0x5dc, lpBuffer=0x27abcdc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27abcdc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.502] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b1060*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b1060*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.504] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b4b14*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b4b14*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.505] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b8508*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b8508*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.528] WriteFile (in: hFile=0x5dc, lpBuffer=0x27bd430*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27bd430*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.576] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c0f34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c0f34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.579] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c4aa8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c4aa8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.581] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c861c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c861c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.582] WriteFile (in: hFile=0x5dc, lpBuffer=0x27cc1f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27cc1f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.587] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d1520*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d1520*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.658] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d5144*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d5144*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.660] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d9204*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d9204*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.673] WriteFile (in: hFile=0x5dc, lpBuffer=0x27ddf24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ddf24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.675] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e1978*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e1978*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.676] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e547c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e547c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.677] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e8f80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e8f80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.679] WriteFile (in: hFile=0x5dc, lpBuffer=0x27ecae4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ecae4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.681] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f0e04*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f0e04*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.682] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f4978*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f4978*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.684] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f842c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f842c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.689] WriteFile (in: hFile=0x5dc, lpBuffer=0x27fceac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27fceac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.691] WriteFile (in: hFile=0x5dc, lpBuffer=0x2800a10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2800a10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.693] WriteFile (in: hFile=0x5dc, lpBuffer=0x28045e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28045e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.694] WriteFile (in: hFile=0x5dc, lpBuffer=0x28081b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28081b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.696] WriteFile (in: hFile=0x5dc, lpBuffer=0x280bdec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280bdec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.697] WriteFile (in: hFile=0x5dc, lpBuffer=0x281023c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x281023c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.699] WriteFile (in: hFile=0x5dc, lpBuffer=0x2813ec0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2813ec0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.717] WriteFile (in: hFile=0x5dc, lpBuffer=0x2817a84*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2817a84*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.722] WriteFile (in: hFile=0x5dc, lpBuffer=0x281c264*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x281c264*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.723] WriteFile (in: hFile=0x5dc, lpBuffer=0x281fbf8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x281fbf8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.725] WriteFile (in: hFile=0x5dc, lpBuffer=0x282363c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x282363c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.727] WriteFile (in: hFile=0x5dc, lpBuffer=0x2827080*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2827080*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.729] WriteFile (in: hFile=0x5dc, lpBuffer=0x282ab24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x282ab24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.734] WriteFile (in: hFile=0x5dc, lpBuffer=0x282f664*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x282f664*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.736] WriteFile (in: hFile=0x5dc, lpBuffer=0x2833118*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2833118*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.737] WriteFile (in: hFile=0x5dc, lpBuffer=0x2836b0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2836b0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.742] WriteFile (in: hFile=0x5dc, lpBuffer=0x283b1cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x283b1cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.744] WriteFile (in: hFile=0x5dc, lpBuffer=0x283eaf0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x283eaf0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.745] WriteFile (in: hFile=0x5dc, lpBuffer=0x2842484*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2842484*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.822] WriteFile (in: hFile=0x5dc, lpBuffer=0x2845e18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2845e18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.823] WriteFile (in: hFile=0x5dc, lpBuffer=0x284980c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x284980c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.828] WriteFile (in: hFile=0x5dc, lpBuffer=0x284e23c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x284e23c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.830] WriteFile (in: hFile=0x5dc, lpBuffer=0x2851c80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2851c80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.832] WriteFile (in: hFile=0x5dc, lpBuffer=0x2855604*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2855604*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.833] WriteFile (in: hFile=0x5dc, lpBuffer=0x285a158*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x285a158*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.835] WriteFile (in: hFile=0x5dc, lpBuffer=0x285dadc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x285dadc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.839] WriteFile (in: hFile=0x5dc, lpBuffer=0x286306c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x286306c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.868] WriteFile (in: hFile=0x5dc, lpBuffer=0x2868010*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2868010*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.870] WriteFile (in: hFile=0x5dc, lpBuffer=0x286ba64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x286ba64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.891] WriteFile (in: hFile=0x5dc, lpBuffer=0x2870534*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2870534*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0097.999] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0097.999] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x56
	[0097.999] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbc3e2f6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfbc3e2f6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbc3e2f6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0098.000] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0098.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0098.000] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\systemappdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.000] GetFileType (hFile=0x2ec) returned 0x1
	[0098.000] GetFileType (hFile=0x2ec) returned 0x1
	[0098.000] WriteFile (in: hFile=0x2ec, lpBuffer=0x25812bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25812bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.001] CloseHandle (hObject=0x2ec) returned 1
	[0098.001] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x52
	[0098.001] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0098.002] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.002] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.002] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0098.002] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x52
	[0098.002] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.002] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.002] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.003] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\TempState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\TempState\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0098.003] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\TempState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\tempstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.003] GetFileType (hFile=0x2ec) returned 0x1
	[0098.003] GetFileType (hFile=0x2ec) returned 0x1
	[0098.003] WriteFile (in: hFile=0x2ec, lpBuffer=0x25857ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25857ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.004] CloseHandle (hObject=0x2ec) returned 1
	[0098.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x53
	[0098.005] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0098.006] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.006] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.006] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.007] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.007] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.007] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.007] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0098.008] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x53
	[0098.008] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0098.008] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.008] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.009] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.009] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.009] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.009] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0098.009] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0098.010] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0098.010] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\ac\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.011] GetFileType (hFile=0x2ec) returned 0x1
	[0098.011] GetFileType (hFile=0x2ec) returned 0x1
	[0098.011] WriteFile (in: hFile=0x2ec, lpBuffer=0x258a8b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258a8b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.015] CloseHandle (hObject=0x2ec) returned 1
	[0098.015] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x58
	[0098.015] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0098.016] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.016] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.016] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0098.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x58
	[0098.016] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0098.016] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.016] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.016] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0098.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0098.017] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.017] GetFileType (hFile=0x2ec) returned 0x1
	[0098.017] GetFileType (hFile=0x2ec) returned 0x1
	[0098.017] WriteFile (in: hFile=0x2ec, lpBuffer=0x2590064*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2590064*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.018] CloseHandle (hObject=0x2ec) returned 1
	[0098.018] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x5b
	[0098.018] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0098.018] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.018] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.019] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0098.019] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x5b
	[0098.019] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.019] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.019] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.019] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.019] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0098.019] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\localcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.020] GetFileType (hFile=0x2ec) returned 0x1
	[0098.020] GetFileType (hFile=0x2ec) returned 0x1
	[0098.020] WriteFile (in: hFile=0x2ec, lpBuffer=0x2594108*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2594108*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.021] CloseHandle (hObject=0x2ec) returned 1
	[0098.021] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x5b
	[0098.021] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.021] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.021] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.021] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.021] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x5b
	[0098.021] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0098.022] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.022] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.022] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0098.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0098.022] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\localstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.023] GetFileType (hFile=0x2ec) returned 0x1
	[0098.023] GetFileType (hFile=0x2ec) returned 0x1
	[0098.023] WriteFile (in: hFile=0x2ec, lpBuffer=0x2598bf4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2598bf4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.024] CloseHandle (hObject=0x2ec) returned 1
	[0098.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x5d
	[0098.024] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0098.024] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.024] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.024] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0098.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x5d
	[0098.025] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0098.025] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.025] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.025] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0098.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0098.025] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\roamingstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.025] GetFileType (hFile=0x2ec) returned 0x1
	[0098.026] GetFileType (hFile=0x2ec) returned 0x1
	[0098.026] WriteFile (in: hFile=0x2ec, lpBuffer=0x259c9a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259c9a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.026] CloseHandle (hObject=0x2ec) returned 1
	[0098.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x59
	[0098.027] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0098.027] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.027] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.027] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.027] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0
	[0098.027] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0098.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x59
	[0098.028] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0098.028] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.028] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.028] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.028] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.028] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0098.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x65
	[0098.028] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.029] GetFileType (hFile=0x2ec) returned 0x1
	[0098.029] GetFileType (hFile=0x2ec) returned 0x1
	[0098.030] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a3a08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a3a08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.030] CloseHandle (hObject=0x2ec) returned 1
	[0098.031] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x5e
	[0098.031] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0098.031] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.031] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.031] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0098.031] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x5e
	[0098.031] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0098.032] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.032] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.032] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0098.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0098.032] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\systemappdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.032] GetFileType (hFile=0x2ec) returned 0x1
	[0098.032] GetFileType (hFile=0x2ec) returned 0x1
	[0098.032] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a7c10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a7c10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.033] CloseHandle (hObject=0x2ec) returned 1
	[0098.033] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x5a
	[0098.033] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0098.034] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.034] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.034] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0098.034] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x5a
	[0098.034] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.034] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.035] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.035] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.035] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\TempState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\TempState\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0098.035] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\TempState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\tempstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.095] GetFileType (hFile=0x2ec) returned 0x1
	[0098.095] GetFileType (hFile=0x2ec) returned 0x1
	[0098.095] WriteFile (in: hFile=0x2ec, lpBuffer=0x25abbd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25abbd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.096] CloseHandle (hObject=0x2ec) returned 1
	[0098.096] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x4f
	[0098.096] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0098.096] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcafaf3be, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x124e2b77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#!001", cAlternateFileName="")) returned 1
	[0098.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcc74b84d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1318d398, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#!002", cAlternateFileName="")) returned 1
	[0098.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x926657f3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9268ba69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#!006", cAlternateFileName="")) returned 1
	[0098.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9af0a0eb, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9af0a0eb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#!121", cAlternateFileName="")) returned 1
	[0098.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xccdf6895, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a49a72f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xccdf70e6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a49a72f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xccdf7d9c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a49a72f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf07d8a0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcce3d76e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf8d9fb88, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0098.097] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1
	[0098.098] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.098] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.098] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0098.098] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x4f
	[0098.098] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0098.098] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.098] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcafaf3be, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x124e2b77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#!001", cAlternateFileName="")) returned 1
	[0098.098] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcc74b84d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1318d398, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#!002", cAlternateFileName="")) returned 1
	[0098.099] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x926657f3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9268ba69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#!006", cAlternateFileName="")) returned 1
	[0098.099] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9af0a0eb, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9af0a0eb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#!121", cAlternateFileName="")) returned 1
	[0098.099] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xccdf6895, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a49a72f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.099] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xccdf70e6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a49a72f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.099] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xccdf7d9c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a49a72f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.099] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf07d8a0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcce3d76e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf8d9fb88, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0098.099] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1
	[0098.100] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.100] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0098.100] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0098.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0098.100] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.101] GetFileType (hFile=0x2ec) returned 0x1
	[0098.101] GetFileType (hFile=0x2ec) returned 0x1
	[0098.101] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b4e50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b4e50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.102] CloseHandle (hObject=0x2ec) returned 1
	[0098.102] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x54
	[0098.102] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x332cdbf2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x332cdbf2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0098.103] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x332cdbf2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x332cdbf2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.103] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd59f82c3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd455dd5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd59ff7ff, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1
	[0098.103] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.103] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0098.103] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x54
	[0098.103] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x332cdbf2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x332cdbf2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0098.104] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x332cdbf2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x332cdbf2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.104] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd59f82c3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd455dd5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd59ff7ff, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1
	[0098.104] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd59f82c3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd455dd5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd59ff7ff, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0
	[0098.104] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0098.104] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0098.104] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.104] GetFileType (hFile=0x2ec) returned 0x1
	[0098.104] GetFileType (hFile=0x2ec) returned 0x1
	[0098.105] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b9388*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b9388*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.105] CloseHandle (hObject=0x2ec) returned 1
	[0098.106] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x57
	[0098.106] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e0f7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a428010, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0098.106] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e0f7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a428010, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.107] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e0f7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a428010, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.107] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0098.107] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x57
	[0098.107] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e0f7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a428010, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0098.107] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e0f7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a428010, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.107] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e0f7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a428010, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.108] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0098.108] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0098.108] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\localcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.108] GetFileType (hFile=0x2ec) returned 0x1
	[0098.108] GetFileType (hFile=0x2ec) returned 0x1
	[0098.108] WriteFile (in: hFile=0x2ec, lpBuffer=0x25bdb7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bdb7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.109] CloseHandle (hObject=0x2ec) returned 1
	[0098.109] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x57
	[0098.109] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x333666b9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x333666b9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0098.110] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x333666b9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x333666b9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.110] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x132e491b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd4e1bc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x132e491b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PinnedTiles", cAlternateFileName="PINNED~1")) returned 1
	[0098.110] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.110] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0098.110] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x57
	[0098.111] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x333666b9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x333666b9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.111] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x333666b9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x333666b9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.111] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x132e491b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd4e1bc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x132e491b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PinnedTiles", cAlternateFileName="PINNED~1")) returned 1
	[0098.111] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x132e491b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd4e1bc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x132e491b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PinnedTiles", cAlternateFileName="PINNED~1")) returned 0
	[0098.111] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.111] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0098.111] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\localstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.112] GetFileType (hFile=0x2ec) returned 0x1
	[0098.112] GetFileType (hFile=0x2ec) returned 0x1
	[0098.112] WriteFile (in: hFile=0x2ec, lpBuffer=0x25c217c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c217c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.113] CloseHandle (hObject=0x2ec) returned 1
	[0098.113] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x59
	[0098.113] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e21af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a401dd0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0098.113] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e21af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a401dd0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.113] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e21af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a401dd0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.114] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0098.114] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x59
	[0098.114] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e21af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a401dd0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0098.114] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e21af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a401dd0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.114] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e21af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a401dd0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.114] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0098.114] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", lpFilePart=0x0) returned 0x65
	[0098.114] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\roamingstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.115] GetFileType (hFile=0x2ec) returned 0x1
	[0098.115] GetFileType (hFile=0x2ec) returned 0x1
	[0098.115] WriteFile (in: hFile=0x2ec, lpBuffer=0x25c71e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c71e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.115] CloseHandle (hObject=0x2ec) returned 1
	[0098.116] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x55
	[0098.116] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.117] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.117] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6a44e278, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x6a44e278, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.117] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.117] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd82ba8b0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd82ba8b0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd82ba8b0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1
	[0098.117] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd82ba8b0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd82ba8b0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd82ba8b0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1
	[0098.118] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd82ba8b0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd82ba8b0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd82ba8b0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0
	[0098.118] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.118] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x55
	[0098.118] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0098.119] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.119] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6a44e278, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x6a44e278, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.120] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.120] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd82ba8b0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd82ba8b0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd82ba8b0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1
	[0098.120] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd82ba8b0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd82ba8b0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd82ba8b0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1
	[0098.120] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.120] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0098.121] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0098.121] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.122] GetFileType (hFile=0x2ec) returned 0x1
	[0098.122] GetFileType (hFile=0x2ec) returned 0x1
	[0098.122] WriteFile (in: hFile=0x2ec, lpBuffer=0x25d1118*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d1118*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.122] CloseHandle (hObject=0x2ec) returned 1
	[0098.123] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x5a
	[0098.123] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4fe9ef, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc4fe9ef, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.123] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4fe9ef, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc4fe9ef, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.123] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4fe9ef, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc4fe9ef, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.123] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.123] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x5a
	[0098.123] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4fe9ef, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc4fe9ef, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.124] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4fe9ef, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc4fe9ef, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.124] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4fe9ef, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc4fe9ef, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.124] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.124] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0098.124] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\systemappdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.124] GetFileType (hFile=0x2ec) returned 0x1
	[0098.124] GetFileType (hFile=0x2ec) returned 0x1
	[0098.124] WriteFile (in: hFile=0x2ec, lpBuffer=0x25d5328*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d5328*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.130] CloseHandle (hObject=0x2ec) returned 1
	[0098.131] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x56
	[0098.131] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0098.131] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.131] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.131] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0098.131] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x56
	[0098.131] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.132] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.132] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.132] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0098.132] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\tempstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.133] GetFileType (hFile=0x2ec) returned 0x1
	[0098.133] GetFileType (hFile=0x2ec) returned 0x1
	[0098.133] WriteFile (in: hFile=0x2ec, lpBuffer=0x25d94f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d94f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.133] CloseHandle (hObject=0x2ec) returned 1
	[0098.134] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x54
	[0098.134] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a2f42, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33556550, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33556550, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0098.464] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a2f42, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33556550, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33556550, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.464] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8670, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.465] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.465] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f951f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.465] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f9a49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.465] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.465] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0098.466] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x54
	[0098.466] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a2f42, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33556550, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33556550, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0098.467] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a2f42, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33556550, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33556550, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.467] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8670, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.467] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.467] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f951f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.467] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f9a49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.467] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f9a49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0098.467] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0098.468] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0098.468] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\ac\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.472] GetFileType (hFile=0x2ec) returned 0x1
	[0098.472] GetFileType (hFile=0x2ec) returned 0x1
	[0098.472] WriteFile (in: hFile=0x2ec, lpBuffer=0x25812bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25812bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.473] CloseHandle (hObject=0x2ec) returned 1
	[0098.473] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x59
	[0098.473] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fac32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0098.473] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fac32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.473] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fac32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.474] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0098.474] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x59
	[0098.474] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fac32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0098.474] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fac32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.474] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fac32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.474] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0098.474] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x65
	[0098.474] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.474] GetFileType (hFile=0x2ec) returned 0x1
	[0098.474] GetFileType (hFile=0x2ec) returned 0x1
	[0098.474] WriteFile (in: hFile=0x2ec, lpBuffer=0x25857ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25857ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.475] CloseHandle (hObject=0x2ec) returned 1
	[0098.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x5c
	[0098.475] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fb51b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31897f18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0098.476] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fb51b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31897f18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.476] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fb51b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31897f18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.476] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0098.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x5c
	[0098.476] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fb51b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31897f18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0098.476] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fb51b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31897f18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.476] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fb51b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31897f18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.476] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0098.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0098.476] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\localcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.477] GetFileType (hFile=0x2ec) returned 0x1
	[0098.477] GetFileType (hFile=0x2ec) returned 0x1
	[0098.477] WriteFile (in: hFile=0x2ec, lpBuffer=0x2589ca8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2589ca8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.478] CloseHandle (hObject=0x2ec) returned 1
	[0098.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x5c
	[0098.478] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fbb01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.478] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fbb01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.478] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fbb01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.479] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x5c
	[0098.479] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fbb01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0098.479] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fbb01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.479] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fbb01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.479] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0098.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0098.480] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\localstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.481] GetFileType (hFile=0x2ec) returned 0x1
	[0098.481] GetFileType (hFile=0x2ec) returned 0x1
	[0098.481] WriteFile (in: hFile=0x2ec, lpBuffer=0x258d86c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258d86c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.482] CloseHandle (hObject=0x2ec) returned 1
	[0098.482] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x5e
	[0098.482] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fc459, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0098.483] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fc459, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.483] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fc459, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.483] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0098.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x5e
	[0098.483] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fc459, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0098.483] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fc459, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.483] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fc459, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.483] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0098.484] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0098.484] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\roamingstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.484] GetFileType (hFile=0x2ec) returned 0x1
	[0098.484] GetFileType (hFile=0x2ec) returned 0x1
	[0098.484] WriteFile (in: hFile=0x2ec, lpBuffer=0x2591c88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2591c88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.485] CloseHandle (hObject=0x2ec) returned 1
	[0098.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x5a
	[0098.485] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0098.487] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.487] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31930880, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.487] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffa61aaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffa61aaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.487] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80ad41ac, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x80ad41ac, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x80ad41ac, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1
	[0098.487] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80ad41ac, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x80ad41ac, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x80ad41ac, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1
	[0098.487] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80ad41ac, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x80ad41ac, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x80ad41ac, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0
	[0098.488] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0098.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x5a
	[0098.488] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0098.489] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.489] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31930880, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.489] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffa61aaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffa61aaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.489] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80ad41ac, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x80ad41ac, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x80ad41ac, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1
	[0098.489] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80ad41ac, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x80ad41ac, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x80ad41ac, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1
	[0098.490] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.490] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0098.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0098.490] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.491] GetFileType (hFile=0x2ec) returned 0x1
	[0098.492] GetFileType (hFile=0x2ec) returned 0x1
	[0098.492] WriteFile (in: hFile=0x2ec, lpBuffer=0x2597fe4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2597fe4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.493] CloseHandle (hObject=0x2ec) returned 1
	[0098.493] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x5f
	[0098.493] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6917fc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf6917fc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf6917fc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0098.494] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6917fc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf6917fc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf6917fc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.494] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6917fc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf6917fc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf6917fc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.494] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0098.494] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x5f
	[0098.494] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6917fc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf6917fc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf6917fc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0098.494] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6917fc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf6917fc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf6917fc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.495] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6917fc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf6917fc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf6917fc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.495] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0098.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", lpFilePart=0x0) returned 0x6b
	[0098.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\systemappdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.495] GetFileType (hFile=0x2ec) returned 0x1
	[0098.495] GetFileType (hFile=0x2ec) returned 0x1
	[0098.496] WriteFile (in: hFile=0x2ec, lpBuffer=0x259c5f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259c5f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.496] CloseHandle (hObject=0x2ec) returned 1
	[0098.497] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x5b
	[0098.497] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.497] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.497] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.497] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.497] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x5b
	[0098.497] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0098.497] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.497] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.498] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0098.498] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\TempState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\TempState\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0098.498] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\TempState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\tempstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.543] GetFileType (hFile=0x2ec) returned 0x1
	[0098.543] GetFileType (hFile=0x2ec) returned 0x1
	[0098.543] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a3a08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a3a08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.544] CloseHandle (hObject=0x2ec) returned 1
	[0098.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x5e
	[0098.548] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3374640a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3374640a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0098.574] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3374640a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3374640a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.574] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b7e51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.575] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b8634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.575] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b8e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.575] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b9d52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.575] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.575] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0098.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x5e
	[0098.576] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3374640a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3374640a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0098.577] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3374640a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3374640a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.577] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b7e51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.577] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b8634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.577] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b8e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.577] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b9d52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.577] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b9d52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0098.578] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0098.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.578] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0098.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.578] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\ac\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.579] GetFileType (hFile=0x2ec) returned 0x1
	[0098.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.579] GetFileType (hFile=0x2ec) returned 0x1
	[0098.580] WriteFile (in: hFile=0x2ec, lpBuffer=0x2571f54*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2571f54*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.580] CloseHandle (hObject=0x2ec) returned 1
	[0098.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.581] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x63
	[0098.581] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7ba7ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0098.581] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7ba7ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.581] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7ba7ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.581] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0098.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.581] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x63
	[0098.582] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7ba7ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.582] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7ba7ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.582] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7ba7ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.582] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.582] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x6f
	[0098.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.582] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.583] GetFileType (hFile=0x2ec) returned 0x1
	[0098.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.583] GetFileType (hFile=0x2ec) returned 0x1
	[0098.583] WriteFile (in: hFile=0x2ec, lpBuffer=0x2575c48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2575c48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.584] CloseHandle (hObject=0x2ec) returned 1
	[0098.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.584] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x66
	[0098.584] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb01d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8d0f0a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0098.585] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb01d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8d0f0a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.585] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb01d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8d0f0a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.585] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0098.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.585] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x66
	[0098.585] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb01d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8d0f0a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0098.585] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb01d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8d0f0a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.585] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb01d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8d0f0a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.586] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0098.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.586] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", lpFilePart=0x0) returned 0x72
	[0098.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.586] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\localcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.586] GetFileType (hFile=0x2ec) returned 0x1
	[0098.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.586] GetFileType (hFile=0x2ec) returned 0x1
	[0098.586] WriteFile (in: hFile=0x2ec, lpBuffer=0x25799ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25799ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.587] CloseHandle (hObject=0x2ec) returned 1
	[0098.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.587] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x66
	[0098.587] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb9cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0098.588] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb9cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.588] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb9cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.588] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0098.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.589] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x66
	[0098.589] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb9cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.589] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb9cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.589] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb9cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.589] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.589] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", lpFilePart=0x0) returned 0x72
	[0098.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.589] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\localstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.590] GetFileType (hFile=0x2ec) returned 0x1
	[0098.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.590] GetFileType (hFile=0x2ec) returned 0x1
	[0098.590] WriteFile (in: hFile=0x2ec, lpBuffer=0x257d790*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257d790*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.591] CloseHandle (hObject=0x2ec) returned 1
	[0098.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.591] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x68
	[0098.591] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bc2fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0098.592] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bc2fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.592] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bc2fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.592] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0098.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.592] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x68
	[0098.592] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bc2fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.592] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bc2fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.593] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bc2fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.593] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.593] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", lpFilePart=0x0) returned 0x74
	[0098.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\roamingstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.593] GetFileType (hFile=0x2ec) returned 0x1
	[0098.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.593] GetFileType (hFile=0x2ec) returned 0x1
	[0098.593] WriteFile (in: hFile=0x2ec, lpBuffer=0x2581594*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2581594*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.597] CloseHandle (hObject=0x2ec) returned 1
	[0098.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x64
	[0098.598] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.599] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.599] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2d9698d0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.600] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.600] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7db976b3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7db976b3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7db976b3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1
	[0098.600] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7db976b3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7db976b3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7db976b3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1
	[0098.600] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7db976b3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7db976b3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7db976b3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0
	[0098.600] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x64
	[0098.601] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0098.602] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.602] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2d9698d0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.602] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.602] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7db976b3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7db976b3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7db976b3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1
	[0098.602] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7db976b3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7db976b3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7db976b3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1
	[0098.602] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.603] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0098.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.603] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x70
	[0098.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.603] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.604] GetFileType (hFile=0x2ec) returned 0x1
	[0098.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.621] GetFileType (hFile=0x2ec) returned 0x1
	[0098.621] WriteFile (in: hFile=0x2ec, lpBuffer=0x2586674*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2586674*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.622] CloseHandle (hObject=0x2ec) returned 1
	[0098.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x69
	[0098.622] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb10eaaa, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb10eaaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.622] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb10eaaa, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb10eaaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.623] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb10eaaa, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb10eaaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.623] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.623] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x69
	[0098.623] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb10eaaa, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb10eaaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0098.623] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb10eaaa, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb10eaaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.623] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb10eaaa, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb10eaaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.623] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0098.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0098.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.624] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\systemappdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.624] GetFileType (hFile=0x2ec) returned 0x1
	[0098.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.624] GetFileType (hFile=0x2ec) returned 0x1
	[0098.624] WriteFile (in: hFile=0x2ec, lpBuffer=0x258a488*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258a488*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.625] CloseHandle (hObject=0x2ec) returned 1
	[0098.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.625] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x65
	[0098.625] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0098.626] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.626] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.626] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0098.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.626] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x65
	[0098.626] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.627] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.627] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.627] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.627] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\TempState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\TempState\\Decrypt.txt", lpFilePart=0x0) returned 0x71
	[0098.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.627] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\TempState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\tempstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.628] GetFileType (hFile=0x2ec) returned 0x1
	[0098.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.628] GetFileType (hFile=0x2ec) returned 0x1
	[0098.628] WriteFile (in: hFile=0x2ec, lpBuffer=0x258e1dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258e1dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.629] CloseHandle (hObject=0x2ec) returned 1
	[0098.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x56
	[0098.629] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0098.631] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.631] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.632] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.632] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.632] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.632] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.632] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0098.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.633] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x56
	[0098.633] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0098.634] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.634] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.634] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.634] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.635] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.635] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0098.635] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0098.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.636] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0098.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.636] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\ac\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.637] GetFileType (hFile=0x2ec) returned 0x1
	[0098.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.637] GetFileType (hFile=0x2ec) returned 0x1
	[0098.637] WriteFile (in: hFile=0x2ec, lpBuffer=0x2592cdc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2592cdc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.638] CloseHandle (hObject=0x2ec) returned 1
	[0098.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.639] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x5b
	[0098.639] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0098.640] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.640] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.640] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0098.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.640] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x5b
	[0098.640] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.641] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.641] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.641] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.641] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0098.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.641] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.641] GetFileType (hFile=0x2ec) returned 0x1
	[0098.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.641] GetFileType (hFile=0x2ec) returned 0x1
	[0098.642] WriteFile (in: hFile=0x2ec, lpBuffer=0x2596850*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2596850*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.642] CloseHandle (hObject=0x2ec) returned 1
	[0098.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.643] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x5e
	[0098.643] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0098.643] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.643] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.643] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0098.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.644] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x5e
	[0098.644] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0098.644] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.644] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.644] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0098.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.644] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0098.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.644] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\localcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.645] GetFileType (hFile=0x2ec) returned 0x1
	[0098.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.645] GetFileType (hFile=0x2ec) returned 0x1
	[0098.645] WriteFile (in: hFile=0x2ec, lpBuffer=0x259a474*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259a474*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.699] CloseHandle (hObject=0x2ec) returned 1
	[0098.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x5e
	[0098.699] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0098.700] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.700] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.700] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0098.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.700] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x5e
	[0098.700] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0098.700] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.701] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.701] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0098.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.701] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0098.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.701] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\localstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.702] GetFileType (hFile=0x2ec) returned 0x1
	[0098.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.702] GetFileType (hFile=0x2ec) returned 0x1
	[0098.702] WriteFile (in: hFile=0x2ec, lpBuffer=0x259e098*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259e098*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.702] CloseHandle (hObject=0x2ec) returned 1
	[0098.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.703] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x60
	[0098.703] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0098.703] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.703] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.703] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0098.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.704] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x60
	[0098.704] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0098.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.704] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.704] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0098.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.704] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0098.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.704] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\roamingstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.705] GetFileType (hFile=0x2ec) returned 0x1
	[0098.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.705] GetFileType (hFile=0x2ec) returned 0x1
	[0098.705] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a1d1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a1d1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.706] CloseHandle (hObject=0x2ec) returned 1
	[0098.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.706] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x5c
	[0098.706] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0098.706] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.706] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.707] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.707] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0
	[0098.707] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0098.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x5c
	[0098.707] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0098.707] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.707] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.708] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.708] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.708] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0098.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.708] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0098.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.708] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.708] GetFileType (hFile=0x2ec) returned 0x1
	[0098.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.708] GetFileType (hFile=0x2ec) returned 0x1
	[0098.709] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a61bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a61bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.709] CloseHandle (hObject=0x2ec) returned 1
	[0098.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.710] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x61
	[0098.710] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0098.710] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.710] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.710] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0098.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.710] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x61
	[0098.710] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0098.711] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.711] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.711] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0098.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.711] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", lpFilePart=0x0) returned 0x6d
	[0098.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.711] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\systemappdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.711] GetFileType (hFile=0x2ec) returned 0x1
	[0098.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.711] GetFileType (hFile=0x2ec) returned 0x1
	[0098.711] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a9e50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a9e50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.712] CloseHandle (hObject=0x2ec) returned 1
	[0098.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.712] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x5d
	[0098.712] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.713] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.713] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.713] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.713] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x5d
	[0098.713] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0098.713] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.713] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.714] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0098.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.714] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\TempState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\TempState\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0098.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.714] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\TempState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\tempstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.715] GetFileType (hFile=0x2ec) returned 0x1
	[0098.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.715] GetFileType (hFile=0x2ec) returned 0x1
	[0098.715] WriteFile (in: hFile=0x2ec, lpBuffer=0x25ada24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ada24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.715] CloseHandle (hObject=0x2ec) returned 1
	[0098.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x49
	[0098.716] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.717] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.718] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.718] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.718] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.718] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.718] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.718] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x49
	[0098.719] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0098.719] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.720] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.720] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.720] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.720] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.720] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0098.720] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0098.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0098.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\ac\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.722] GetFileType (hFile=0x2ec) returned 0x1
	[0098.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.722] GetFileType (hFile=0x2ec) returned 0x1
	[0098.723] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b20e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b20e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.723] CloseHandle (hObject=0x2ec) returned 1
	[0098.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x4e
	[0098.724] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.724] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.724] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.724] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x4e
	[0098.724] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0098.724] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.724] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.725] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0098.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0098.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.725] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.725] GetFileType (hFile=0x2ec) returned 0x1
	[0098.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.725] GetFileType (hFile=0x2ec) returned 0x1
	[0098.725] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b5a08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b5a08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.726] CloseHandle (hObject=0x2ec) returned 1
	[0098.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.726] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x51
	[0098.726] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0098.727] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.727] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.727] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0098.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.727] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x51
	[0098.727] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0098.728] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.728] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.728] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0098.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.728] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0098.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.728] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\localcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.728] GetFileType (hFile=0x2ec) returned 0x1
	[0098.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.728] GetFileType (hFile=0x2ec) returned 0x1
	[0098.728] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b939c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b939c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.729] CloseHandle (hObject=0x2ec) returned 1
	[0098.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x51
	[0098.729] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0098.730] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.730] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.730] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0098.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x51
	[0098.730] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.730] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.730] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.731] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0098.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.731] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\localstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.732] GetFileType (hFile=0x2ec) returned 0x1
	[0098.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.732] GetFileType (hFile=0x2ec) returned 0x1
	[0098.732] WriteFile (in: hFile=0x2ec, lpBuffer=0x25bcd30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bcd30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.733] CloseHandle (hObject=0x2ec) returned 1
	[0098.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.733] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x53
	[0098.733] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0098.733] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.733] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.733] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0098.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.734] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x53
	[0098.734] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0098.734] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.734] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.734] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0098.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.734] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0098.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.734] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\roamingstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.734] GetFileType (hFile=0x2ec) returned 0x1
	[0098.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.735] GetFileType (hFile=0x2ec) returned 0x1
	[0098.735] WriteFile (in: hFile=0x2ec, lpBuffer=0x25c0724*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c0724*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.735] CloseHandle (hObject=0x2ec) returned 1
	[0098.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.736] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x4f
	[0098.736] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0098.736] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.736] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.736] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.736] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0
	[0098.736] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0098.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.737] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x4f
	[0098.737] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0098.737] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.737] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.737] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.737] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.737] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0098.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.737] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0098.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.737] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.738] GetFileType (hFile=0x2ec) returned 0x1
	[0098.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.738] GetFileType (hFile=0x2ec) returned 0x1
	[0098.738] WriteFile (in: hFile=0x2ec, lpBuffer=0x25c4874*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c4874*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.738] CloseHandle (hObject=0x2ec) returned 1
	[0098.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.739] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x54
	[0098.739] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0098.739] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.739] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.739] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0098.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.739] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x54
	[0098.739] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0098.740] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.740] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.740] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0098.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.740] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0098.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.740] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\SystemAppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\systemappdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.740] GetFileType (hFile=0x2ec) returned 0x1
	[0098.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.740] GetFileType (hFile=0x2ec) returned 0x1
	[0098.740] WriteFile (in: hFile=0x2ec, lpBuffer=0x25c82b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c82b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.741] CloseHandle (hObject=0x2ec) returned 1
	[0098.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.741] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x50
	[0098.741] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcda59e5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0098.742] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcda59e5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.742] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcda59e5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.742] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0098.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.742] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x50
	[0098.742] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcda59e5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0098.742] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcda59e5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.742] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcda59e5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.743] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0098.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.743] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\TempState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\TempState\\Decrypt.txt", lpFilePart=0x0) returned 0x5c
	[0098.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\TempState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\tempstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.778] GetFileType (hFile=0x2ec) returned 0x1
	[0098.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.778] GetFileType (hFile=0x2ec) returned 0x1
	[0098.778] WriteFile (in: hFile=0x2ec, lpBuffer=0x25cbc3c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cbc3c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.779] CloseHandle (hObject=0x2ec) returned 1
	[0098.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x5a
	[0098.779] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf292dc14, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33a8d656, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33a8d656, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0098.791] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf292dc14, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33a8d656, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33a8d656, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.791] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb12b31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.791] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb135d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.792] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb13e2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.792] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63004, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.792] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.792] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0098.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x5a
	[0098.793] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf292dc14, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33a8d656, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33a8d656, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.794] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf292dc14, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33a8d656, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33a8d656, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.794] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb12b31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.794] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb135d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.794] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb13e2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.794] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63004, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.794] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63004, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0098.794] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0098.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\ac\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.796] GetFileType (hFile=0x2ec) returned 0x1
	[0098.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.796] GetFileType (hFile=0x2ec) returned 0x1
	[0098.796] WriteFile (in: hFile=0x2ec, lpBuffer=0x25d087c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d087c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.807] CloseHandle (hObject=0x2ec) returned 1
	[0098.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.807] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x5f
	[0098.808] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2907a4b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63970, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2907a4b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0098.809] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2907a4b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63970, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2907a4b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.809] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2907a4b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63970, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2907a4b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.809] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0098.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x5f
	[0098.810] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2907a4b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63970, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2907a4b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0098.810] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2907a4b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63970, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2907a4b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.810] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2907a4b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63970, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2907a4b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.810] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0098.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x6b
	[0098.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.810] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.811] GetFileType (hFile=0x2ec) returned 0x1
	[0098.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.811] GetFileType (hFile=0x2ec) returned 0x1
	[0098.811] WriteFile (in: hFile=0x2ec, lpBuffer=0x25d44b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d44b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.811] CloseHandle (hObject=0x2ec) returned 1
	[0098.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x62
	[0098.812] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb64026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0098.812] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb64026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.812] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb64026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.812] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0098.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x62
	[0098.813] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb64026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.813] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb64026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.813] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb64026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.813] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0098.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.813] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\localcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.813] GetFileType (hFile=0x2ec) returned 0x1
	[0098.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.814] GetFileType (hFile=0x2ec) returned 0x1
	[0098.814] WriteFile (in: hFile=0x2ec, lpBuffer=0x25d8194*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d8194*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.815] CloseHandle (hObject=0x2ec) returned 1
	[0098.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x62
	[0098.815] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb6476c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0098.815] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb6476c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.816] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb6476c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.816] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0098.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x62
	[0098.816] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb6476c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0098.816] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb6476c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.816] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb6476c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.816] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0098.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0098.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.816] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\localstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.817] GetFileType (hFile=0x2ec) returned 0x1
	[0098.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.817] GetFileType (hFile=0x2ec) returned 0x1
	[0098.817] WriteFile (in: hFile=0x2ec, lpBuffer=0x25dbe78*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25dbe78*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.818] CloseHandle (hObject=0x2ec) returned 1
	[0098.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.819] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x64
	[0098.819] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb652c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0098.819] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb652c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.819] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb652c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.819] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0098.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.819] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x64
	[0098.819] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb652c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0098.820] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb652c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.820] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb652c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.820] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0098.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", lpFilePart=0x0) returned 0x70
	[0098.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.820] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\roamingstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.820] GetFileType (hFile=0x2ec) returned 0x1
	[0098.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.820] GetFileType (hFile=0x2ec) returned 0x1
	[0098.820] WriteFile (in: hFile=0x2ec, lpBuffer=0x25dfbbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25dfbbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.821] CloseHandle (hObject=0x2ec) returned 1
	[0098.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x60
	[0098.822] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf286f050, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.855] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf286f050, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.855] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2907a4b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2907a4b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf2907a4b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.855] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf286f050, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x80ebabe8, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.855] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf2da6323, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2da6323, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf2da6323, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1
	[0098.856] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf2da6323, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2da6323, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf2da6323, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1
	[0098.856] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf2da6323, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2da6323, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf2da6323, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0
	[0098.856] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.856] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x60
	[0098.856] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf286f050, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.857] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf286f050, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.857] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2907a4b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2907a4b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf2907a4b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.857] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf286f050, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x80ebabe8, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.857] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf2da6323, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2da6323, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf2da6323, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1
	[0098.857] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf2da6323, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2da6323, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf2da6323, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1
	[0098.857] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.857] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0098.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.858] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.860] GetFileType (hFile=0x2ec) returned 0x1
	[0098.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.860] GetFileType (hFile=0x2ec) returned 0x1
	[0098.860] WriteFile (in: hFile=0x2ec, lpBuffer=0x25e4b5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e4b5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.861] CloseHandle (hObject=0x2ec) returned 1
	[0098.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.861] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x61
	[0098.861] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdc0d575, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0098.861] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdc0d575, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.861] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdc0d575, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.861] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0098.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.862] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x61
	[0098.862] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdc0d575, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.862] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdc0d575, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.862] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdc0d575, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.862] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0098.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0098.862] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\TempState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\TempState\\Decrypt.txt", lpFilePart=0x0) returned 0x6d
	[0098.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0098.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\TempState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\tempstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.862] GetFileType (hFile=0x2ec) returned 0x1
	[0098.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0098.862] GetFileType (hFile=0x2ec) returned 0x1
	[0098.862] WriteFile (in: hFile=0x2ec, lpBuffer=0x25e87f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e87f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.863] CloseHandle (hObject=0x2ec) returned 1
	[0098.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0098.863] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x5a
	[0098.863] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x109ba31, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33d3c232, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33d3c232, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0098.874] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x109ba31, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33d3c232, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33d3c232, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.874] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc594d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.875] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5a13e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.875] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5aca0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.875] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5b47b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.875] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.875] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0098.876] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x5a
	[0098.876] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x109ba31, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33d3c232, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33d3c232, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.877] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x109ba31, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33d3c232, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33d3c232, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.877] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc594d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.877] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5a13e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.877] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5aca0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.877] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5b47b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.877] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5b47b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0098.877] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.878] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0098.878] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.881] GetFileType (hFile=0x2ec) returned 0x1
	[0098.881] GetFileType (hFile=0x2ec) returned 0x1
	[0098.881] WriteFile (in: hFile=0x2ec, lpBuffer=0x25ed430*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ed430*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.882] CloseHandle (hObject=0x2ec) returned 1
	[0098.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x5f
	[0098.882] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5bd63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x107580d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.883] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5bd63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x107580d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.883] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5bd63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x107580d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.883] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x5f
	[0098.883] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5bd63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x107580d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0098.883] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5bd63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x107580d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.883] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5bd63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x107580d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.884] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0098.884] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x6b
	[0098.884] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.884] GetFileType (hFile=0x2ec) returned 0x1
	[0098.884] GetFileType (hFile=0x2ec) returned 0x1
	[0098.884] WriteFile (in: hFile=0x2ec, lpBuffer=0x25f1064*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f1064*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.885] CloseHandle (hObject=0x2ec) returned 1
	[0098.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x62
	[0098.885] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5c548, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0098.886] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5c548, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.886] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5c548, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.887] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0098.887] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x62
	[0098.887] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5c548, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0098.887] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5c548, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.887] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5c548, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.887] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0098.887] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0098.887] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\localcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.887] GetFileType (hFile=0x2ec) returned 0x1
	[0098.887] GetFileType (hFile=0x2ec) returned 0x1
	[0098.888] WriteFile (in: hFile=0x2ec, lpBuffer=0x25f4d48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f4d48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.888] CloseHandle (hObject=0x2ec) returned 1
	[0098.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x62
	[0098.889] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5cd7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0098.889] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5cd7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.889] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5cd7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.889] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0098.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x62
	[0098.889] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5cd7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0098.889] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5cd7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.890] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5cd7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.890] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0098.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0098.890] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\localstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.890] GetFileType (hFile=0x2ec) returned 0x1
	[0098.890] GetFileType (hFile=0x2ec) returned 0x1
	[0098.890] WriteFile (in: hFile=0x2ec, lpBuffer=0x25f8a2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f8a2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.891] CloseHandle (hObject=0x2ec) returned 1
	[0098.891] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x64
	[0098.891] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5d5ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0098.892] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5d5ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.892] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5d5ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.892] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0098.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x64
	[0098.892] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5d5ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0098.892] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5d5ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.892] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5d5ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.892] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0098.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt", lpFilePart=0x0) returned 0x70
	[0098.892] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\roamingstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.893] GetFileType (hFile=0x2ec) returned 0x1
	[0098.893] GetFileType (hFile=0x2ec) returned 0x1
	[0098.893] WriteFile (in: hFile=0x2ec, lpBuffer=0x25fc770*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fc770*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.894] CloseHandle (hObject=0x2ec) returned 1
	[0098.895] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x60
	[0098.895] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0098.903] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.903] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x107580d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x107580d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.903] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb5909282, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.903] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x11a6a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x11a6a8d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x11a6a8d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1
	[0098.903] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x11a6a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x11a6a8d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x11a6a8d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1
	[0098.903] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x11a6a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x11a6a8d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x11a6a8d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0
	[0098.903] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0098.904] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x60
	[0098.904] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0098.905] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.905] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x107580d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x107580d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1
	[0098.905] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb5909282, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0098.905] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x11a6a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x11a6a8d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x11a6a8d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1
	[0098.905] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x11a6a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x11a6a8d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x11a6a8d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1
	[0098.905] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.905] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0098.906] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0098.906] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.907] GetFileType (hFile=0x2ec) returned 0x1
	[0098.907] GetFileType (hFile=0x2ec) returned 0x1
	[0098.907] WriteFile (in: hFile=0x2ec, lpBuffer=0x2601710*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2601710*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.908] CloseHandle (hObject=0x2ec) returned 1
	[0098.908] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x61
	[0098.908] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcddc79b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0098.908] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcddc79b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.908] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcddc79b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.908] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0098.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x61
	[0098.933] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcddc79b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0098.934] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcddc79b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.934] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcddc79b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.934] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0098.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState\\Decrypt.txt", lpFilePart=0x0) returned 0x6d
	[0098.934] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\tempstate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.934] GetFileType (hFile=0x2ec) returned 0x1
	[0098.934] GetFileType (hFile=0x2ec) returned 0x1
	[0098.934] WriteFile (in: hFile=0x2ec, lpBuffer=0x26053a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26053a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.937] CloseHandle (hObject=0x2ec) returned 1
	[0098.937] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x5a
	[0098.937] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0098.946] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.946] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.946] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.946] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.946] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.946] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.946] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0098.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x5a
	[0098.947] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0098.947] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.948] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.948] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.948] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.948] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.948] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0098.948] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0098.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0098.949] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.3_8wekyb3d8bbwe\\ac\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.951] GetFileType (hFile=0x2ec) returned 0x1
	[0098.952] GetFileType (hFile=0x2ec) returned 0x1
	[0098.952] WriteFile (in: hFile=0x2ec, lpBuffer=0x2609fe4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2609fe4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.953] CloseHandle (hObject=0x2ec) returned 1
	[0098.953] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x5a
	[0098.953] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2690400b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x33fc4a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33fc4a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0098.954] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2690400b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x33fc4a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33fc4a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.954] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde92403, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.954] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde92ed7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.955] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde937b4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.955] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde93ee6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.955] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.955] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0098.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x5a
	[0098.955] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2690400b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x33fc4a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33fc4a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0098.956] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2690400b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x33fc4a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33fc4a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.956] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde92403, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0098.956] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde92ed7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0098.956] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde937b4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1
	[0098.956] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde93ee6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0098.956] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde93ee6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0098.956] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0098.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0098.957] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\ac\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0098.958] GetFileType (hFile=0x2ec) returned 0x1
	[0098.958] GetFileType (hFile=0x2ec) returned 0x1
	[0098.958] WriteFile (in: hFile=0x2ec, lpBuffer=0x260ec24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260ec24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.959] CloseHandle (hObject=0x2ec) returned 1
	[0098.959] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x5f
	[0098.959] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2686b7b5, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde948f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2686b7b5, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0098.960] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2686b7b5, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde948f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2686b7b5, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.964] WriteFile (in: hFile=0x2ec, lpBuffer=0x2612858*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2612858*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.966] WriteFile (in: hFile=0x2ec, lpBuffer=0x261653c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261653c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.969] WriteFile (in: hFile=0x2ec, lpBuffer=0x261a220*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261a220*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0098.971] WriteFile (in: hFile=0x2ec, lpBuffer=0x261df64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261df64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.015] WriteFile (in: hFile=0x2ec, lpBuffer=0x2622f04*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2622f04*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.018] WriteFile (in: hFile=0x2ec, lpBuffer=0x2626b98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2626b98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.471] WriteFile (in: hFile=0x2ec, lpBuffer=0x262b738*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262b738*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.472] WriteFile (in: hFile=0x2ec, lpBuffer=0x262f30c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262f30c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.474] WriteFile (in: hFile=0x2ec, lpBuffer=0x2632f90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2632f90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.475] WriteFile (in: hFile=0x2ec, lpBuffer=0x2636c14*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2636c14*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.478] WriteFile (in: hFile=0x2ec, lpBuffer=0x263a8f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263a8f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.482] WriteFile (in: hFile=0x2ec, lpBuffer=0x263f7f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263f7f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.484] WriteFile (in: hFile=0x2ec, lpBuffer=0x264342c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264342c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.489] WriteFile (in: hFile=0x2ec, lpBuffer=0x2647fcc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2647fcc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.491] WriteFile (in: hFile=0x2ec, lpBuffer=0x264bba0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264bba0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.492] WriteFile (in: hFile=0x2ec, lpBuffer=0x264f824*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264f824*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.493] WriteFile (in: hFile=0x2ec, lpBuffer=0x26534a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26534a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.494] WriteFile (in: hFile=0x2ec, lpBuffer=0x265718c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265718c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.498] WriteFile (in: hFile=0x2ec, lpBuffer=0x265c08c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265c08c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.499] WriteFile (in: hFile=0x2ec, lpBuffer=0x265fcc0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265fcc0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0099.869] WriteFile (in: hFile=0x2ec, lpBuffer=0x2664860*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2664860*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.028] WriteFile (in: hFile=0x2ec, lpBuffer=0x2669400*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2669400*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.036] WriteFile (in: hFile=0x2ec, lpBuffer=0x266dfa0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266dfa0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.038] WriteFile (in: hFile=0x2ec, lpBuffer=0x2671b74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2671b74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.040] WriteFile (in: hFile=0x2ec, lpBuffer=0x26757f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26757f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.074] WriteFile (in: hFile=0x2ec, lpBuffer=0x267947c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267947c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.075] WriteFile (in: hFile=0x2ec, lpBuffer=0x267d160*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267d160*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.100] WriteFile (in: hFile=0x2ec, lpBuffer=0x2682060*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2682060*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.102] WriteFile (in: hFile=0x2ec, lpBuffer=0x2685c94*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2685c94*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.107] WriteFile (in: hFile=0x2ec, lpBuffer=0x268a5b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268a5b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.109] WriteFile (in: hFile=0x2ec, lpBuffer=0x268e008*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268e008*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.110] WriteFile (in: hFile=0x2ec, lpBuffer=0x2691b0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2691b0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.112] WriteFile (in: hFile=0x2ec, lpBuffer=0x2695610*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2695610*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.167] WriteFile (in: hFile=0x2ec, lpBuffer=0x2699174*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2699174*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.173] WriteFile (in: hFile=0x2ec, lpBuffer=0x269ddf4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269ddf4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.175] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a1968*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a1968*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.177] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a541c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a541c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.184] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a9c1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a9c1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.187] WriteFile (in: hFile=0x2ec, lpBuffer=0x26ad600*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ad600*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.189] WriteFile (in: hFile=0x2ec, lpBuffer=0x26b1054*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b1054*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.191] WriteFile (in: hFile=0x2ec, lpBuffer=0x26b4aa8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b4aa8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.194] WriteFile (in: hFile=0x2ec, lpBuffer=0x26b855c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b855c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.218] WriteFile (in: hFile=0x2ec, lpBuffer=0x26bd0cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bd0cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.220] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c0bd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0bd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.222] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c4614*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c4614*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.230] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c8df4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c8df4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.232] WriteFile (in: hFile=0x2ec, lpBuffer=0x26cc788*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cc788*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.234] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d01cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d01cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.236] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d3c10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d3c10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.238] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d76b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d76b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.240] WriteFile (in: hFile=0x2ec, lpBuffer=0x26db8d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26db8d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.242] WriteFile (in: hFile=0x2ec, lpBuffer=0x26df388*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26df388*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.244] WriteFile (in: hFile=0x2ec, lpBuffer=0x26e2d7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e2d7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.279] WriteFile (in: hFile=0x2ec, lpBuffer=0x26e741c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e741c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.280] WriteFile (in: hFile=0x2ec, lpBuffer=0x26eacf0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26eacf0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.282] WriteFile (in: hFile=0x2ec, lpBuffer=0x26ee674*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ee674*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.284] WriteFile (in: hFile=0x2ec, lpBuffer=0x26f1ff8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f1ff8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.287] WriteFile (in: hFile=0x2ec, lpBuffer=0x26f59dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f59dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.295] WriteFile (in: hFile=0x2ec, lpBuffer=0x26fa3dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fa3dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.297] WriteFile (in: hFile=0x2ec, lpBuffer=0x26fddd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fddd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.299] WriteFile (in: hFile=0x2ec, lpBuffer=0x2701704*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2701704*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.317] WriteFile (in: hFile=0x2ec, lpBuffer=0x2705fa4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2705fa4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.319] WriteFile (in: hFile=0x2ec, lpBuffer=0x27099e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27099e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.322] WriteFile (in: hFile=0x2ec, lpBuffer=0x270d49c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270d49c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.324] WriteFile (in: hFile=0x2ec, lpBuffer=0x2710f50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2710f50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.369] WriteFile (in: hFile=0x2ec, lpBuffer=0x2714a64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2714a64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.370] WriteFile (in: hFile=0x2ec, lpBuffer=0x2718d34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2718d34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.372] WriteFile (in: hFile=0x2ec, lpBuffer=0x271c898*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271c898*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.373] WriteFile (in: hFile=0x2ec, lpBuffer=0x272033c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272033c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.378] WriteFile (in: hFile=0x2ec, lpBuffer=0x2724f9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2724f9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.379] WriteFile (in: hFile=0x2ec, lpBuffer=0x2728c20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2728c20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.381] WriteFile (in: hFile=0x2ec, lpBuffer=0x272c914*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272c914*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.383] WriteFile (in: hFile=0x2ec, lpBuffer=0x2730608*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2730608*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.385] WriteFile (in: hFile=0x2ec, lpBuffer=0x273435c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273435c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.391] WriteFile (in: hFile=0x2ec, lpBuffer=0x273932c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273932c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.392] WriteFile (in: hFile=0x2ec, lpBuffer=0x273d010*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273d010*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.412] WriteFile (in: hFile=0x2ec, lpBuffer=0x2741750*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2741750*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.413] WriteFile (in: hFile=0x2ec, lpBuffer=0x2745084*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2745084*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.414] WriteFile (in: hFile=0x2ec, lpBuffer=0x2748a68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2748a68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.416] WriteFile (in: hFile=0x2ec, lpBuffer=0x274cd48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274cd48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.417] WriteFile (in: hFile=0x2ec, lpBuffer=0x275078c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275078c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.463] WriteFile (in: hFile=0x2ec, lpBuffer=0x275522c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275522c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.466] WriteFile (in: hFile=0x2ec, lpBuffer=0x2758c80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2758c80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.467] WriteFile (in: hFile=0x2ec, lpBuffer=0x275c614*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275c614*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.480] WriteFile (in: hFile=0x2ec, lpBuffer=0x2760fd4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2760fd4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.483] WriteFile (in: hFile=0x2ec, lpBuffer=0x2764a88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2764a88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.484] WriteFile (in: hFile=0x2ec, lpBuffer=0x27685ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27685ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.485] WriteFile (in: hFile=0x2ec, lpBuffer=0x276c150*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276c150*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.487] WriteFile (in: hFile=0x2ec, lpBuffer=0x2576b84*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2576b84*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.501] WriteFile (in: hFile=0x2ec, lpBuffer=0x257af24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257af24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.502] WriteFile (in: hFile=0x2ec, lpBuffer=0x257eaf8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257eaf8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.503] WriteFile (in: hFile=0x2ec, lpBuffer=0x258260c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258260c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.546] WriteFile (in: hFile=0x2ec, lpBuffer=0x2586eac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2586eac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.548] WriteFile (in: hFile=0x2ec, lpBuffer=0x258a8f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258a8f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.549] WriteFile (in: hFile=0x2ec, lpBuffer=0x258e3a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258e3a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.551] WriteFile (in: hFile=0x2ec, lpBuffer=0x2591e58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2591e58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.552] WriteFile (in: hFile=0x2ec, lpBuffer=0x259596c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259596c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.558] WriteFile (in: hFile=0x2ec, lpBuffer=0x259a57c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259a57c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.559] WriteFile (in: hFile=0x2ec, lpBuffer=0x259e020*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259e020*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.570] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a26c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a26c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.572] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a5f94*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a5f94*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.573] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a9918*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a9918*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.575] WriteFile (in: hFile=0x2ec, lpBuffer=0x25ad29c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ad29c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.576] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b0c80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b0c80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.577] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b4da0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b4da0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.578] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b8794*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b8794*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.580] WriteFile (in: hFile=0x2ec, lpBuffer=0x25bc0c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bc0c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.584] WriteFile (in: hFile=0x2ec, lpBuffer=0x25c122c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c122c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.622] WriteFile (in: hFile=0x2ec, lpBuffer=0x25c4eb0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c4eb0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.630] WriteFile (in: hFile=0x2ec, lpBuffer=0x25c8ba4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c8ba4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.634] WriteFile (in: hFile=0x2ec, lpBuffer=0x25cda0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cda0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.636] WriteFile (in: hFile=0x2ec, lpBuffer=0x25d1760*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d1760*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.643] WriteFile (in: hFile=0x2ec, lpBuffer=0x25d6730*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d6730*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.644] WriteFile (in: hFile=0x2ec, lpBuffer=0x25da4d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25da4d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.646] WriteFile (in: hFile=0x2ec, lpBuffer=0x25de1b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25de1b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.652] WriteFile (in: hFile=0x2ec, lpBuffer=0x25e2878*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e2878*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.654] WriteFile (in: hFile=0x2ec, lpBuffer=0x25e619c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e619c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.657] WriteFile (in: hFile=0x2ec, lpBuffer=0x25e9b30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e9b30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.659] WriteFile (in: hFile=0x2ec, lpBuffer=0x25ed4c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ed4c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.661] WriteFile (in: hFile=0x2ec, lpBuffer=0x25f0eb8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f0eb8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.702] WriteFile (in: hFile=0x2ec, lpBuffer=0x25f58e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f58e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.704] WriteFile (in: hFile=0x2ec, lpBuffer=0x25f932c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f932c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.705] WriteFile (in: hFile=0x2ec, lpBuffer=0x25fccb0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fccb0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.724] WriteFile (in: hFile=0x2ec, lpBuffer=0x2601710*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2601710*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.726] WriteFile (in: hFile=0x2ec, lpBuffer=0x2605224*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2605224*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.729] WriteFile (in: hFile=0x2ec, lpBuffer=0x2608de8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2608de8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.731] WriteFile (in: hFile=0x2ec, lpBuffer=0x260c9ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260c9ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.733] WriteFile (in: hFile=0x2ec, lpBuffer=0x26105d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26105d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.740] WriteFile (in: hFile=0x2ec, lpBuffer=0x2615390*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2615390*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.742] WriteFile (in: hFile=0x2ec, lpBuffer=0x2618fc4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2618fc4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.743] WriteFile (in: hFile=0x2ec, lpBuffer=0x261cb38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261cb38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.794] WriteFile (in: hFile=0x2ec, lpBuffer=0x2621478*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2621478*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.797] WriteFile (in: hFile=0x2ec, lpBuffer=0x2624f1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2624f1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.799] WriteFile (in: hFile=0x2ec, lpBuffer=0x2628a30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2628a30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.801] WriteFile (in: hFile=0x2ec, lpBuffer=0x262c544*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262c544*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.802] WriteFile (in: hFile=0x2ec, lpBuffer=0x26300b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26300b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.804] WriteFile (in: hFile=0x2ec, lpBuffer=0x2634408*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2634408*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.806] WriteFile (in: hFile=0x2ec, lpBuffer=0x2637fcc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2637fcc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.807] WriteFile (in: hFile=0x2ec, lpBuffer=0x263bad0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263bad0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.813] WriteFile (in: hFile=0x2ec, lpBuffer=0x26405d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26405d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.815] WriteFile (in: hFile=0x2ec, lpBuffer=0x2644144*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2644144*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.817] WriteFile (in: hFile=0x2ec, lpBuffer=0x2647d68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2647d68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.819] WriteFile (in: hFile=0x2ec, lpBuffer=0x264b98c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264b98c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.821] WriteFile (in: hFile=0x2ec, lpBuffer=0x264f610*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264f610*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.823] WriteFile (in: hFile=0x2ec, lpBuffer=0x2653ab0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2653ab0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.825] WriteFile (in: hFile=0x2ec, lpBuffer=0x2657744*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2657744*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.826] WriteFile (in: hFile=0x2ec, lpBuffer=0x265b318*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265b318*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.859] WriteFile (in: hFile=0x2ec, lpBuffer=0x265fed8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265fed8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.861] WriteFile (in: hFile=0x2ec, lpBuffer=0x2663afc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2663afc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.863] WriteFile (in: hFile=0x2ec, lpBuffer=0x2667790*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2667790*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.865] WriteFile (in: hFile=0x2ec, lpBuffer=0x266b424*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266b424*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.867] WriteFile (in: hFile=0x2ec, lpBuffer=0x266f118*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266f118*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.868] WriteFile (in: hFile=0x2ec, lpBuffer=0x2673668*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2673668*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.870] WriteFile (in: hFile=0x2ec, lpBuffer=0x26773ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26773ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.871] WriteFile (in: hFile=0x2ec, lpBuffer=0x267b030*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267b030*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.878] WriteFile (in: hFile=0x2ec, lpBuffer=0x267f790*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267f790*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.880] WriteFile (in: hFile=0x2ec, lpBuffer=0x2683114*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2683114*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.883] WriteFile (in: hFile=0x2ec, lpBuffer=0x2686b08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2686b08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.886] WriteFile (in: hFile=0x2ec, lpBuffer=0x268a4fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268a4fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.891] WriteFile (in: hFile=0x2ec, lpBuffer=0x268df50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268df50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.935] WriteFile (in: hFile=0x2ec, lpBuffer=0x2692a20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2692a20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.937] WriteFile (in: hFile=0x2ec, lpBuffer=0x26964c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26964c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.939] WriteFile (in: hFile=0x2ec, lpBuffer=0x2699ea8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2699ea8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.957] WriteFile (in: hFile=0x2ec, lpBuffer=0x269e608*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269e608*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.959] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a1f8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a1f8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.961] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a5980*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a5980*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.963] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a9374*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a9374*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.966] WriteFile (in: hFile=0x2ec, lpBuffer=0x26acdc8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26acdc8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.971] WriteFile (in: hFile=0x2ec, lpBuffer=0x26b1898*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b1898*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.973] WriteFile (in: hFile=0x2ec, lpBuffer=0x26b533c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b533c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.975] WriteFile (in: hFile=0x2ec, lpBuffer=0x26b8d20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b8d20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0100.977] WriteFile (in: hFile=0x2ec, lpBuffer=0x26bc594*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bc594*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.013] WriteFile (in: hFile=0x2ec, lpBuffer=0x26bff18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bff18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.015] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c390c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c390c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.016] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c7300*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c7300*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.018] WriteFile (in: hFile=0x2ec, lpBuffer=0x26cad54*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cad54*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.024] WriteFile (in: hFile=0x2ec, lpBuffer=0x26cf824*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cf824*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.025] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d3208*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d3208*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.027] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d6c5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d6c5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.029] WriteFile (in: hFile=0x2ec, lpBuffer=0x26da7c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26da7c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.031] WriteFile (in: hFile=0x2ec, lpBuffer=0x26de394*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26de394*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.033] WriteFile (in: hFile=0x2ec, lpBuffer=0x26e2378*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e2378*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.035] WriteFile (in: hFile=0x2ec, lpBuffer=0x26e5fac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e5fac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.080] WriteFile (in: hFile=0x2ec, lpBuffer=0x26ead9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ead9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.083] WriteFile (in: hFile=0x2ec, lpBuffer=0x26eea20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26eea20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.119] WriteFile (in: hFile=0x2ec, lpBuffer=0x26f25e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f25e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.129] WriteFile (in: hFile=0x2ec, lpBuffer=0x26f6844*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f6844*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.131] WriteFile (in: hFile=0x2ec, lpBuffer=0x26f9e08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f9e08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.140] WriteFile (in: hFile=0x2ec, lpBuffer=0x26fd43c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fd43c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.141] WriteFile (in: hFile=0x2ec, lpBuffer=0x2700c40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2700c40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.143] WriteFile (in: hFile=0x2ec, lpBuffer=0x2704880*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2704880*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.145] WriteFile (in: hFile=0x2ec, lpBuffer=0x27083f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27083f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.147] WriteFile (in: hFile=0x2ec, lpBuffer=0x270c944*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270c944*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.148] WriteFile (in: hFile=0x2ec, lpBuffer=0x2710ee4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2710ee4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.149] WriteFile (in: hFile=0x2ec, lpBuffer=0x2714638*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2714638*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.175] WriteFile (in: hFile=0x2ec, lpBuffer=0x2718640*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2718640*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.177] WriteFile (in: hFile=0x2ec, lpBuffer=0x271c438*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271c438*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.179] WriteFile (in: hFile=0x2ec, lpBuffer=0x271fd38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271fd38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.183] WriteFile (in: hFile=0x2ec, lpBuffer=0x27237b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27237b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.186] WriteFile (in: hFile=0x2ec, lpBuffer=0x2726cbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2726cbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.187] WriteFile (in: hFile=0x2ec, lpBuffer=0x272a4c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272a4c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.198] WriteFile (in: hFile=0x2ec, lpBuffer=0x272dfd4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272dfd4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.200] WriteFile (in: hFile=0x2ec, lpBuffer=0x2731ad8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2731ad8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.225] WriteFile (in: hFile=0x2ec, lpBuffer=0x2737d00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2737d00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.226] WriteFile (in: hFile=0x2ec, lpBuffer=0x273b688*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273b688*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.227] WriteFile (in: hFile=0x2ec, lpBuffer=0x273f164*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273f164*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.231] WriteFile (in: hFile=0x2ec, lpBuffer=0x2742618*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2742618*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.232] WriteFile (in: hFile=0x2ec, lpBuffer=0x2745b2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2745b2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.234] WriteFile (in: hFile=0x2ec, lpBuffer=0x274ac10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274ac10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.235] WriteFile (in: hFile=0x2ec, lpBuffer=0x274e66c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274e66c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.238] WriteFile (in: hFile=0x2ec, lpBuffer=0x2751de4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2751de4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.255] WriteFile (in: hFile=0x2ec, lpBuffer=0x2755ce4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2755ce4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.265] WriteFile (in: hFile=0x2ec, lpBuffer=0x275a510*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275a510*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.267] WriteFile (in: hFile=0x2ec, lpBuffer=0x27602a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27602a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.307] WriteFile (in: hFile=0x2ec, lpBuffer=0x2763acc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2763acc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.310] WriteFile (in: hFile=0x2ec, lpBuffer=0x2767ed8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2767ed8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.311] WriteFile (in: hFile=0x2ec, lpBuffer=0x276b7f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276b7f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.312] WriteFile (in: hFile=0x2ec, lpBuffer=0x276ec98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276ec98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.314] WriteFile (in: hFile=0x2ec, lpBuffer=0x27729f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27729f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.315] WriteFile (in: hFile=0x2ec, lpBuffer=0x2775fc8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2775fc8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.317] WriteFile (in: hFile=0x2ec, lpBuffer=0x27798b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27798b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.318] WriteFile (in: hFile=0x2ec, lpBuffer=0x277cca4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277cca4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.320] WriteFile (in: hFile=0x2ec, lpBuffer=0x2781538*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2781538*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.321] WriteFile (in: hFile=0x2ec, lpBuffer=0x2786ea4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2786ea4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.323] WriteFile (in: hFile=0x2ec, lpBuffer=0x278cdf4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278cdf4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.324] WriteFile (in: hFile=0x2ec, lpBuffer=0x27917c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27917c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.325] WriteFile (in: hFile=0x2ec, lpBuffer=0x2794e58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2794e58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.327] WriteFile (in: hFile=0x2ec, lpBuffer=0x279865c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279865c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.328] WriteFile (in: hFile=0x2ec, lpBuffer=0x279be3c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279be3c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.330] WriteFile (in: hFile=0x2ec, lpBuffer=0x279f520*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279f520*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.331] WriteFile (in: hFile=0x2ec, lpBuffer=0x27a2f4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a2f4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.332] WriteFile (in: hFile=0x2ec, lpBuffer=0x27a6820*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a6820*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.335] WriteFile (in: hFile=0x2ec, lpBuffer=0x27aa7ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27aa7ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.341] WriteFile (in: hFile=0x2ec, lpBuffer=0x27b7c9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b7c9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.343] WriteFile (in: hFile=0x2ec, lpBuffer=0x27bb440*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27bb440*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.344] WriteFile (in: hFile=0x2ec, lpBuffer=0x27beb24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27beb24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.479] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c2310*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c2310*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.480] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c5884*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c5884*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.481] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c8f78*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c8f78*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.483] WriteFile (in: hFile=0x5dc, lpBuffer=0x27cc72c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27cc72c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.484] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d0370*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0370*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.486] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d39f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d39f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.487] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d7088*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d7088*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.488] WriteFile (in: hFile=0x5dc, lpBuffer=0x27dadb8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27dadb8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.489] WriteFile (in: hFile=0x5dc, lpBuffer=0x27deab0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27deab0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.491] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e27e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e27e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.492] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e6054*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e6054*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.493] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e9918*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e9918*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.494] WriteFile (in: hFile=0x5dc, lpBuffer=0x27ed644*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ed644*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.496] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f0e58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f0e58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.512] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f4e40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f4e40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.513] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f8ba8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f8ba8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.515] WriteFile (in: hFile=0x5dc, lpBuffer=0x27fc4cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27fc4cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.516] WriteFile (in: hFile=0x5dc, lpBuffer=0x280006c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280006c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.518] WriteFile (in: hFile=0x5dc, lpBuffer=0x2803cd8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2803cd8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.528] WriteFile (in: hFile=0x5dc, lpBuffer=0x2807fe8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2807fe8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.529] WriteFile (in: hFile=0x5dc, lpBuffer=0x280ba38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280ba38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.558] WriteFile (in: hFile=0x5dc, lpBuffer=0x280f1dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280f1dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.559] WriteFile (in: hFile=0x5dc, lpBuffer=0x2812e70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2812e70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.561] WriteFile (in: hFile=0x5dc, lpBuffer=0x2816b84*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2816b84*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.576] WriteFile (in: hFile=0x5dc, lpBuffer=0x281bf9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x281bf9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.581] WriteFile (in: hFile=0x5dc, lpBuffer=0x2821854*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2821854*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.582] WriteFile (in: hFile=0x5dc, lpBuffer=0x28254e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28254e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.584] WriteFile (in: hFile=0x5dc, lpBuffer=0x282917c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x282917c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.585] WriteFile (in: hFile=0x5dc, lpBuffer=0x282ce10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x282ce10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.587] WriteFile (in: hFile=0x5dc, lpBuffer=0x2830aa4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2830aa4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.589] WriteFile (in: hFile=0x5dc, lpBuffer=0x2834738*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2834738*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.591] WriteFile (in: hFile=0x5dc, lpBuffer=0x283844c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x283844c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.592] WriteFile (in: hFile=0x5dc, lpBuffer=0x283c0e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x283c0e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.594] WriteFile (in: hFile=0x5dc, lpBuffer=0x283fd74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x283fd74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.595] WriteFile (in: hFile=0x5dc, lpBuffer=0x2843a18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2843a18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.597] WriteFile (in: hFile=0x5dc, lpBuffer=0x284779c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x284779c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.598] WriteFile (in: hFile=0x5dc, lpBuffer=0x284b430*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x284b430*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.600] WriteFile (in: hFile=0x5dc, lpBuffer=0x284f144*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x284f144*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.602] WriteFile (in: hFile=0x5dc, lpBuffer=0x2852dd8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2852dd8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.603] WriteFile (in: hFile=0x5dc, lpBuffer=0x2856a6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2856a6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.635] WriteFile (in: hFile=0x5dc, lpBuffer=0x285a780*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x285a780*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.638] WriteFile (in: hFile=0x5dc, lpBuffer=0x285e414*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x285e414*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.639] WriteFile (in: hFile=0x5dc, lpBuffer=0x2862128*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2862128*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.641] WriteFile (in: hFile=0x5dc, lpBuffer=0x2865dbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2865dbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.642] WriteFile (in: hFile=0x5dc, lpBuffer=0x2869a50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2869a50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.644] WriteFile (in: hFile=0x5dc, lpBuffer=0x286d6e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x286d6e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.645] WriteFile (in: hFile=0x5dc, lpBuffer=0x28713f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28713f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.647] WriteFile (in: hFile=0x5dc, lpBuffer=0x287510c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x287510c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.648] WriteFile (in: hFile=0x5dc, lpBuffer=0x2878e20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2878e20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.650] WriteFile (in: hFile=0x5dc, lpBuffer=0x287cab4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x287cab4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.651] WriteFile (in: hFile=0x5dc, lpBuffer=0x28807c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28807c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.653] WriteFile (in: hFile=0x5dc, lpBuffer=0x288453c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x288453c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.654] WriteFile (in: hFile=0x5dc, lpBuffer=0x2888250*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2888250*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.656] WriteFile (in: hFile=0x5dc, lpBuffer=0x288bee4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x288bee4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.657] WriteFile (in: hFile=0x5dc, lpBuffer=0x288fc68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x288fc68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.658] WriteFile (in: hFile=0x5dc, lpBuffer=0x2893abc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2893abc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.660] WriteFile (in: hFile=0x5dc, lpBuffer=0x2897750*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2897750*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.661] WriteFile (in: hFile=0x5dc, lpBuffer=0x289b398*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x289b398*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.663] WriteFile (in: hFile=0x5dc, lpBuffer=0x289efbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x289efbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.664] WriteFile (in: hFile=0x5dc, lpBuffer=0x28a2be0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28a2be0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.666] WriteFile (in: hFile=0x5dc, lpBuffer=0x28a69c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28a69c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.668] WriteFile (in: hFile=0x5dc, lpBuffer=0x28aa5e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28aa5e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.670] WriteFile (in: hFile=0x5dc, lpBuffer=0x28ae20c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28ae20c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.671] WriteFile (in: hFile=0x5dc, lpBuffer=0x28b1e30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28b1e30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.713] WriteFile (in: hFile=0x5dc, lpBuffer=0x28b5a54*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28b5a54*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.716] WriteFile (in: hFile=0x5dc, lpBuffer=0x28b9678*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28b9678*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.717] WriteFile (in: hFile=0x5dc, lpBuffer=0x28bcd5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28bcd5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.719] WriteFile (in: hFile=0x5dc, lpBuffer=0x28c0c24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28c0c24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.720] WriteFile (in: hFile=0x5dc, lpBuffer=0x28c4848*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28c4848*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.722] WriteFile (in: hFile=0x5dc, lpBuffer=0x28c84ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28c84ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.734] WriteFile (in: hFile=0x5dc, lpBuffer=0x28cc8d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28cc8d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.736] WriteFile (in: hFile=0x5dc, lpBuffer=0x28d04fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28d04fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.739] WriteFile (in: hFile=0x5dc, lpBuffer=0x28d44c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28d44c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.741] WriteFile (in: hFile=0x5dc, lpBuffer=0x28d816c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28d816c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.743] WriteFile (in: hFile=0x5dc, lpBuffer=0x28dbf50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28dbf50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.744] WriteFile (in: hFile=0x5dc, lpBuffer=0x28dfb74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28dfb74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.746] WriteFile (in: hFile=0x5dc, lpBuffer=0x28e3798*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28e3798*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.748] WriteFile (in: hFile=0x5dc, lpBuffer=0x28e743c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28e743c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.750] WriteFile (in: hFile=0x5dc, lpBuffer=0x28eb0e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28eb0e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.752] WriteFile (in: hFile=0x5dc, lpBuffer=0x28eeec4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28eeec4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.754] WriteFile (in: hFile=0x5dc, lpBuffer=0x28f2ae8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28f2ae8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.756] WriteFile (in: hFile=0x5dc, lpBuffer=0x28f69ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28f69ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.792] WriteFile (in: hFile=0x5dc, lpBuffer=0x28fa5d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28fa5d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.793] WriteFile (in: hFile=0x5dc, lpBuffer=0x28fe274*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28fe274*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.796] WriteFile (in: hFile=0x5dc, lpBuffer=0x2901e98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2901e98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.798] WriteFile (in: hFile=0x5dc, lpBuffer=0x2905abc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2905abc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.799] WriteFile (in: hFile=0x5dc, lpBuffer=0x29096e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29096e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.801] WriteFile (in: hFile=0x5dc, lpBuffer=0x290d304*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x290d304*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.803] WriteFile (in: hFile=0x5dc, lpBuffer=0x2910fa8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2910fa8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.804] WriteFile (in: hFile=0x5dc, lpBuffer=0x2914bcc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2914bcc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.806] WriteFile (in: hFile=0x5dc, lpBuffer=0x29187f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29187f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.807] WriteFile (in: hFile=0x5dc, lpBuffer=0x291c414*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x291c414*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.809] WriteFile (in: hFile=0x5dc, lpBuffer=0x2920038*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2920038*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.811] WriteFile (in: hFile=0x5dc, lpBuffer=0x2923c5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2923c5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.813] WriteFile (in: hFile=0x5dc, lpBuffer=0x2927960*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2927960*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.815] WriteFile (in: hFile=0x5dc, lpBuffer=0x292b584*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x292b584*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.817] WriteFile (in: hFile=0x5dc, lpBuffer=0x292f228*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x292f228*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.819] WriteFile (in: hFile=0x5dc, lpBuffer=0x2932f3c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2932f3c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.821] WriteFile (in: hFile=0x5dc, lpBuffer=0x2936b60*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2936b60*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.823] WriteFile (in: hFile=0x5dc, lpBuffer=0x293a784*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x293a784*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.825] WriteFile (in: hFile=0x5dc, lpBuffer=0x293e568*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x293e568*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.826] WriteFile (in: hFile=0x5dc, lpBuffer=0x294218c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x294218c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.875] WriteFile (in: hFile=0x5dc, lpBuffer=0x2945db0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2945db0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.877] WriteFile (in: hFile=0x5dc, lpBuffer=0x29499d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29499d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.878] WriteFile (in: hFile=0x5dc, lpBuffer=0x294d5f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x294d5f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.880] WriteFile (in: hFile=0x5dc, lpBuffer=0x295121c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x295121c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.881] WriteFile (in: hFile=0x5dc, lpBuffer=0x2954e40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2954e40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.895] WriteFile (in: hFile=0x5dc, lpBuffer=0x2958ae4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2958ae4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.896] WriteFile (in: hFile=0x5dc, lpBuffer=0x295cadc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x295cadc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.913] WriteFile (in: hFile=0x5dc, lpBuffer=0x2967d24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2967d24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.915] WriteFile (in: hFile=0x5dc, lpBuffer=0x296b948*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x296b948*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.917] WriteFile (in: hFile=0x5dc, lpBuffer=0x296f56c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x296f56c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.918] WriteFile (in: hFile=0x5dc, lpBuffer=0x2973190*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2973190*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.919] WriteFile (in: hFile=0x5dc, lpBuffer=0x2976db4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2976db4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.958] WriteFile (in: hFile=0x5dc, lpBuffer=0x297a9d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x297a9d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0101.959] CloseHandle (hObject=0x5dc) returned 1
	[0101.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0101.959] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\km-kh", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\km-kh", lpFilePart=0x0) returned 0x45
	[0101.959] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\km-kh\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90894cc, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x90894cc, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x98e189c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0101.959] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90894cc, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x90894cc, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x98e189c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.959] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98e189c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x98e189c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x98e189c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x236c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0101.960] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98e189c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x98e189c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x98e189c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x236c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0101.960] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0101.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0101.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0101.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0101.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\km-kh", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\km-kh", lpFilePart=0x0) returned 0x45
	[0101.960] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\km-kh\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90894cc, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x90894cc, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x98e189c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0101.960] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90894cc, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x90894cc, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x98e189c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.960] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98e189c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x98e189c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x98e189c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x236c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0101.960] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0101.960] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0101.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0101.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0101.961] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\km-kh\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\km-kh\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0101.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0101.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\km-kh\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\km-kh\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0102.149] GetFileType (hFile=0x5dc) returned 0x1
	[0102.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.149] GetFileType (hFile=0x5dc) returned 0x1
	[0102.149] WriteFile (in: hFile=0x5dc, lpBuffer=0x297e67c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x297e67c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.150] CloseHandle (hObject=0x5dc) returned 1
	[0102.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.155] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kn", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kn", lpFilePart=0x0) returned 0x42
	[0102.155] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kn\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98e189c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x98e189c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa434b7f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0102.155] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98e189c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x98e189c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa434b7f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.155] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa434b7f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa434b7f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa434b7f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x270c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.156] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa434b7f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa434b7f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa434b7f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x270c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.156] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0102.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kn", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kn", lpFilePart=0x0) returned 0x42
	[0102.156] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kn\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98e189c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x98e189c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa434b7f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0102.156] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98e189c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x98e189c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa434b7f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.156] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa434b7f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa434b7f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa434b7f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x270c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.156] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.157] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0102.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.157] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kn\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.157] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kn\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\kn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0102.157] GetFileType (hFile=0x5dc) returned 0x1
	[0102.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.157] GetFileType (hFile=0x5dc) returned 0x1
	[0102.157] WriteFile (in: hFile=0x5dc, lpBuffer=0x29822a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29822a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.158] CloseHandle (hObject=0x5dc) returned 1
	[0102.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ko", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ko", lpFilePart=0x0) returned 0x42
	[0102.159] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ko\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa434b7f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa434b7f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaba610e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0102.159] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa434b7f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa434b7f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaba610e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.159] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba610e, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xaba610e, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaba610e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x168c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.159] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba610e, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xaba610e, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaba610e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x168c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.159] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0102.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ko", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ko", lpFilePart=0x0) returned 0x42
	[0102.160] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ko\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa434b7f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa434b7f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaba610e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0102.160] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa434b7f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa434b7f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaba610e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.160] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba610e, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xaba610e, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaba610e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x168c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.160] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.160] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0102.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ko\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ko\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ko\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\ko\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0102.161] GetFileType (hFile=0x5dc) returned 0x1
	[0102.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.161] GetFileType (hFile=0x5dc) returned 0x1
	[0102.161] WriteFile (in: hFile=0x5dc, lpBuffer=0x2985ec4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2985ec4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.161] CloseHandle (hObject=0x5dc) returned 1
	[0102.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.162] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kok", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kok", lpFilePart=0x0) returned 0x43
	[0102.162] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kok\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabcc372, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xabcc372, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb555a11, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0102.162] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabcc372, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xabcc372, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb555a11, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.162] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb555a11, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb555a11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb555a11, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.162] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb555a11, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb555a11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb555a11, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.162] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0102.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.163] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kok", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kok", lpFilePart=0x0) returned 0x43
	[0102.163] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kok\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabcc372, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xabcc372, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb555a11, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0102.163] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabcc372, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xabcc372, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb555a11, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.163] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb555a11, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb555a11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb555a11, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.163] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.163] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0102.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.163] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kok\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kok\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0102.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.163] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kok\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\kok\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0102.164] GetFileType (hFile=0x5dc) returned 0x1
	[0102.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.164] GetFileType (hFile=0x5dc) returned 0x1
	[0102.164] WriteFile (in: hFile=0x5dc, lpBuffer=0x2989af8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2989af8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.165] CloseHandle (hObject=0x5dc) returned 1
	[0102.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.165] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ku-arab", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ku-arab", lpFilePart=0x0) returned 0x47
	[0102.165] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ku-arab\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb555a11, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb555a11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbc0a3f4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0102.165] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb555a11, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb555a11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbc0a3f4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.165] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0a3f4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbc0a3f4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbc0a3f4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.166] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0a3f4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbc0a3f4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbc0a3f4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.166] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0102.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.166] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ku-arab", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ku-arab", lpFilePart=0x0) returned 0x47
	[0102.166] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ku-arab\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb555a11, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb555a11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbc0a3f4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0102.166] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb555a11, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb555a11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbc0a3f4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.166] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0a3f4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbc0a3f4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbc0a3f4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.167] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.167] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0102.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ku-arab\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ku-arab\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0102.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.167] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ku-arab\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\ku-arab\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0102.168] GetFileType (hFile=0x5dc) returned 0x1
	[0102.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.168] GetFileType (hFile=0x5dc) returned 0x1
	[0102.168] WriteFile (in: hFile=0x5dc, lpBuffer=0x298d80c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x298d80c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.168] CloseHandle (hObject=0x5dc) returned 1
	[0102.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ky", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ky", lpFilePart=0x0) returned 0x42
	[0102.169] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ky\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc0a3f4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbc0a3f4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc3c9ef6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0102.169] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc0a3f4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbc0a3f4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc3c9ef6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.170] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c9ef6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc3c9ef6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc3c9ef6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.170] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c9ef6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc3c9ef6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc3c9ef6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.170] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0102.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.170] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ky", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ky", lpFilePart=0x0) returned 0x42
	[0102.170] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ky\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc0a3f4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbc0a3f4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc3c9ef6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0102.170] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc0a3f4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbc0a3f4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc3c9ef6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.170] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c9ef6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc3c9ef6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc3c9ef6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.171] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.171] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0102.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.171] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ky\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ky\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.171] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ky\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\ky\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0102.171] GetFileType (hFile=0x5dc) returned 0x1
	[0102.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.171] GetFileType (hFile=0x5dc) returned 0x1
	[0102.172] WriteFile (in: hFile=0x5dc, lpBuffer=0x2991430*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2991430*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.172] CloseHandle (hObject=0x5dc) returned 1
	[0102.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.173] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lb-lu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lb-lu", lpFilePart=0x0) returned 0x45
	[0102.173] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lb-lu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc3c9ef6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc3c9ef6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xcda21d4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0102.173] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc3c9ef6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc3c9ef6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xcda21d4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.173] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcda21d4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xcda21d4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xce60d95, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x27cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.173] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcda21d4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xcda21d4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xce60d95, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x27cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.173] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0102.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lb-lu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lb-lu", lpFilePart=0x0) returned 0x45
	[0102.174] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lb-lu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc3c9ef6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc3c9ef6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xcda21d4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0102.174] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc3c9ef6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc3c9ef6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xcda21d4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.174] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcda21d4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xcda21d4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xce60d95, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x27cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.174] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.174] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0102.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lb-lu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lb-lu\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0102.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lb-lu\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\lb-lu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0102.175] GetFileType (hFile=0x5dc) returned 0x1
	[0102.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.175] GetFileType (hFile=0x5dc) returned 0x1
	[0102.175] WriteFile (in: hFile=0x5dc, lpBuffer=0x29950d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29950d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.176] CloseHandle (hObject=0x5dc) returned 1
	[0102.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.176] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lt", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lt", lpFilePart=0x0) returned 0x42
	[0102.176] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lt\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce60d95, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xce60d95, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd6df3c3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0102.176] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce60d95, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xce60d95, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd6df3c3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.177] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6df3c3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd6df3c3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd6df3c3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x250c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.177] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6df3c3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd6df3c3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd6df3c3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x250c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.177] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0102.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.177] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lt", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lt", lpFilePart=0x0) returned 0x42
	[0102.177] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lt\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce60d95, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xce60d95, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd6df3c3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0102.177] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce60d95, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xce60d95, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd6df3c3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.177] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6df3c3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd6df3c3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd6df3c3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x250c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.178] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.178] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0102.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.178] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lt\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.178] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lt\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\lt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0102.178] GetFileType (hFile=0x5dc) returned 0x1
	[0102.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.178] GetFileType (hFile=0x5dc) returned 0x1
	[0102.178] WriteFile (in: hFile=0x5dc, lpBuffer=0x2998cf8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2998cf8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.179] CloseHandle (hObject=0x5dc) returned 1
	[0102.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.179] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lv", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lv", lpFilePart=0x0) returned 0x42
	[0102.180] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lv\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6df3c3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd6df3c3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdd478f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0102.180] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6df3c3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd6df3c3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdd478f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.180] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd478f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdd478f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdd478f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.180] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd478f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdd478f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdd478f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.180] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0102.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lv", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lv", lpFilePart=0x0) returned 0x42
	[0102.181] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lv\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6df3c3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd6df3c3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdd478f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0102.181] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6df3c3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd6df3c3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdd478f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.181] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd478f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdd478f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdd478f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.181] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.181] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0102.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lv\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.181] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lv\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\lv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0102.182] GetFileType (hFile=0x5dc) returned 0x1
	[0102.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.182] GetFileType (hFile=0x5dc) returned 0x1
	[0102.182] WriteFile (in: hFile=0x5dc, lpBuffer=0x299c91c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x299c91c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.183] CloseHandle (hObject=0x5dc) returned 1
	[0102.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.183] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mi-nz", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mi-nz", lpFilePart=0x0) returned 0x45
	[0102.184] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mi-nz\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd478f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdd478f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe4bae99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0102.184] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd478f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdd478f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe4bae99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.184] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bae99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe4bae99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe4bae99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.185] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bae99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe4bae99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe4bae99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.185] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0102.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.185] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mi-nz", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mi-nz", lpFilePart=0x0) returned 0x45
	[0102.185] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mi-nz\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd478f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdd478f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe4bae99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0102.185] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd478f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdd478f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe4bae99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.185] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bae99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe4bae99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe4bae99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.185] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.186] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0102.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mi-nz\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mi-nz\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0102.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.186] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mi-nz\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\mi-nz\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0102.186] GetFileType (hFile=0x5dc) returned 0x1
	[0102.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.186] GetFileType (hFile=0x5dc) returned 0x1
	[0102.186] WriteFile (in: hFile=0x5dc, lpBuffer=0x29a05c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29a05c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.187] CloseHandle (hObject=0x5dc) returned 1
	[0102.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mk", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mk", lpFilePart=0x0) returned 0x42
	[0102.188] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mk\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4bae99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe4bae99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xecc6dc0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0102.188] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4bae99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe4bae99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xecc6dc0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.188] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc6dc0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xecc6dc0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xecc6dc0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x256c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.188] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc6dc0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xecc6dc0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xecc6dc0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x256c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.189] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0102.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.189] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mk", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mk", lpFilePart=0x0) returned 0x42
	[0102.189] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mk\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4bae99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe4bae99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xecc6dc0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0102.189] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4bae99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe4bae99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xecc6dc0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.189] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc6dc0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xecc6dc0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xecc6dc0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x256c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.189] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.189] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0102.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mk\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.190] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mk\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\mk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0102.190] GetFileType (hFile=0x5dc) returned 0x1
	[0102.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.190] GetFileType (hFile=0x5dc) returned 0x1
	[0102.190] WriteFile (in: hFile=0x5dc, lpBuffer=0x29a41e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29a41e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.191] CloseHandle (hObject=0x5dc) returned 1
	[0102.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.191] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ml-in", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ml-in", lpFilePart=0x0) returned 0x45
	[0102.191] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ml-in\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc6dc0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xecc6dc0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf486817, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0102.191] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc6dc0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xecc6dc0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf486817, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.192] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf486817, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf486817, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf486817, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x286c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.192] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf486817, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf486817, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf486817, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x286c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.192] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0102.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.192] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ml-in", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ml-in", lpFilePart=0x0) returned 0x45
	[0102.192] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ml-in\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc6dc0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xecc6dc0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf486817, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0102.192] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc6dc0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xecc6dc0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf486817, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.193] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf486817, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf486817, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf486817, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x286c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.193] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.193] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0102.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.193] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ml-in\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ml-in\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0102.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.193] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ml-in\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\ml-in\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0102.194] GetFileType (hFile=0x5dc) returned 0x1
	[0102.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.194] GetFileType (hFile=0x5dc) returned 0x1
	[0102.194] WriteFile (in: hFile=0x5dc, lpBuffer=0x29a7e88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29a7e88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.195] CloseHandle (hObject=0x5dc) returned 1
	[0102.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.195] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mn", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mn", lpFilePart=0x0) returned 0x42
	[0102.195] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mn\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf486817, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf486817, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfbdb1a2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0102.195] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf486817, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf486817, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfbdb1a2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.195] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdb1a2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfbdb1a2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfbdb1a2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x244c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.196] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdb1a2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfbdb1a2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfbdb1a2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x244c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.196] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0102.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.196] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mn", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mn", lpFilePart=0x0) returned 0x42
	[0102.196] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mn\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf486817, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf486817, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfbdb1a2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0102.196] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf486817, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf486817, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfbdb1a2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.196] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdb1a2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfbdb1a2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfbdb1a2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x244c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.196] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.197] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0102.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.197] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mn\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.197] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mn\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\mn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.312] GetFileType (hFile=0x2ec) returned 0x1
	[0102.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.312] GetFileType (hFile=0x2ec) returned 0x1
	[0102.312] WriteFile (in: hFile=0x2ec, lpBuffer=0x29abbb8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29abbb8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.313] CloseHandle (hObject=0x2ec) returned 1
	[0102.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.313] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mr", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mr", lpFilePart=0x0) returned 0x42
	[0102.314] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mr\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbdb1a2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfbdb1a2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1034e754, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0102.314] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbdb1a2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfbdb1a2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1034e754, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.314] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e754, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1034e754, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1034e754, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.314] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e754, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1034e754, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1034e754, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.314] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0102.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.314] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mr", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mr", lpFilePart=0x0) returned 0x42
	[0102.315] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mr\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbdb1a2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfbdb1a2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1034e754, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0102.315] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbdb1a2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfbdb1a2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1034e754, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.315] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e754, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1034e754, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1034e754, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.315] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.315] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0102.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.315] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mr\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.316] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mr\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\mr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.317] GetFileType (hFile=0x2ec) returned 0x1
	[0102.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.317] GetFileType (hFile=0x2ec) returned 0x1
	[0102.317] WriteFile (in: hFile=0x2ec, lpBuffer=0x29af7dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29af7dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.318] CloseHandle (hObject=0x2ec) returned 1
	[0102.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.318] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ms", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ms", lpFilePart=0x0) returned 0x42
	[0102.318] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ms\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1034e754, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1034e754, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10a2939b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0102.318] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1034e754, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1034e754, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10a2939b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.319] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10a2939b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10a2939b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10a2939b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.319] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10a2939b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10a2939b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10a2939b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.319] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0102.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ms", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ms", lpFilePart=0x0) returned 0x42
	[0102.319] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ms\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1034e754, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1034e754, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10a2939b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0102.319] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1034e754, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1034e754, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10a2939b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.319] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10a2939b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10a2939b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10a2939b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.319] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.320] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0102.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.320] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ms\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ms\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.320] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ms\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\ms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.320] GetFileType (hFile=0x2ec) returned 0x1
	[0102.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.320] GetFileType (hFile=0x2ec) returned 0x1
	[0102.321] WriteFile (in: hFile=0x2ec, lpBuffer=0x29b3400*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29b3400*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.321] CloseHandle (hObject=0x2ec) returned 1
	[0102.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.322] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mt-mt", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mt-mt", lpFilePart=0x0) returned 0x45
	[0102.322] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mt-mt\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10a2939b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10a2939b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10d6dd08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0102.322] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10a2939b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10a2939b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10d6dd08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.323] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10d6dd08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10d6dd08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10d6dd08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.323] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10d6dd08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10d6dd08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10d6dd08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.323] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0102.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.323] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mt-mt", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mt-mt", lpFilePart=0x0) returned 0x45
	[0102.323] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mt-mt\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10a2939b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10a2939b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10d6dd08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0102.323] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10a2939b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10a2939b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10d6dd08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.323] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10d6dd08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10d6dd08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10d6dd08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.324] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.324] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0102.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.324] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mt-mt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mt-mt\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0102.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.324] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mt-mt\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\mt-mt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.324] GetFileType (hFile=0x2ec) returned 0x1
	[0102.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.324] GetFileType (hFile=0x2ec) returned 0x1
	[0102.324] WriteFile (in: hFile=0x2ec, lpBuffer=0x29b70a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29b70a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.325] CloseHandle (hObject=0x2ec) returned 1
	[0102.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.325] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nb-no", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nb-no", lpFilePart=0x0) returned 0x45
	[0102.326] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nb-no\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10d6dd08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10d6dd08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11199ef0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0102.326] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10d6dd08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10d6dd08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11199ef0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.326] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11199ef0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11199ef0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11199ef0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.327] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11199ef0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11199ef0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11199ef0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.327] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0102.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.327] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nb-no", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nb-no", lpFilePart=0x0) returned 0x45
	[0102.327] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nb-no\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10d6dd08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10d6dd08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11199ef0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0102.327] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10d6dd08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10d6dd08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11199ef0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.327] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11199ef0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11199ef0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11199ef0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.327] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.327] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0102.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.328] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nb-no\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nb-no\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0102.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.328] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nb-no\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\nb-no\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.328] GetFileType (hFile=0x2ec) returned 0x1
	[0102.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.328] GetFileType (hFile=0x2ec) returned 0x1
	[0102.329] WriteFile (in: hFile=0x2ec, lpBuffer=0x29bad48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29bad48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.329] CloseHandle (hObject=0x2ec) returned 1
	[0102.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.330] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ne-np", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ne-np", lpFilePart=0x0) returned 0x45
	[0102.330] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ne-np\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11199ef0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11199ef0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1159fe85, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0102.330] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11199ef0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11199ef0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1159fe85, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.330] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1159fe85, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1159fe85, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1159fe85, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.330] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1159fe85, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1159fe85, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1159fe85, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.330] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0102.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.330] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ne-np", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ne-np", lpFilePart=0x0) returned 0x45
	[0102.331] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ne-np\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11199ef0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11199ef0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1159fe85, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0102.331] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11199ef0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11199ef0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1159fe85, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.331] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1159fe85, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1159fe85, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1159fe85, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.331] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.331] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0102.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.331] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ne-np\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ne-np\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0102.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.331] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ne-np\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\ne-np\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.332] GetFileType (hFile=0x2ec) returned 0x1
	[0102.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.332] GetFileType (hFile=0x2ec) returned 0x1
	[0102.332] WriteFile (in: hFile=0x2ec, lpBuffer=0x29be9ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29be9ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.332] CloseHandle (hObject=0x2ec) returned 1
	[0102.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.333] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nl", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nl", lpFilePart=0x0) returned 0x42
	[0102.333] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nl\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1159fe85, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1159fe85, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x119cc05c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0102.333] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1159fe85, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1159fe85, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x119cc05c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.334] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119cc05c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x119cc05c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x119cc05c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.334] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119cc05c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x119cc05c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x119cc05c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.334] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0102.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nl", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nl", lpFilePart=0x0) returned 0x42
	[0102.334] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nl\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1159fe85, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1159fe85, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x119cc05c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0102.334] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1159fe85, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1159fe85, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x119cc05c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.334] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119cc05c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x119cc05c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x119cc05c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.334] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.335] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0102.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.335] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nl\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.335] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nl\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\nl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.335] GetFileType (hFile=0x2ec) returned 0x1
	[0102.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.335] GetFileType (hFile=0x2ec) returned 0x1
	[0102.335] WriteFile (in: hFile=0x2ec, lpBuffer=0x29c2610*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29c2610*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.336] CloseHandle (hObject=0x2ec) returned 1
	[0102.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.336] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nn-no", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nn-no", lpFilePart=0x0) returned 0x45
	[0102.337] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nn-no\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x119cc05c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x119cc05c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11e446f7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0102.337] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x119cc05c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x119cc05c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11e446f7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.337] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e446f7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11e446f7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11e446f7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.337] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e446f7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11e446f7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11e446f7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.337] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0102.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.337] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nn-no", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nn-no", lpFilePart=0x0) returned 0x45
	[0102.338] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nn-no\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x119cc05c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x119cc05c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11e446f7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0102.338] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x119cc05c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x119cc05c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11e446f7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.338] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e446f7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11e446f7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11e446f7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.338] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.338] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0102.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nn-no\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nn-no\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0102.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.338] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nn-no\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\nn-no\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.339] GetFileType (hFile=0x2ec) returned 0x1
	[0102.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.339] GetFileType (hFile=0x2ec) returned 0x1
	[0102.339] WriteFile (in: hFile=0x2ec, lpBuffer=0x29c62b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29c62b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.340] CloseHandle (hObject=0x2ec) returned 1
	[0102.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.340] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nso-za", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nso-za", lpFilePart=0x0) returned 0x46
	[0102.340] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nso-za\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11e446f7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11e446f7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x122e2ffb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0102.341] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11e446f7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11e446f7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x122e2ffb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.341] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x122e2ffb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x122e2ffb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x122e2ffb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x264c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.341] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x122e2ffb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x122e2ffb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x122e2ffb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x264c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.341] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0102.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nso-za", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nso-za", lpFilePart=0x0) returned 0x46
	[0102.342] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nso-za\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11e446f7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11e446f7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x122e2ffb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0102.342] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11e446f7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11e446f7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x122e2ffb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.342] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x122e2ffb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x122e2ffb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x122e2ffb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x264c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.342] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.342] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0102.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.342] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nso-za\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nso-za\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0102.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.342] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nso-za\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\nso-za\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.343] GetFileType (hFile=0x2ec) returned 0x1
	[0102.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.343] GetFileType (hFile=0x2ec) returned 0x1
	[0102.343] WriteFile (in: hFile=0x2ec, lpBuffer=0x29c9fb8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29c9fb8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.344] CloseHandle (hObject=0x2ec) returned 1
	[0102.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.344] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\or-in", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\or-in", lpFilePart=0x0) returned 0x45
	[0102.344] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\or-in\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x122e2ffb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x122e2ffb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1275b68c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0102.345] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x122e2ffb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x122e2ffb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1275b68c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.345] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1275b68c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1275b68c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1275b68c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x280c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.345] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1275b68c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1275b68c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1275b68c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x280c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.345] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0102.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\or-in", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\or-in", lpFilePart=0x0) returned 0x45
	[0102.345] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\or-in\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x122e2ffb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x122e2ffb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1275b68c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0102.346] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x122e2ffb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x122e2ffb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1275b68c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.346] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1275b68c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1275b68c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1275b68c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x280c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.346] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.346] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0102.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\or-in\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\or-in\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0102.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.346] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\or-in\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\or-in\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.346] GetFileType (hFile=0x2ec) returned 0x1
	[0102.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.346] GetFileType (hFile=0x2ec) returned 0x1
	[0102.347] WriteFile (in: hFile=0x2ec, lpBuffer=0x29cdc5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29cdc5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.347] CloseHandle (hObject=0x2ec) returned 1
	[0102.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa", lpFilePart=0x0) returned 0x42
	[0102.348] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1275b68c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1275b68c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12b3b3bd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0102.348] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1275b68c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1275b68c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12b3b3bd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.348] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12b3b3bd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12b3b3bd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12b3b3bd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x250c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.348] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12b3b3bd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12b3b3bd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12b3b3bd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x250c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.348] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0102.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa", lpFilePart=0x0) returned 0x42
	[0102.349] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1275b68c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1275b68c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12b3b3bd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0102.349] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1275b68c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1275b68c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12b3b3bd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.349] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12b3b3bd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12b3b3bd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12b3b3bd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x250c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.349] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.349] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0102.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.349] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.349] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\pa\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.349] GetFileType (hFile=0x2ec) returned 0x1
	[0102.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.350] GetFileType (hFile=0x2ec) returned 0x1
	[0102.350] WriteFile (in: hFile=0x2ec, lpBuffer=0x29d1880*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29d1880*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.351] CloseHandle (hObject=0x2ec) returned 1
	[0102.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa-arab", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa-arab", lpFilePart=0x0) returned 0x47
	[0102.351] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa-arab\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b3b3bd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12b3b3bd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0102.407] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b3b3bd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12b3b3bd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.407] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x244c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.407] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x244c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.407] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0102.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.407] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa-arab", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa-arab", lpFilePart=0x0) returned 0x47
	[0102.407] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa-arab\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b3b3bd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12b3b3bd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0102.407] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b3b3bd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12b3b3bd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.408] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x244c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.408] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.408] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0102.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.408] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa-arab\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa-arab\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0102.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.408] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa-arab\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\pa-arab\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.409] GetFileType (hFile=0x2ec) returned 0x1
	[0102.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.409] GetFileType (hFile=0x2ec) returned 0x1
	[0102.409] WriteFile (in: hFile=0x2ec, lpBuffer=0x2577d50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2577d50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.410] CloseHandle (hObject=0x2ec) returned 1
	[0102.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pl", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pl", lpFilePart=0x0) returned 0x42
	[0102.410] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pl\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13b06d1c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0102.410] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13b06d1c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.410] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b06d1c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13b06d1c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13b06d1c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x26ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.410] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b06d1c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13b06d1c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13b06d1c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x26ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.411] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0102.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pl", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pl", lpFilePart=0x0) returned 0x42
	[0102.411] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pl\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13b06d1c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0102.411] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13b06d1c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.411] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b06d1c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13b06d1c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13b06d1c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x26ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.412] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.412] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0102.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.412] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pl\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.412] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pl\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\pl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.412] GetFileType (hFile=0x2ec) returned 0x1
	[0102.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.412] GetFileType (hFile=0x2ec) returned 0x1
	[0102.412] WriteFile (in: hFile=0x2ec, lpBuffer=0x257bbd8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x257bbd8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.413] CloseHandle (hObject=0x2ec) returned 1
	[0102.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\platforms", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\platforms", lpFilePart=0x0) returned 0x49
	[0102.413] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\platforms\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13e694e3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13e694e3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142956c8, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0102.414] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13e694e3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13e694e3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142956c8, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.414] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142956c8, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142956c8, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142956c8, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x10c4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="qwindows.dll", cAlternateFileName="")) returned 1
	[0102.414] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142956c8, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142956c8, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142956c8, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x10c4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="qwindows.dll", cAlternateFileName="")) returned 0
	[0102.414] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0102.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.414] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\platforms", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\platforms", lpFilePart=0x0) returned 0x49
	[0102.414] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\platforms\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13e694e3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13e694e3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142956c8, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0102.414] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13e694e3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13e694e3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142956c8, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.414] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142956c8, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142956c8, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142956c8, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x10c4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="qwindows.dll", cAlternateFileName="")) returned 1
	[0102.416] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.416] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0102.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.417] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\platforms\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\platforms\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0102.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.417] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\platforms\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\platforms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.417] GetFileType (hFile=0x2ec) returned 0x1
	[0102.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.417] GetFileType (hFile=0x2ec) returned 0x1
	[0102.417] WriteFile (in: hFile=0x2ec, lpBuffer=0x258b02c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258b02c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.418] CloseHandle (hObject=0x2ec) returned 1
	[0102.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.418] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\prs-af", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\prs-af", lpFilePart=0x0) returned 0x46
	[0102.418] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\prs-af\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x142bb925, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142bb925, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0102.418] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x142bb925, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142bb925, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.419] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.419] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.419] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0102.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\prs-af", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\prs-af", lpFilePart=0x0) returned 0x46
	[0102.419] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\prs-af\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x142bb925, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142bb925, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0102.419] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x142bb925, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142bb925, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.419] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.419] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.419] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0102.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.420] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\prs-af\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\prs-af\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0102.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.420] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\prs-af\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\prs-af\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.420] GetFileType (hFile=0x2ec) returned 0x1
	[0102.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.420] GetFileType (hFile=0x2ec) returned 0x1
	[0102.420] WriteFile (in: hFile=0x2ec, lpBuffer=0x258ed30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258ed30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.421] CloseHandle (hObject=0x2ec) returned 1
	[0102.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.421] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-br", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-br", lpFilePart=0x0) returned 0x45
	[0102.421] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-br\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0102.422] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.422] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x252c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.422] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x252c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.422] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0102.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.423] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-br", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-br", lpFilePart=0x0) returned 0x45
	[0102.423] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-br\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0102.423] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.423] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x252c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.423] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.423] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0102.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.423] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-br\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-br\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0102.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.423] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-br\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\pt-br\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.424] GetFileType (hFile=0x2ec) returned 0x1
	[0102.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.425] GetFileType (hFile=0x2ec) returned 0x1
	[0102.425] WriteFile (in: hFile=0x2ec, lpBuffer=0x25929d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25929d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.427] CloseHandle (hObject=0x2ec) returned 1
	[0102.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-pt", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-pt", lpFilePart=0x0) returned 0x45
	[0102.428] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-pt\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14ea7587, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0102.428] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14ea7587, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.428] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14ea7587, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14ea7587, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14ecd7c9, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x262c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.428] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14ea7587, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14ea7587, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14ecd7c9, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x262c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.428] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0102.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.429] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-pt", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-pt", lpFilePart=0x0) returned 0x45
	[0102.429] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-pt\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14ea7587, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0102.429] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14ea7587, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.429] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14ea7587, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14ea7587, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14ecd7c9, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x262c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.429] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.429] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0102.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.429] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-pt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-pt\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0102.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.429] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-pt\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\pt-pt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.430] GetFileType (hFile=0x2ec) returned 0x1
	[0102.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.430] GetFileType (hFile=0x2ec) returned 0x1
	[0102.430] WriteFile (in: hFile=0x2ec, lpBuffer=0x2596678*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2596678*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.431] CloseHandle (hObject=0x2ec) returned 1
	[0102.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml", lpFilePart=0x0) returned 0x43
	[0102.431] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ecd7c9, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ec87e47, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0102.432] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ecd7c9, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ec87e47, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.432] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15261046, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15261046, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15261046, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1a05c, dwReserved0=0x0, dwReserved1=0x0, cFileName="fabricmdl2.ttf", cAlternateFileName="FABRIC~1.TTF")) returned 1
	[0102.432] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f827600, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f827600, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QtQuick", cAlternateFileName="")) returned 1
	[0102.432] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ec87e47, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f4478d5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f4478d5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QtQuick.2", cAlternateFileName="")) returned 1
	[0102.432] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.432] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0102.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.432] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml", lpFilePart=0x0) returned 0x43
	[0102.432] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ecd7c9, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ec87e47, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0102.432] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ecd7c9, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ec87e47, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.433] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15261046, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15261046, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15261046, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1a05c, dwReserved0=0x0, dwReserved1=0x0, cFileName="fabricmdl2.ttf", cAlternateFileName="FABRIC~1.TTF")) returned 1
	[0102.433] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f827600, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f827600, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QtQuick", cAlternateFileName="")) returned 1
	[0102.433] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ec87e47, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f4478d5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f4478d5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QtQuick.2", cAlternateFileName="")) returned 1
	[0102.433] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ec87e47, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f4478d5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f4478d5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QtQuick.2", cAlternateFileName="")) returned 0
	[0102.433] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0102.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0102.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.433] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\qml\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.433] GetFileType (hFile=0x2ec) returned 0x1
	[0102.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.434] GetFileType (hFile=0x2ec) returned 0x1
	[0102.434] WriteFile (in: hFile=0x2ec, lpBuffer=0x259a7f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259a7f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.434] CloseHandle (hObject=0x2ec) returned 1
	[0102.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.434] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qut-latn", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qut-latn", lpFilePart=0x0) returned 0x48
	[0102.435] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qut-latn\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x152d3757, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x152d3757, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15666fc7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0102.435] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x152d3757, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x152d3757, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15666fc7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.435] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15666fc7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15666fc7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15666fc7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x20ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.435] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15666fc7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15666fc7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15666fc7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x20ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.435] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0102.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.435] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qut-latn", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qut-latn", lpFilePart=0x0) returned 0x48
	[0102.435] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qut-latn\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x152d3757, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x152d3757, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15666fc7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0102.436] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x152d3757, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x152d3757, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15666fc7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.436] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15666fc7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15666fc7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15666fc7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x20ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.436] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.436] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0102.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0102.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0102.436] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qut-latn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qut-latn\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0102.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0102.436] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qut-latn\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\qut-latn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.436] GetFileType (hFile=0x2ec) returned 0x1
	[0102.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0102.436] GetFileType (hFile=0x2ec) returned 0x1
	[0102.437] WriteFile (in: hFile=0x2ec, lpBuffer=0x259e568*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259e568*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.437] CloseHandle (hObject=0x2ec) returned 1
	[0102.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0102.437] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\quz-pe", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\quz-pe", lpFilePart=0x0) returned 0x46
	[0102.437] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\quz-pe\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1568d220, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1568d220, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0102.438] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1568d220, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1568d220, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.438] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x264c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.438] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x264c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.438] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0102.439] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\quz-pe", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\quz-pe", lpFilePart=0x0) returned 0x46
	[0102.439] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\quz-pe\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1568d220, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1568d220, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0102.439] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1568d220, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1568d220, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.439] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x264c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.439] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.439] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0102.439] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\quz-pe\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\quz-pe\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0102.439] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\quz-pe\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quz-pe\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.479] GetFileType (hFile=0x2ec) returned 0x1
	[0102.479] GetFileType (hFile=0x2ec) returned 0x1
	[0102.479] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a226c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a226c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.480] CloseHandle (hObject=0x2ec) returned 1
	[0102.480] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ro", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ro", lpFilePart=0x0) returned 0x42
	[0102.480] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ro\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0102.480] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.480] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x258c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.480] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x258c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.481] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0102.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ro", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ro", lpFilePart=0x0) returned 0x42
	[0102.481] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ro\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0102.481] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.481] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x258c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.481] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.481] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0102.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ro\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ro\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.481] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ro\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\ro\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.482] GetFileType (hFile=0x2ec) returned 0x1
	[0102.482] GetFileType (hFile=0x2ec) returned 0x1
	[0102.482] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a5e90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a5e90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.483] CloseHandle (hObject=0x2ec) returned 1
	[0102.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ru", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ru", lpFilePart=0x0) returned 0x42
	[0102.483] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ru\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0102.484] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.484] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.484] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.484] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0102.484] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ru", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ru", lpFilePart=0x0) returned 0x42
	[0102.484] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ru\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0102.484] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.484] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.485] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.485] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0102.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ru\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ru\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.485] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ru\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\ru\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.485] GetFileType (hFile=0x2ec) returned 0x1
	[0102.485] GetFileType (hFile=0x2ec) returned 0x1
	[0102.485] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a9ab4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a9ab4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.486] CloseHandle (hObject=0x2ec) returned 1
	[0102.486] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\rw", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\rw", lpFilePart=0x0) returned 0x42
	[0102.486] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\rw\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0102.486] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.487] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.487] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.487] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0102.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\rw", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\rw", lpFilePart=0x0) returned 0x42
	[0102.487] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\rw\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0102.487] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.487] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.487] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.487] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0102.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\rw\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\rw\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\rw\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\rw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.488] GetFileType (hFile=0x2ec) returned 0x1
	[0102.488] GetFileType (hFile=0x2ec) returned 0x1
	[0102.488] WriteFile (in: hFile=0x2ec, lpBuffer=0x25ad6d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ad6d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.489] CloseHandle (hObject=0x2ec) returned 1
	[0102.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sd-arab", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sd-arab", lpFilePart=0x0) returned 0x47
	[0102.489] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sd-arab\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0102.490] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.490] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.490] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.490] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0102.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sd-arab", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sd-arab", lpFilePart=0x0) returned 0x47
	[0102.490] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sd-arab\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0102.490] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.491] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.491] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.491] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0102.491] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sd-arab\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sd-arab\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0102.491] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sd-arab\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\sd-arab\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.492] GetFileType (hFile=0x2ec) returned 0x1
	[0102.492] GetFileType (hFile=0x2ec) returned 0x1
	[0102.492] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b13ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b13ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.493] CloseHandle (hObject=0x2ec) returned 1
	[0102.493] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\si-lk", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\si-lk", lpFilePart=0x0) returned 0x45
	[0102.493] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\si-lk\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0102.493] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.493] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.493] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.493] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0102.494] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\si-lk", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\si-lk", lpFilePart=0x0) returned 0x45
	[0102.494] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\si-lk\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0102.494] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.494] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.494] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.494] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0102.494] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\si-lk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\si-lk\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0102.494] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\si-lk\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\si-lk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.495] GetFileType (hFile=0x2ec) returned 0x1
	[0102.495] GetFileType (hFile=0x2ec) returned 0x1
	[0102.495] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b5090*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b5090*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.496] CloseHandle (hObject=0x2ec) returned 1
	[0102.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sk", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sk", lpFilePart=0x0) returned 0x42
	[0102.496] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sk\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0102.497] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.497] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.497] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.497] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0102.497] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sk", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sk", lpFilePart=0x0) returned 0x42
	[0102.497] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sk\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0102.497] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.497] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.497] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.497] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0102.498] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sk\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.498] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sk\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\sk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.498] GetFileType (hFile=0x2ec) returned 0x1
	[0102.498] GetFileType (hFile=0x2ec) returned 0x1
	[0102.498] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b8cb4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b8cb4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.499] CloseHandle (hObject=0x2ec) returned 1
	[0102.499] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sl", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sl", lpFilePart=0x0) returned 0x42
	[0102.499] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sl\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0102.499] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.499] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x252c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.499] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x252c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.499] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0102.500] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sl", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sl", lpFilePart=0x0) returned 0x42
	[0102.500] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sl\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0102.500] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.500] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x252c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.500] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.500] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0102.500] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sl\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.500] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sl\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\sl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.500] GetFileType (hFile=0x2ec) returned 0x1
	[0102.501] GetFileType (hFile=0x2ec) returned 0x1
	[0102.501] WriteFile (in: hFile=0x2ec, lpBuffer=0x25bc8d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bc8d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.501] CloseHandle (hObject=0x2ec) returned 1
	[0102.501] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sq", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sq", lpFilePart=0x0) returned 0x42
	[0102.501] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sq\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0102.502] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.502] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x262c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.502] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x262c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.502] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0102.503] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sq", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sq", lpFilePart=0x0) returned 0x42
	[0102.503] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sq\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0102.503] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.503] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x262c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.503] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.503] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0102.503] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sq\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sq\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0102.503] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sq\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\sq\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0102.504] GetFileType (hFile=0x2ec) returned 0x1
	[0102.504] GetFileType (hFile=0x2ec) returned 0x1
	[0102.504] WriteFile (in: hFile=0x2ec, lpBuffer=0x25c04fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c04fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.505] CloseHandle (hObject=0x2ec) returned 1
	[0102.505] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sr-cyrl-ba", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sr-cyrl-ba", lpFilePart=0x0) returned 0x4a
	[0102.505] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sr-cyrl-ba\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0102.505] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.505] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17e7c8e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17e7c8e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.505] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17e7c8e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17e7c8e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0102.506] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0102.506] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sr-cyrl-ba", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sr-cyrl-ba", lpFilePart=0x0) returned 0x4a
	[0102.506] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sr-cyrl-ba\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0102.506] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.506] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17e7c8e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17e7c8e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0102.509] WriteFile (in: hFile=0x2ec, lpBuffer=0x25c42e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c42e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.513] WriteFile (in: hFile=0x2ec, lpBuffer=0x25c80c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c80c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.514] WriteFile (in: hFile=0x2ec, lpBuffer=0x25cbea8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cbea8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.516] WriteFile (in: hFile=0x2ec, lpBuffer=0x25cfacc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cfacc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.557] WriteFile (in: hFile=0x2ec, lpBuffer=0x25d36f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d36f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.560] WriteFile (in: hFile=0x2ec, lpBuffer=0x25d7314*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d7314*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.561] WriteFile (in: hFile=0x2ec, lpBuffer=0x25daf38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25daf38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.563] WriteFile (in: hFile=0x2ec, lpBuffer=0x25dec4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25dec4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.565] WriteFile (in: hFile=0x2ec, lpBuffer=0x25e2870*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e2870*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.567] WriteFile (in: hFile=0x2ec, lpBuffer=0x25e6494*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e6494*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.569] WriteFile (in: hFile=0x2ec, lpBuffer=0x25ea138*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ea138*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.571] WriteFile (in: hFile=0x2ec, lpBuffer=0x25edddc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25edddc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.573] WriteFile (in: hFile=0x2ec, lpBuffer=0x25f1a00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f1a00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.575] WriteFile (in: hFile=0x2ec, lpBuffer=0x25f5624*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f5624*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.576] WriteFile (in: hFile=0x2ec, lpBuffer=0x25f9338*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f9338*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.578] WriteFile (in: hFile=0x2ec, lpBuffer=0x25fcf5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fcf5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.579] WriteFile (in: hFile=0x2ec, lpBuffer=0x2600b80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2600b80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.581] WriteFile (in: hFile=0x2ec, lpBuffer=0x2604964*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2604964*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.583] WriteFile (in: hFile=0x2ec, lpBuffer=0x2608588*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2608588*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.586] WriteFile (in: hFile=0x2ec, lpBuffer=0x260c1ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260c1ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.587] WriteFile (in: hFile=0x2ec, lpBuffer=0x260fe50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260fe50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.589] WriteFile (in: hFile=0x2ec, lpBuffer=0x2613af4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2613af4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.591] WriteFile (in: hFile=0x2ec, lpBuffer=0x2617798*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2617798*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.592] WriteFile (in: hFile=0x2ec, lpBuffer=0x261b43c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261b43c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.635] WriteFile (in: hFile=0x2ec, lpBuffer=0x261f0e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261f0e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.637] WriteFile (in: hFile=0x2ec, lpBuffer=0x2622fa8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2622fa8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.639] WriteFile (in: hFile=0x2ec, lpBuffer=0x2626bcc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2626bcc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.640] WriteFile (in: hFile=0x2ec, lpBuffer=0x262a870*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262a870*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.642] WriteFile (in: hFile=0x2ec, lpBuffer=0x262ec5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262ec5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.643] WriteFile (in: hFile=0x2ec, lpBuffer=0x2632880*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2632880*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.645] WriteFile (in: hFile=0x2ec, lpBuffer=0x263684c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263684c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.646] WriteFile (in: hFile=0x2ec, lpBuffer=0x263a4f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263a4f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.648] WriteFile (in: hFile=0x2ec, lpBuffer=0x263e2d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263e2d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.649] WriteFile (in: hFile=0x2ec, lpBuffer=0x2641ef8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2641ef8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.650] WriteFile (in: hFile=0x2ec, lpBuffer=0x2645b1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2645b1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.652] WriteFile (in: hFile=0x2ec, lpBuffer=0x26497c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26497c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.654] WriteFile (in: hFile=0x2ec, lpBuffer=0x264d464*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264d464*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.656] WriteFile (in: hFile=0x2ec, lpBuffer=0x2651248*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2651248*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.659] WriteFile (in: hFile=0x2ec, lpBuffer=0x2654e6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2654e6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.660] WriteFile (in: hFile=0x2ec, lpBuffer=0x2658d30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2658d30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.663] WriteFile (in: hFile=0x2ec, lpBuffer=0x265c954*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265c954*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.664] WriteFile (in: hFile=0x2ec, lpBuffer=0x26605f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26605f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.666] WriteFile (in: hFile=0x2ec, lpBuffer=0x266421c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266421c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.667] WriteFile (in: hFile=0x2ec, lpBuffer=0x2667e40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2667e40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.669] WriteFile (in: hFile=0x2ec, lpBuffer=0x266ba64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266ba64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.671] WriteFile (in: hFile=0x2ec, lpBuffer=0x266f688*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266f688*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.708] WriteFile (in: hFile=0x2ec, lpBuffer=0x267332c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267332c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.709] WriteFile (in: hFile=0x2ec, lpBuffer=0x2676f50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2676f50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.711] WriteFile (in: hFile=0x2ec, lpBuffer=0x267ab74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267ab74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.713] WriteFile (in: hFile=0x2ec, lpBuffer=0x267e798*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267e798*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.714] WriteFile (in: hFile=0x2ec, lpBuffer=0x26823bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26823bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.716] WriteFile (in: hFile=0x2ec, lpBuffer=0x2685fe0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2685fe0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.718] WriteFile (in: hFile=0x2ec, lpBuffer=0x2689ce4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2689ce4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.720] WriteFile (in: hFile=0x2ec, lpBuffer=0x268d908*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268d908*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.721] WriteFile (in: hFile=0x2ec, lpBuffer=0x26915ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26915ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.723] WriteFile (in: hFile=0x2ec, lpBuffer=0x26952c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26952c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.724] WriteFile (in: hFile=0x2ec, lpBuffer=0x2698ee4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2698ee4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.726] WriteFile (in: hFile=0x2ec, lpBuffer=0x269cb08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269cb08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.727] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a08ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a08ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.730] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a4510*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a4510*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.732] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a8134*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a8134*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.733] WriteFile (in: hFile=0x2ec, lpBuffer=0x26abd58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26abd58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.735] WriteFile (in: hFile=0x2ec, lpBuffer=0x26af97c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26af97c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.736] WriteFile (in: hFile=0x2ec, lpBuffer=0x26b35a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b35a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.738] WriteFile (in: hFile=0x2ec, lpBuffer=0x26b71c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b71c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.739] WriteFile (in: hFile=0x2ec, lpBuffer=0x26bae68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bae68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.741] WriteFile (in: hFile=0x2ec, lpBuffer=0x26bee60*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bee60*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.780] WriteFile (in: hFile=0x2ec, lpBuffer=0x26ca418*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ca418*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.782] WriteFile (in: hFile=0x2ec, lpBuffer=0x26ce03c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ce03c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.783] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d1c60*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d1c60*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.785] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d5884*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d5884*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.787] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d94a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d94a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.790] WriteFile (in: hFile=0x2ec, lpBuffer=0x26dd0cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26dd0cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.791] WriteFile (in: hFile=0x2ec, lpBuffer=0x26e0d70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e0d70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0102.793] WriteFile (in: hFile=0x2ec, lpBuffer=0x26e4994*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e4994*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.422] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e85b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e85b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.424] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ec1ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ec1ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.426] WriteFile (in: hFile=0x5dc, lpBuffer=0x26eff00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26eff00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.428] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f3b24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f3b24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.429] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f77c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f77c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.432] WriteFile (in: hFile=0x5dc, lpBuffer=0x26fb3ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fb3ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.434] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ff010*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ff010*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.436] WriteFile (in: hFile=0x5dc, lpBuffer=0x2702cb4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2702cb4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.438] WriteFile (in: hFile=0x5dc, lpBuffer=0x27068d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27068d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.441] WriteFile (in: hFile=0x5dc, lpBuffer=0x270a57c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270a57c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.442] WriteFile (in: hFile=0x5dc, lpBuffer=0x270e1a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270e1a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.444] WriteFile (in: hFile=0x5dc, lpBuffer=0x2711dc4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2711dc4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.446] WriteFile (in: hFile=0x5dc, lpBuffer=0x27159e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27159e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.448] WriteFile (in: hFile=0x5dc, lpBuffer=0x271968c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271968c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.456] WriteFile (in: hFile=0x5dc, lpBuffer=0x271d330*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271d330*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.458] WriteFile (in: hFile=0x5dc, lpBuffer=0x2720fd4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2720fd4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.485] WriteFile (in: hFile=0x2ec, lpBuffer=0x2725074*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2725074*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.487] WriteFile (in: hFile=0x2ec, lpBuffer=0x2728d18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2728d18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.489] WriteFile (in: hFile=0x2ec, lpBuffer=0x272ca1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272ca1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.491] WriteFile (in: hFile=0x2ec, lpBuffer=0x27306c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27306c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.492] WriteFile (in: hFile=0x2ec, lpBuffer=0x27342e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27342e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.494] WriteFile (in: hFile=0x2ec, lpBuffer=0x2737ff8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2737ff8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.497] WriteFile (in: hFile=0x2ec, lpBuffer=0x273bc1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273bc1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.500] WriteFile (in: hFile=0x2ec, lpBuffer=0x273f7f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273f7f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.529] WriteFile (in: hFile=0x2ec, lpBuffer=0x274376c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274376c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.531] WriteFile (in: hFile=0x2ec, lpBuffer=0x2747410*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2747410*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.533] WriteFile (in: hFile=0x2ec, lpBuffer=0x274b0b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274b0b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.534] WriteFile (in: hFile=0x2ec, lpBuffer=0x274f230*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274f230*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.538] WriteFile (in: hFile=0x2ec, lpBuffer=0x2752fa4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2752fa4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.540] WriteFile (in: hFile=0x2ec, lpBuffer=0x2756ca8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2756ca8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.541] WriteFile (in: hFile=0x2ec, lpBuffer=0x275a8cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275a8cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.543] WriteFile (in: hFile=0x2ec, lpBuffer=0x275e4f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275e4f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.546] WriteFile (in: hFile=0x2ec, lpBuffer=0x2762114*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2762114*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.565] WriteFile (in: hFile=0x41c, lpBuffer=0x27662c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27662c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.567] WriteFile (in: hFile=0x41c, lpBuffer=0x2769f68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2769f68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.568] WriteFile (in: hFile=0x41c, lpBuffer=0x276db8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276db8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.570] WriteFile (in: hFile=0x41c, lpBuffer=0x27717b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27717b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.571] WriteFile (in: hFile=0x41c, lpBuffer=0x27753d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27753d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.590] WriteFile (in: hFile=0x41c, lpBuffer=0x277942c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277942c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.593] WriteFile (in: hFile=0x41c, lpBuffer=0x277d210*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277d210*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.595] WriteFile (in: hFile=0x41c, lpBuffer=0x2780ff4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2780ff4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.597] WriteFile (in: hFile=0x41c, lpBuffer=0x2784c18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2784c18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.599] WriteFile (in: hFile=0x41c, lpBuffer=0x278883c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278883c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.605] WriteFile (in: hFile=0x41c, lpBuffer=0x25893b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25893b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.606] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\te", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\te", lpFilePart=0x0) returned 0x42
	[0104.606] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\te\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x824908b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x824908b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x82c03db8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0104.607] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0104.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\te", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\te", lpFilePart=0x0) returned 0x42
	[0104.608] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\te\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x824908b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x824908b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x82c03db8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0104.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\te\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\te\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0104.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.608] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\te\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\te\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.609] GetFileType (hFile=0x41c) returned 0x1
	[0104.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.609] GetFileType (hFile=0x41c) returned 0x1
	[0104.609] WriteFile (in: hFile=0x41c, lpBuffer=0x258cfd4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x258cfd4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.610] CloseHandle (hObject=0x41c) returned 1
	[0104.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.610] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tg-cyrl", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tg-cyrl", lpFilePart=0x0) returned 0x47
	[0104.610] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tg-cyrl\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82dcdbf9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x82dcdbf9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8321fe2b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0104.611] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82dcdbf9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x82dcdbf9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8321fe2b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.611] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8321fe2b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8321fe2b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8321fe2b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x28ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.611] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8321fe2b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8321fe2b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8321fe2b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x28ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.611] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0104.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.611] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tg-cyrl", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tg-cyrl", lpFilePart=0x0) returned 0x47
	[0104.611] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tg-cyrl\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82dcdbf9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x82dcdbf9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8321fe2b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0104.611] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82dcdbf9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x82dcdbf9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8321fe2b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.612] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8321fe2b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8321fe2b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8321fe2b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x28ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.612] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.612] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0104.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.612] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tg-cyrl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tg-cyrl\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0104.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.612] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tg-cyrl\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\tg-cyrl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.612] GetFileType (hFile=0x41c) returned 0x1
	[0104.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.612] GetFileType (hFile=0x41c) returned 0x1
	[0104.612] WriteFile (in: hFile=0x41c, lpBuffer=0x2590ce8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2590ce8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.613] CloseHandle (hObject=0x41c) returned 1
	[0104.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.614] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\th", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\th", lpFilePart=0x0) returned 0x42
	[0104.614] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\th\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x832461b4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x832461b4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x835ffb5a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0104.614] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x832461b4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x832461b4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x835ffb5a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.615] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x835ffb5a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x835ffb5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x835ffb5a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x224a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.615] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x835ffb5a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x835ffb5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x835ffb5a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x224a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.615] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0104.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.615] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\th", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\th", lpFilePart=0x0) returned 0x42
	[0104.615] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\th\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x832461b4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x832461b4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x835ffb5a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0104.615] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x832461b4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x832461b4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x835ffb5a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.616] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x835ffb5a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x835ffb5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x835ffb5a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x224a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.616] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.616] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0104.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\th\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\th\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0104.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\th\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\th\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.617] GetFileType (hFile=0x41c) returned 0x1
	[0104.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.617] GetFileType (hFile=0x41c) returned 0x1
	[0104.617] WriteFile (in: hFile=0x41c, lpBuffer=0x259490c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259490c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.618] CloseHandle (hObject=0x41c) returned 1
	[0104.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.618] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ti", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ti", lpFilePart=0x0) returned 0x42
	[0104.618] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ti\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83625f0f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83625f0f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83ba94c3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0104.628] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83625f0f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83625f0f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83ba94c3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.628] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83ba94c3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83ba94c3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83ba94c3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.628] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83ba94c3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83ba94c3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83ba94c3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.628] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0104.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.628] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ti", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ti", lpFilePart=0x0) returned 0x42
	[0104.628] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ti\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83625f0f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83625f0f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83ba94c3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0104.629] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83625f0f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83625f0f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83ba94c3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.629] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83ba94c3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83ba94c3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83ba94c3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.629] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.629] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0104.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ti\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ti\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0104.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ti\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\ti\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.630] GetFileType (hFile=0x41c) returned 0x1
	[0104.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.630] GetFileType (hFile=0x41c) returned 0x1
	[0104.630] WriteFile (in: hFile=0x41c, lpBuffer=0x259899c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259899c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.631] CloseHandle (hObject=0x41c) returned 1
	[0104.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.631] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tk-tm", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tk-tm", lpFilePart=0x0) returned 0x45
	[0104.631] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tk-tm\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83ba94c3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83ba94c3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83faf448, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0104.631] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83ba94c3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83ba94c3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83faf448, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.631] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83faf448, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83faf448, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83faf448, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x23aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.631] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83faf448, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83faf448, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83faf448, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x23aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.631] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0104.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.632] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tk-tm", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tk-tm", lpFilePart=0x0) returned 0x45
	[0104.632] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tk-tm\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83ba94c3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83ba94c3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83faf448, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0104.632] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83ba94c3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83ba94c3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83faf448, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.632] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83faf448, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83faf448, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83faf448, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x23aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.632] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.632] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0104.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.632] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tk-tm\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tk-tm\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0104.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.632] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tk-tm\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\tk-tm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.633] GetFileType (hFile=0x41c) returned 0x1
	[0104.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.633] GetFileType (hFile=0x41c) returned 0x1
	[0104.633] WriteFile (in: hFile=0x41c, lpBuffer=0x259c640*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259c640*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.634] CloseHandle (hObject=0x41c) returned 1
	[0104.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tn-za", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tn-za", lpFilePart=0x0) returned 0x45
	[0104.634] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tn-za\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83faf448, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83faf448, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8431ca5f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0104.635] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83faf448, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83faf448, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8431ca5f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.635] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8431ca5f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8431ca5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8431ca5f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2aaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.635] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8431ca5f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8431ca5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8431ca5f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2aaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.635] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0104.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tn-za", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tn-za", lpFilePart=0x0) returned 0x45
	[0104.635] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tn-za\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83faf448, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83faf448, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8431ca5f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0104.635] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83faf448, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83faf448, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8431ca5f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.635] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8431ca5f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8431ca5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8431ca5f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2aaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.636] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.636] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0104.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.636] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tn-za\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tn-za\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0104.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.636] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tn-za\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\tn-za\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.636] GetFileType (hFile=0x41c) returned 0x1
	[0104.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.636] GetFileType (hFile=0x41c) returned 0x1
	[0104.636] WriteFile (in: hFile=0x41c, lpBuffer=0x25a02e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a02e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.637] CloseHandle (hObject=0x41c) returned 1
	[0104.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tr", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tr", lpFilePart=0x0) returned 0x42
	[0104.637] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tr\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8431ca5f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8431ca5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x848ec705, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b080
	[0104.638] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8431ca5f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8431ca5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x848ec705, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.638] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ec705, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x848ec705, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x848ec705, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.638] FindNextFileW (in: hFindFile=0x82b080, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ec705, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x848ec705, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x848ec705, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.638] FindClose (in: hFindFile=0x82b080 | out: hFindFile=0x82b080) returned 1
	[0104.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.638] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tr", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tr", lpFilePart=0x0) returned 0x42
	[0104.639] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tr\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8431ca5f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8431ca5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x848ec705, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0104.639] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8431ca5f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8431ca5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x848ec705, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.639] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ec705, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x848ec705, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x848ec705, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.639] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.639] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0104.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.639] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tr\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0104.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.639] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tr\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\tr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.658] GetFileType (hFile=0x41c) returned 0x1
	[0104.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.658] GetFileType (hFile=0x41c) returned 0x1
	[0104.658] WriteFile (in: hFile=0x41c, lpBuffer=0x25a45ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a45ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.659] CloseHandle (hObject=0x41c) returned 1
	[0104.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tt", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tt", lpFilePart=0x0) returned 0x42
	[0104.659] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tt\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x848ec705, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x848ec705, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84d187f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0104.668] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x848ec705, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x848ec705, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84d187f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.668] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d187f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x84d187f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84d3eae9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.668] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d187f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x84d187f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84d3eae9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.668] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0104.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.669] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tt", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tt", lpFilePart=0x0) returned 0x42
	[0104.669] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tt\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x848ec705, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x848ec705, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84d187f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0104.669] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x848ec705, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x848ec705, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84d187f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.669] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d187f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x84d187f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84d3eae9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.669] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.669] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0104.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.669] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tt\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0104.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.670] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tt\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\tt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.670] GetFileType (hFile=0x41c) returned 0x1
	[0104.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.670] GetFileType (hFile=0x41c) returned 0x1
	[0104.670] WriteFile (in: hFile=0x41c, lpBuffer=0x25a842c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a842c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.671] CloseHandle (hObject=0x41c) returned 1
	[0104.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ug-arab", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ug-arab", lpFilePart=0x0) returned 0x47
	[0104.671] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ug-arab\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d3eae9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x84d3eae9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85229a93, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0104.672] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d3eae9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x84d3eae9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85229a93, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.672] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85229a93, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85229a93, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8524fb26, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x240a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.672] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85229a93, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85229a93, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8524fb26, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x240a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.672] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0104.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.672] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ug-arab", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ug-arab", lpFilePart=0x0) returned 0x47
	[0104.673] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ug-arab\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d3eae9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x84d3eae9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85229a93, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0104.673] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d3eae9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x84d3eae9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85229a93, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.673] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85229a93, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85229a93, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8524fb26, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x240a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.673] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.673] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0104.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.673] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ug-arab\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ug-arab\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0104.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.673] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ug-arab\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\ug-arab\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.674] GetFileType (hFile=0x41c) returned 0x1
	[0104.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.674] GetFileType (hFile=0x41c) returned 0x1
	[0104.674] WriteFile (in: hFile=0x41c, lpBuffer=0x25ac140*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ac140*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.675] CloseHandle (hObject=0x41c) returned 1
	[0104.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.675] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uk", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uk", lpFilePart=0x0) returned 0x42
	[0104.675] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uk\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8524fb26, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8524fb26, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x856ee5cc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0104.676] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8524fb26, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8524fb26, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x856ee5cc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.676] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x856ee5cc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x856ee5cc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x857145dd, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.676] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x856ee5cc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x856ee5cc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x857145dd, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.676] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0104.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.676] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uk", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uk", lpFilePart=0x0) returned 0x42
	[0104.676] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uk\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8524fb26, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8524fb26, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x856ee5cc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0104.677] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8524fb26, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8524fb26, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x856ee5cc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.677] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x856ee5cc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x856ee5cc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x857145dd, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.677] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.677] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0104.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.677] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uk\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0104.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.677] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uk\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\uk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.678] GetFileType (hFile=0x41c) returned 0x1
	[0104.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.678] GetFileType (hFile=0x41c) returned 0x1
	[0104.678] WriteFile (in: hFile=0x41c, lpBuffer=0x25afd64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25afd64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.680] CloseHandle (hObject=0x41c) returned 1
	[0104.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.680] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ur", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ur", lpFilePart=0x0) returned 0x42
	[0104.680] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ur\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857145dd, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x857145dd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85cbe150, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0104.681] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857145dd, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x857145dd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85cbe150, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.681] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cbe150, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85cbe150, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85cbe150, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x268a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.681] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cbe150, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85cbe150, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85cbe150, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x268a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.681] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0104.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ur", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ur", lpFilePart=0x0) returned 0x42
	[0104.682] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ur\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857145dd, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x857145dd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85cbe150, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0104.682] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857145dd, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x857145dd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85cbe150, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.682] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cbe150, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85cbe150, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85cbe150, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x268a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.682] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.682] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0104.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ur\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ur\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0104.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.682] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ur\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\ur\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.683] GetFileType (hFile=0x41c) returned 0x1
	[0104.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.683] GetFileType (hFile=0x41c) returned 0x1
	[0104.683] WriteFile (in: hFile=0x41c, lpBuffer=0x25b3988*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b3988*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.684] CloseHandle (hObject=0x41c) returned 1
	[0104.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uz-latn-uz", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uz-latn-uz", lpFilePart=0x0) returned 0x4a
	[0104.684] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uz-latn-uz\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ce41fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85ce41fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86110334, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0104.685] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ce41fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85ce41fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86110334, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.685] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86110334, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86110334, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86110334, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x274a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.685] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86110334, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86110334, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86110334, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x274a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.685] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0104.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.686] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uz-latn-uz", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uz-latn-uz", lpFilePart=0x0) returned 0x4a
	[0104.686] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uz-latn-uz\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ce41fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85ce41fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86110334, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0104.686] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ce41fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85ce41fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86110334, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.686] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86110334, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86110334, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86110334, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x274a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.686] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.686] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0104.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.686] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uz-latn-uz\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uz-latn-uz\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0104.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.686] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uz-latn-uz\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\uz-latn-uz\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.687] GetFileType (hFile=0x41c) returned 0x1
	[0104.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.687] GetFileType (hFile=0x41c) returned 0x1
	[0104.687] WriteFile (in: hFile=0x41c, lpBuffer=0x25b776c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b776c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.688] CloseHandle (hObject=0x41c) returned 1
	[0104.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.688] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\vi", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\vi", lpFilePart=0x0) returned 0x42
	[0104.688] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\vi\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86110334, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86110334, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x864f0063, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0104.688] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86110334, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86110334, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x864f0063, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.689] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x864f0063, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x864f0063, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x864f0063, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.689] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x864f0063, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x864f0063, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x864f0063, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.689] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0104.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.689] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\vi", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\vi", lpFilePart=0x0) returned 0x42
	[0104.689] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\vi\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86110334, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86110334, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x864f0063, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0104.689] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86110334, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86110334, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x864f0063, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.690] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x864f0063, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x864f0063, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x864f0063, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.690] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.690] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0104.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\vi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\vi\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0104.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.690] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\vi\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\vi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.690] GetFileType (hFile=0x41c) returned 0x1
	[0104.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.690] GetFileType (hFile=0x41c) returned 0x1
	[0104.690] WriteFile (in: hFile=0x41c, lpBuffer=0x25bb390*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bb390*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.691] CloseHandle (hObject=0x41c) returned 1
	[0104.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\wo", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\wo", lpFilePart=0x0) returned 0x42
	[0104.691] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\wo\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x864f0063, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x864f0063, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x868a9b36, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0104.713] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x864f0063, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x864f0063, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x868a9b36, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.713] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868a9b36, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x868a9b36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x868a9b36, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x220a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.713] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868a9b36, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x868a9b36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x868a9b36, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x220a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.713] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0104.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.713] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\wo", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\wo", lpFilePart=0x0) returned 0x42
	[0104.713] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\wo\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x864f0063, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x864f0063, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x868a9b36, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0104.713] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x864f0063, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x864f0063, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x868a9b36, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.714] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868a9b36, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x868a9b36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x868a9b36, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x220a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.714] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.714] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0104.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.714] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\wo\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\wo\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0104.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.714] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\wo\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\wo\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.714] GetFileType (hFile=0x41c) returned 0x1
	[0104.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.714] GetFileType (hFile=0x41c) returned 0x1
	[0104.715] WriteFile (in: hFile=0x41c, lpBuffer=0x25bf3f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bf3f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.715] CloseHandle (hObject=0x41c) returned 1
	[0104.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\xh-za", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\xh-za", lpFilePart=0x0) returned 0x45
	[0104.716] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\xh-za\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868a9b36, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x868a9b36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86c1714d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0104.716] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868a9b36, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x868a9b36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86c1714d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.716] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c1714d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86c1714d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86c1714d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.716] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c1714d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86c1714d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86c1714d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.716] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0104.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\xh-za", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\xh-za", lpFilePart=0x0) returned 0x45
	[0104.716] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\xh-za\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868a9b36, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x868a9b36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86c1714d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0104.717] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868a9b36, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x868a9b36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86c1714d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.717] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c1714d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86c1714d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86c1714d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.717] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.717] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0104.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\xh-za\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\xh-za\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0104.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.717] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\xh-za\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\xh-za\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.718] GetFileType (hFile=0x41c) returned 0x1
	[0104.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.718] GetFileType (hFile=0x41c) returned 0x1
	[0104.718] WriteFile (in: hFile=0x41c, lpBuffer=0x25c3094*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c3094*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.719] CloseHandle (hObject=0x41c) returned 1
	[0104.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\yo-ng", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\yo-ng", lpFilePart=0x0) returned 0x45
	[0104.719] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\yo-ng\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86c1714d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86c1714d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x870696c1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0104.719] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86c1714d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86c1714d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x870696c1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.720] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870696c1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x870696c1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x870696c1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x246a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.720] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870696c1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x870696c1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x870696c1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x246a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.720] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0104.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.720] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\yo-ng", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\yo-ng", lpFilePart=0x0) returned 0x45
	[0104.720] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\yo-ng\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86c1714d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86c1714d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x870696c1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0104.720] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86c1714d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86c1714d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x870696c1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.720] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870696c1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x870696c1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x870696c1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x246a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.721] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.721] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0104.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\yo-ng\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\yo-ng\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0104.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\yo-ng\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\yo-ng\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.721] GetFileType (hFile=0x41c) returned 0x1
	[0104.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.721] GetFileType (hFile=0x41c) returned 0x1
	[0104.721] WriteFile (in: hFile=0x41c, lpBuffer=0x25c6d38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c6d38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.722] CloseHandle (hObject=0x41c) returned 1
	[0104.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.722] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-cn", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-cn", lpFilePart=0x0) returned 0x45
	[0104.723] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-cn\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x870696c1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x870696c1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87495786, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0104.723] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x870696c1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x870696c1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87495786, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.724] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87495786, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87495786, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87495786, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x126a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.724] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87495786, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87495786, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87495786, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x126a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.724] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0104.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-cn", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-cn", lpFilePart=0x0) returned 0x45
	[0104.724] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-cn\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x870696c1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x870696c1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87495786, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0104.725] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x870696c1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x870696c1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87495786, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.725] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87495786, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87495786, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87495786, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x126a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.725] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.725] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0104.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-cn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-cn\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0104.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.725] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-cn\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\zh-cn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.726] GetFileType (hFile=0x41c) returned 0x1
	[0104.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.726] GetFileType (hFile=0x41c) returned 0x1
	[0104.726] WriteFile (in: hFile=0x41c, lpBuffer=0x25ca9dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ca9dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.727] CloseHandle (hObject=0x41c) returned 1
	[0104.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.727] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-tw", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-tw", lpFilePart=0x0) returned 0x45
	[0104.727] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-tw\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87495786, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87495786, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0104.737] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87495786, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87495786, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.737] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x12ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.737] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x12ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.737] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0104.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.737] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-tw", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-tw", lpFilePart=0x0) returned 0x45
	[0104.737] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-tw\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87495786, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87495786, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0104.738] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87495786, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87495786, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.738] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x12ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.738] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.738] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0104.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.738] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-tw\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-tw\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0104.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.738] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-tw\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\zh-tw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.739] GetFileType (hFile=0x5dc) returned 0x1
	[0104.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.739] GetFileType (hFile=0x5dc) returned 0x1
	[0104.739] WriteFile (in: hFile=0x5dc, lpBuffer=0x25cebc8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cebc8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.740] CloseHandle (hObject=0x5dc) returned 1
	[0104.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.740] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zu-za", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zu-za", lpFilePart=0x0) returned 0x45
	[0104.740] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zu-za\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87b703a3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0104.741] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87b703a3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.741] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87b703a3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87b703a3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87b703a3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.742] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87b703a3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87b703a3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87b703a3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0
	[0104.742] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0104.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.742] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zu-za", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zu-za", lpFilePart=0x0) returned 0x45
	[0104.742] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zu-za\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87b703a3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0104.742] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87b703a3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.742] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87b703a3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87b703a3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87b703a3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0104.742] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.742] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0104.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.743] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zu-za\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zu-za\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0104.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zu-za\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\zu-za\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.744] GetFileType (hFile=0x5dc) returned 0x1
	[0104.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.744] GetFileType (hFile=0x5dc) returned 0x1
	[0104.744] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d28b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d28b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.745] CloseHandle (hObject=0x5dc) returned 1
	[0104.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.745] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Common", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Common", lpFilePart=0x0) returned 0x3c
	[0104.745] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Common\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xcd897090, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x55f90df8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55f90df8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0104.791] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xcd897090, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x55f90df8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55f90df8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.791] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x33bad36c, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x33bad36c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x400109da, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x3b1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2017-11-15.1116.1216.1.odl", cAlternateFileName="STANDA~3.ODL")) returned 1
	[0104.792] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x875afc47, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0x875afc47, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x9370aa75, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x3dab, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2017-9-26.1455.6924.1.odl", cAlternateFileName="STANDA~2.ODL")) returned 1
	[0104.792] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd8bd310, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcd8bd310, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd57401b7, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2017-9-7.839.2648.1.odl", cAlternateFileName="STANDA~1.ODL")) returned 1
	[0104.792] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xdcafea7a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xdcafea7a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeb5f32aa, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3b1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2018-1-13.755.2112.1.odl", cAlternateFileName="STANDA~4.ODL")) returned 1
	[0104.792] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x36831603, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x36831603, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55f90df8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3b1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2018-2-6.1514.3984.1.odl", cAlternateFileName="ST97AD~1.ODL")) returned 1
	[0104.792] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x8766e737, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0x8766e737, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x892e2653, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="standaloneUpdaterTelemetryCache.otc.session", cAlternateFileName="STANDA~1.SES")) returned 1
	[0104.792] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x8766e737, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0x8766e737, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x892e2653, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="standaloneUpdaterTelemetryCache.otc.session", cAlternateFileName="STANDA~1.SES")) returned 0
	[0104.792] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0104.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Common", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Common", lpFilePart=0x0) returned 0x3c
	[0104.793] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Common\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xcd897090, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x55f90df8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55f90df8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0104.794] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xcd897090, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x55f90df8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55f90df8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.794] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x33bad36c, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x33bad36c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x400109da, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x3b1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2017-11-15.1116.1216.1.odl", cAlternateFileName="STANDA~3.ODL")) returned 1
	[0104.794] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x875afc47, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0x875afc47, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x9370aa75, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x3dab, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2017-9-26.1455.6924.1.odl", cAlternateFileName="STANDA~2.ODL")) returned 1
	[0104.794] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd8bd310, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcd8bd310, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd57401b7, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2017-9-7.839.2648.1.odl", cAlternateFileName="STANDA~1.ODL")) returned 1
	[0104.794] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xdcafea7a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xdcafea7a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeb5f32aa, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3b1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2018-1-13.755.2112.1.odl", cAlternateFileName="STANDA~4.ODL")) returned 1
	[0104.795] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x36831603, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x36831603, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55f90df8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3b1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2018-2-6.1514.3984.1.odl", cAlternateFileName="ST97AD~1.ODL")) returned 1
	[0104.795] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x8766e737, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0x8766e737, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x892e2653, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="standaloneUpdaterTelemetryCache.otc.session", cAlternateFileName="STANDA~1.SES")) returned 1
	[0104.795] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.795] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0104.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Common\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Common\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0104.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.796] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Common\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\logs\\common\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.797] GetFileType (hFile=0x5dc) returned 0x1
	[0104.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.797] GetFileType (hFile=0x5dc) returned 0x1
	[0104.797] WriteFile (in: hFile=0x5dc, lpBuffer=0x25fe5ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fe5ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.798] CloseHandle (hObject=0x5dc) returned 1
	[0104.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.798] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Personal", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Personal", lpFilePart=0x0) returned 0x3e
	[0104.798] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Personal\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc27c59d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0104.813] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc27c59d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.813] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xb265ad7, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xb265ad7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x18fa7527, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2814e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine-2017-9-26.1459.6740.1.aodl", cAlternateFileName="SYNCEN~1.AOD")) returned 1
	[0104.813] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xe7108ba8, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xe7108ba8, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x55097bbd, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0xd19e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine-2017-9-6.1925.840.1.odl", cAlternateFileName="SYNCEN~1.ODL")) returned 1
	[0104.813] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x4516422, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x4516422, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x95a923b0, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x19dc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine-2017-9-7.840.3616.1.odl", cAlternateFileName="SYNCEN~2.ODL")) returned 1
	[0104.813] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x4516422, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x4516422, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xbd1f712, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetryCache.otc.session", cAlternateFileName="TELEME~1.SES")) returned 1
	[0104.813] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x438e2ed3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x439090e4, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceArchive.5892.0626-1.etl", cAlternateFileName="TRACEA~2.ETL")) returned 1
	[0104.813] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xe7e981ee, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xe7e981ee, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x551a2c7c, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceArchive.6816.0313-2.etl", cAlternateFileName="TRACEA~3.ETL")) returned 1
	[0104.814] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0x5a3f29b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x5a3f29b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x95a923b0, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceArchive.6943.0625-3.etl", cAlternateFileName="TRACEA~4.ETL")) returned 1
	[0104.814] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xc27c59d, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x18fcd764, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceCurrent.6998.0830.etl", cAlternateFileName="TRACEC~1.ETL")) returned 1
	[0104.814] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xc27c59d, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x18fcd764, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceCurrent.6998.0830.etl", cAlternateFileName="TRACEC~1.ETL")) returned 0
	[0104.814] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0104.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Personal", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Personal", lpFilePart=0x0) returned 0x3e
	[0104.815] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Personal\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc27c59d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0104.816] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc27c59d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.816] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xb265ad7, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xb265ad7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x18fa7527, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2814e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine-2017-9-26.1459.6740.1.aodl", cAlternateFileName="SYNCEN~1.AOD")) returned 1
	[0104.816] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xe7108ba8, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xe7108ba8, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x55097bbd, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0xd19e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine-2017-9-6.1925.840.1.odl", cAlternateFileName="SYNCEN~1.ODL")) returned 1
	[0104.816] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x4516422, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x4516422, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x95a923b0, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x19dc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine-2017-9-7.840.3616.1.odl", cAlternateFileName="SYNCEN~2.ODL")) returned 1
	[0104.816] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x4516422, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x4516422, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xbd1f712, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetryCache.otc.session", cAlternateFileName="TELEME~1.SES")) returned 1
	[0104.816] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x438e2ed3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x439090e4, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceArchive.5892.0626-1.etl", cAlternateFileName="TRACEA~2.ETL")) returned 1
	[0104.816] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xe7e981ee, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xe7e981ee, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x551a2c7c, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceArchive.6816.0313-2.etl", cAlternateFileName="TRACEA~3.ETL")) returned 1
	[0104.817] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0x5a3f29b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x5a3f29b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x95a923b0, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceArchive.6943.0625-3.etl", cAlternateFileName="TRACEA~4.ETL")) returned 1
	[0104.817] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xc27c59d, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x18fcd764, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceCurrent.6998.0830.etl", cAlternateFileName="TRACEC~1.ETL")) returned 1
	[0104.817] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.817] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0104.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.818] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Personal\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Personal\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0104.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.818] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Personal\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\logs\\personal\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.819] GetFileType (hFile=0x5dc) returned 0x1
	[0104.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.819] GetFileType (hFile=0x5dc) returned 0x1
	[0104.820] WriteFile (in: hFile=0x5dc, lpBuffer=0x2604114*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2604114*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.820] CloseHandle (hObject=0x5dc) returned 1
	[0104.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\settings\\Personal", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\settings\\Personal", lpFilePart=0x0) returned 0x42
	[0104.821] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\settings\\Personal\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b68cdf, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x18ec2a2b, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x18ec2a2b, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0104.888] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b68cdf, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x18ec2a2b, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x18ec2a2b, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.888] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b705ce, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x5b705ce, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x1d7a9502, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1098, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationSettings.xml", cAlternateFileName="APPLIC~1.XML")) returned 1
	[0104.888] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54c457c7, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x18dddb2e, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x18e2a037, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xabc, dwReserved0=0x0, dwReserved1=0x0, cFileName="global.ini", cAlternateFileName="")) returned 1
	[0104.888] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54c457c7, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x18dddb2e, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x18e2a037, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xabc, dwReserved0=0x0, dwReserved1=0x0, cFileName="global.ini", cAlternateFileName="")) returned 0
	[0104.888] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0104.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\settings\\Personal", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\settings\\Personal", lpFilePart=0x0) returned 0x42
	[0104.889] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\settings\\Personal\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b68cdf, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x18ec2a2b, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x18ec2a2b, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b200
	[0104.890] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b68cdf, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x18ec2a2b, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x18ec2a2b, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.890] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b705ce, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x5b705ce, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x1d7a9502, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1098, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationSettings.xml", cAlternateFileName="APPLIC~1.XML")) returned 1
	[0104.890] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54c457c7, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x18dddb2e, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x18e2a037, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xabc, dwReserved0=0x0, dwReserved1=0x0, cFileName="global.ini", cAlternateFileName="")) returned 1
	[0104.890] FindNextFileW (in: hFindFile=0x82b200, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.890] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0104.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.891] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\settings\\Personal\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\settings\\Personal\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0104.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.891] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\settings\\Personal\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\settings\\personal\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.893] GetFileType (hFile=0x5dc) returned 0x1
	[0104.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.893] GetFileType (hFile=0x5dc) returned 0x1
	[0104.893] WriteFile (in: hFile=0x5dc, lpBuffer=0x26081f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26081f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.897] CloseHandle (hObject=0x5dc) returned 1
	[0104.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs", lpFilePart=0x0) returned 0x3b
	[0104.897] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x87cc5d55, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x87cc5d55, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0104.914] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x87cc5d55, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x87cc5d55, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.915] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442db8d6, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x442db8d6, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x45234c56, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x2a22, dwReserved0=0x0, dwReserved1=0x0, cFileName="2018-11-14_170112_f7c-948.log", cAlternateFileName="2018-1~1.LOG")) returned 1
	[0104.915] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447c66f9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x447c66f9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x44ea11e3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x2134, dwReserved0=0x0, dwReserved1=0x0, cFileName="2018-11-14_170113_f4c-be0.log", cAlternateFileName="2018-1~2.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x878bfcc2, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0x878bfcc2, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x887f2f47, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x0, dwReserved1=0x0, cFileName="2018-11-14_171724_d80-678.log", cAlternateFileName="2018-1~3.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87cc5d55, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0x87cc5d55, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x883ece3d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x1ea4, dwReserved0=0x0, dwReserved1=0x0, cFileName="2018-11-14_171725_f28-d4c.log", cAlternateFileName="2018-1~4.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40cbb1b0, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x40cbb1b0, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4e3c1809, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x5c0f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install-PerUser_2017-11-15_121658_11bc-11c0.log", cAlternateFileName="INSTAL~4.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea96ea5b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xea96ea5b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x218241ad, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x888e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install-PerUser_2018-01-13_085545_f54-e1c.log", cAlternateFileName="IN2D73~1.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ff509c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x56ff509c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x97259f33, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9a502, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install-PerUser_2018-02-06_161536_320-1b4.log", cAlternateFileName="IN1304~1.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90785512, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0x90785512, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x13d8f038, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1d3d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install_2017-09-26_165559_91c-123c.log", cAlternateFileName="INSTAL~1.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0d3f61, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x3d0d3f61, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x46e2f5ec, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1d1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install_2017-11-15_121652_111c-1114.log", cAlternateFileName="INSTAL~3.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8758a32, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe8758a32, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xef703bf8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1e0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install_2018-01-13_085541_f60-f7c.log", cAlternateFileName="IN0470~1.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53290922, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x53290922, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x97364e22, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f85a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install_2018-02-06_161529_da8-b1c.log", cAlternateFileName="INA0B8~1.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5383f076, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55ded6e0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="parentTelemetryCache.otc.session", cAlternateFileName="PARENT~1.SES")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3514559e, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x3514559e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x430a4940, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdate_2017-11-15_121639_4c0-7b4.log", cAlternateFileName="STANDA~3.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd88e0aa, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xdd88e0aa, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed3e786a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdate_2018-01-13_085523_840-928.log", cAlternateFileName="STANDA~4.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b328bd6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x4b328bd6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5870dfe3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdate_2018-02-06_161516_f90-3a4.log", cAlternateFileName="STFD35~1.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a9a8f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xe2a9a8f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x15c2addb, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x3fca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update_2017-09-26_165930_1a54-1854.log", cAlternateFileName="UPDATE~3.LOG")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7913822, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5733c46c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x58e350ca, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="userTelemetryCache.otc.session", cAlternateFileName="USERTE~1.SES")) returned 1
	[0104.916] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7913822, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5733c46c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x58e350ca, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="userTelemetryCache.otc.session", cAlternateFileName="USERTE~1.SES")) returned 0
	[0104.916] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0104.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs", lpFilePart=0x0) returned 0x3b
	[0104.918] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x87cc5d55, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x87cc5d55, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0104.919] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x87cc5d55, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x87cc5d55, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.919] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442db8d6, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x442db8d6, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x45234c56, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x2a22, dwReserved0=0x0, dwReserved1=0x0, cFileName="2018-11-14_170112_f7c-948.log", cAlternateFileName="2018-1~1.LOG")) returned 1
	[0104.919] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447c66f9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x447c66f9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x44ea11e3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x2134, dwReserved0=0x0, dwReserved1=0x0, cFileName="2018-11-14_170113_f4c-be0.log", cAlternateFileName="2018-1~2.LOG")) returned 1
	[0104.919] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x878bfcc2, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0x878bfcc2, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x887f2f47, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x0, dwReserved1=0x0, cFileName="2018-11-14_171724_d80-678.log", cAlternateFileName="2018-1~3.LOG")) returned 1
	[0104.919] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87cc5d55, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0x87cc5d55, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x883ece3d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x1ea4, dwReserved0=0x0, dwReserved1=0x0, cFileName="2018-11-14_171725_f28-d4c.log", cAlternateFileName="2018-1~4.LOG")) returned 1
	[0104.919] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40cbb1b0, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x40cbb1b0, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4e3c1809, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x5c0f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install-PerUser_2017-11-15_121658_11bc-11c0.log", cAlternateFileName="INSTAL~4.LOG")) returned 1
	[0104.919] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea96ea5b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xea96ea5b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x218241ad, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x888e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install-PerUser_2018-01-13_085545_f54-e1c.log", cAlternateFileName="IN2D73~1.LOG")) returned 1
	[0104.919] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ff509c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x56ff509c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x97259f33, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9a502, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install-PerUser_2018-02-06_161536_320-1b4.log", cAlternateFileName="IN1304~1.LOG")) returned 1
	[0104.919] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90785512, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0x90785512, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x13d8f038, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1d3d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install_2017-09-26_165559_91c-123c.log", cAlternateFileName="INSTAL~1.LOG")) returned 1
	[0104.919] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0d3f61, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x3d0d3f61, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x46e2f5ec, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1d1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install_2017-11-15_121652_111c-1114.log", cAlternateFileName="INSTAL~3.LOG")) returned 1
	[0104.919] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8758a32, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe8758a32, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xef703bf8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1e0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install_2018-01-13_085541_f60-f7c.log", cAlternateFileName="IN0470~1.LOG")) returned 1
	[0104.920] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53290922, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x53290922, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x97364e22, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f85a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install_2018-02-06_161529_da8-b1c.log", cAlternateFileName="INA0B8~1.LOG")) returned 1
	[0104.920] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5383f076, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55ded6e0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="parentTelemetryCache.otc.session", cAlternateFileName="PARENT~1.SES")) returned 1
	[0104.920] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3514559e, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x3514559e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x430a4940, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdate_2017-11-15_121639_4c0-7b4.log", cAlternateFileName="STANDA~3.LOG")) returned 1
	[0104.920] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd88e0aa, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xdd88e0aa, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed3e786a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdate_2018-01-13_085523_840-928.log", cAlternateFileName="STANDA~4.LOG")) returned 1
	[0104.920] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b328bd6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x4b328bd6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5870dfe3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdate_2018-02-06_161516_f90-3a4.log", cAlternateFileName="STFD35~1.LOG")) returned 1
	[0104.920] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a9a8f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xe2a9a8f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x15c2addb, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x3fca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update_2017-09-26_165930_1a54-1854.log", cAlternateFileName="UPDATE~3.LOG")) returned 1
	[0104.920] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7913822, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5733c46c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x58e350ca, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="userTelemetryCache.otc.session", cAlternateFileName="USERTE~1.SES")) returned 1
	[0104.920] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.920] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0104.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0104.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.921] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.922] GetFileType (hFile=0x5dc) returned 0x1
	[0104.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.922] GetFileType (hFile=0x5dc) returned 0x1
	[0104.923] WriteFile (in: hFile=0x5dc, lpBuffer=0x26108ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26108ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.924] CloseHandle (hObject=0x5dc) returned 1
	[0104.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\Desktop", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\Desktop", lpFilePart=0x0) returned 0x4b
	[0104.924] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\Desktop\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0104.924] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.924] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.924] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0104.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.942] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\Desktop", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\Desktop", lpFilePart=0x0) returned 0x4b
	[0104.942] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\Desktop\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0104.942] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.942] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.943] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0104.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\Desktop\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\Desktop\\Decrypt.txt", lpFilePart=0x0) returned 0x57
	[0104.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\Desktop\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\playready\\internet explorer\\desktop\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.944] GetFileType (hFile=0x5dc) returned 0x1
	[0104.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.944] GetFileType (hFile=0x5dc) returned 0x1
	[0104.944] WriteFile (in: hFile=0x5dc, lpBuffer=0x2614568*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2614568*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.946] CloseHandle (hObject=0x5dc) returned 1
	[0104.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.946] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\InPrivate", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\InPrivate", lpFilePart=0x0) returned 0x4d
	[0104.946] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\InPrivate\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0104.947] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.947] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0104.947] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.947] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0104.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\InPrivate", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\InPrivate", lpFilePart=0x0) returned 0x4d
	[0104.947] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\InPrivate\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0104.947] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.947] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0104.947] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0
	[0104.947] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0104.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.948] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\InPrivate\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\InPrivate\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0104.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.948] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\InPrivate\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\playready\\internet explorer\\inprivate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.948] GetFileType (hFile=0x5dc) returned 0x1
	[0104.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.948] GetFileType (hFile=0x5dc) returned 0x1
	[0104.948] WriteFile (in: hFile=0x5dc, lpBuffer=0x26181cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26181cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.950] CloseHandle (hObject=0x5dc) returned 1
	[0104.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.950] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", lpFilePart=0x0) returned 0x47
	[0104.950] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3d5d939a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0104.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3d5d939a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3462ae18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb817acca, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache2", cAlternateFileName="")) returned 1
	[0104.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x301f956, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x301f956, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3025b1b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x942, dwReserved0=0x0, dwReserved1=0x0, cFileName="directoryLinks.json", cAlternateFileName="DIRECT~1.JSO")) returned 1
	[0104.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f5360c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jumpListCache", cAlternateFileName="JUMPLI~1")) returned 1
	[0104.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcae9ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfcae9ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfcae9ac, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfflineCache", cAlternateFileName="OFFLIN~1")) returned 1
	[0104.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c5a8f2d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3d1ad183, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3d1ad183, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="safebrowsing", cAlternateFileName="SAFEBR~1")) returned 1
	[0104.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4016fa00, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb9f6f531, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xb9f6f531, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="startupCache", cAlternateFileName="STARTU~1")) returned 1
	[0104.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe53ad66, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe53ad66, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe53ad66, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbnails", cAlternateFileName="THUMBN~1")) returned 1
	[0104.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcae9ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfcae9ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x481f73e1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 1
	[0104.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcae9ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfcae9ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x481f73e1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 0
	[0104.960] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0104.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.961] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", lpFilePart=0x0) returned 0x47
	[0104.961] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3d5d939a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0104.962] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3d5d939a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.962] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3462ae18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb817acca, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache2", cAlternateFileName="")) returned 1
	[0104.962] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x301f956, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x301f956, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3025b1b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x942, dwReserved0=0x0, dwReserved1=0x0, cFileName="directoryLinks.json", cAlternateFileName="DIRECT~1.JSO")) returned 1
	[0104.962] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f5360c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jumpListCache", cAlternateFileName="JUMPLI~1")) returned 1
	[0104.962] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcae9ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfcae9ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfcae9ac, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfflineCache", cAlternateFileName="OFFLIN~1")) returned 1
	[0104.962] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c5a8f2d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3d1ad183, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3d1ad183, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="safebrowsing", cAlternateFileName="SAFEBR~1")) returned 1
	[0104.962] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4016fa00, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb9f6f531, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xb9f6f531, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="startupCache", cAlternateFileName="STARTU~1")) returned 1
	[0104.962] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe53ad66, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe53ad66, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe53ad66, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbnails", cAlternateFileName="THUMBN~1")) returned 1
	[0104.962] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcae9ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfcae9ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x481f73e1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 1
	[0104.962] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.962] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0104.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.963] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0104.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.963] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.964] GetFileType (hFile=0x5dc) returned 0x1
	[0104.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.964] GetFileType (hFile=0x5dc) returned 0x1
	[0104.964] WriteFile (in: hFile=0x5dc, lpBuffer=0x261dac0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261dac0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.965] CloseHandle (hObject=0x5dc) returned 1
	[0104.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.966] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCache", lpFilePart=0x0) returned 0x66
	[0104.966] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0104.966] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.967] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.967] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0104.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.967] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCache", lpFilePart=0x0) returned 0x66
	[0104.967] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0104.967] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.967] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.967] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0104.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.967] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCache\\Decrypt.txt", lpFilePart=0x0) returned 0x72
	[0104.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.967] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCache\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\ac\\inetcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.968] GetFileType (hFile=0x5dc) returned 0x1
	[0104.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.968] GetFileType (hFile=0x5dc) returned 0x1
	[0104.968] WriteFile (in: hFile=0x5dc, lpBuffer=0x2621864*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2621864*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.969] CloseHandle (hObject=0x5dc) returned 1
	[0104.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.969] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCookies", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCookies", lpFilePart=0x0) returned 0x68
	[0104.969] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0104.969] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.969] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.969] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0104.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.969] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCookies", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCookies", lpFilePart=0x0) returned 0x68
	[0104.969] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0104.970] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.970] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.970] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0104.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.970] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCookies\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCookies\\Decrypt.txt", lpFilePart=0x0) returned 0x74
	[0104.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.970] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCookies\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\ac\\inetcookies\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.970] GetFileType (hFile=0x5dc) returned 0x1
	[0104.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.970] GetFileType (hFile=0x5dc) returned 0x1
	[0104.970] WriteFile (in: hFile=0x5dc, lpBuffer=0x2625668*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2625668*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.972] CloseHandle (hObject=0x5dc) returned 1
	[0104.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.972] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetHistory", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetHistory", lpFilePart=0x0) returned 0x68
	[0104.972] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0104.972] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.972] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.972] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0104.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.972] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetHistory", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetHistory", lpFilePart=0x0) returned 0x68
	[0104.972] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0104.973] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.973] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.973] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0104.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.973] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetHistory\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetHistory\\Decrypt.txt", lpFilePart=0x0) returned 0x74
	[0104.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.973] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetHistory\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\ac\\inethistory\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.973] GetFileType (hFile=0x5dc) returned 0x1
	[0104.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.973] GetFileType (hFile=0x5dc) returned 0x1
	[0104.973] WriteFile (in: hFile=0x5dc, lpBuffer=0x262946c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262946c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.974] CloseHandle (hObject=0x5dc) returned 1
	[0104.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.974] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\Temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\Temp", lpFilePart=0x0) returned 0x61
	[0104.974] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0104.974] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.974] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.975] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0104.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\Temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\Temp", lpFilePart=0x0) returned 0x61
	[0104.975] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0104.975] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.975] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.975] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0104.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x6d
	[0104.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.975] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\Temp\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\ac\\temp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0104.976] GetFileType (hFile=0x5dc) returned 0x1
	[0104.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.976] GetFileType (hFile=0x5dc) returned 0x1
	[0104.976] WriteFile (in: hFile=0x5dc, lpBuffer=0x262d100*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262d100*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.977] CloseHandle (hObject=0x5dc) returned 1
	[0104.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCache", lpFilePart=0x0) returned 0x52
	[0104.977] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0104.992] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.992] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.992] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0104.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCache", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCache", lpFilePart=0x0) returned 0x52
	[0104.992] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCache\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0104.992] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.992] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.992] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0104.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0104.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0104.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCache\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0104.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0104.993] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCache\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\ac\\inetcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.993] GetFileType (hFile=0x41c) returned 0x1
	[0104.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0104.993] GetFileType (hFile=0x41c) returned 0x1
	[0104.994] WriteFile (in: hFile=0x41c, lpBuffer=0x2638480*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2638480*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.994] CloseHandle (hObject=0x41c) returned 1
	[0104.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0104.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCookies", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCookies", lpFilePart=0x0) returned 0x54
	[0104.995] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCookies\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0104.995] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.995] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.995] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0104.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCookies", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCookies", lpFilePart=0x0) returned 0x54
	[0104.995] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCookies\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0104.995] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.995] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.995] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0104.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCookies\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCookies\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0104.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCookies\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\ac\\inetcookies\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.996] GetFileType (hFile=0x41c) returned 0x1
	[0104.996] GetFileType (hFile=0x41c) returned 0x1
	[0104.996] WriteFile (in: hFile=0x41c, lpBuffer=0x263bec4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263bec4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0104.997] CloseHandle (hObject=0x41c) returned 1
	[0104.997] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetHistory", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetHistory", lpFilePart=0x0) returned 0x54
	[0104.997] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetHistory\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0104.998] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.998] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.998] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0104.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetHistory", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetHistory", lpFilePart=0x0) returned 0x54
	[0104.998] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetHistory\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0104.998] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.998] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0104.998] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0104.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetHistory\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetHistory\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0104.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetHistory\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\ac\\inethistory\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x41c
	[0104.999] GetFileType (hFile=0x41c) returned 0x1
	[0104.999] GetFileType (hFile=0x41c) returned 0x1
	[0104.999] WriteFile (in: hFile=0x41c, lpBuffer=0x263f908*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263f908*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.000] CloseHandle (hObject=0x41c) returned 1
	[0105.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\Temp", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\Temp", lpFilePart=0x0) returned 0x4d
	[0105.000] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\Temp\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f98a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0105.000] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f98a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.009] WriteFile (in: hFile=0x41c, lpBuffer=0x26431dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26431dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.011] WriteFile (in: hFile=0x41c, lpBuffer=0x2646a40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2646a40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.024] WriteFile (in: hFile=0x41c, lpBuffer=0x26523fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26523fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.026] WriteFile (in: hFile=0x41c, lpBuffer=0x2656200*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2656200*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.028] WriteFile (in: hFile=0x41c, lpBuffer=0x265a004*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265a004*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.029] WriteFile (in: hFile=0x41c, lpBuffer=0x265dc98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265dc98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.030] WriteFile (in: hFile=0x41c, lpBuffer=0x26616dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26616dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.032] WriteFile (in: hFile=0x41c, lpBuffer=0x2665180*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2665180*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.033] WriteFile (in: hFile=0x41c, lpBuffer=0x2668c24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2668c24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.035] WriteFile (in: hFile=0x41c, lpBuffer=0x266c558*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266c558*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.036] WriteFile (in: hFile=0x41c, lpBuffer=0x266feec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266feec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.037] WriteFile (in: hFile=0x41c, lpBuffer=0x26738e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26738e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.039] WriteFile (in: hFile=0x41c, lpBuffer=0x26772d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26772d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.040] WriteFile (in: hFile=0x41c, lpBuffer=0x267ab98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267ab98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.042] WriteFile (in: hFile=0x41c, lpBuffer=0x267e46c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267e46c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.080] WriteFile (in: hFile=0x41c, lpBuffer=0x2681da0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2681da0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.091] WriteFile (in: hFile=0x41c, lpBuffer=0x268fdf0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268fdf0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.092] WriteFile (in: hFile=0x41c, lpBuffer=0x26935f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26935f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.094] WriteFile (in: hFile=0x41c, lpBuffer=0x2697398*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2697398*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.096] WriteFile (in: hFile=0x41c, lpBuffer=0x269b19c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269b19c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.097] WriteFile (in: hFile=0x41c, lpBuffer=0x269efa0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269efa0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.099] WriteFile (in: hFile=0x41c, lpBuffer=0x26a2c34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a2c34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.100] WriteFile (in: hFile=0x41c, lpBuffer=0x26a65c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a65c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.105] WriteFile (in: hFile=0x41c, lpBuffer=0x26a9fbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a9fbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.107] WriteFile (in: hFile=0x41c, lpBuffer=0x26ad9b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ad9b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.117] WriteFile (in: hFile=0x41c, lpBuffer=0x26bb968*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bb968*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.118] WriteFile (in: hFile=0x41c, lpBuffer=0x26bf22c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bf22c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.120] WriteFile (in: hFile=0x41c, lpBuffer=0x26c2b50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c2b50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.121] WriteFile (in: hFile=0x41c, lpBuffer=0x26c6474*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c6474*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.123] WriteFile (in: hFile=0x41c, lpBuffer=0x26c9c28*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c9c28*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.126] WriteFile (in: hFile=0x41c, lpBuffer=0x26cd61c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cd61c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.127] WriteFile (in: hFile=0x41c, lpBuffer=0x26d1070*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d1070*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.128] WriteFile (in: hFile=0x41c, lpBuffer=0x26d4ac4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d4ac4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.130] WriteFile (in: hFile=0x41c, lpBuffer=0x26d83e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d83e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.131] WriteFile (in: hFile=0x41c, lpBuffer=0x26dbe3c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26dbe3c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.132] WriteFile (in: hFile=0x41c, lpBuffer=0x26df8f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26df8f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.143] WriteFile (in: hFile=0x41c, lpBuffer=0x26e70d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e70d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.145] WriteFile (in: hFile=0x41c, lpBuffer=0x26eaa58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26eaa58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.147] WriteFile (in: hFile=0x41c, lpBuffer=0x26ee61c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ee61c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.149] WriteFile (in: hFile=0x41c, lpBuffer=0x26f2240*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f2240*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.163] WriteFile (in: hFile=0x41c, lpBuffer=0x27033ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27033ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.164] WriteFile (in: hFile=0x41c, lpBuffer=0x2706e60*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2706e60*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.165] WriteFile (in: hFile=0x41c, lpBuffer=0x270a9d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270a9d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.168] WriteFile (in: hFile=0x41c, lpBuffer=0x270e5a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270e5a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.170] WriteFile (in: hFile=0x41c, lpBuffer=0x271217c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271217c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.171] WriteFile (in: hFile=0x41c, lpBuffer=0x2715c20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2715c20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.172] WriteFile (in: hFile=0x41c, lpBuffer=0x27197e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27197e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.182] WriteFile (in: hFile=0x41c, lpBuffer=0x2727244*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2727244*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.184] WriteFile (in: hFile=0x41c, lpBuffer=0x272ae68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272ae68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.185] WriteFile (in: hFile=0x41c, lpBuffer=0x272e91c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272e91c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.204] WriteFile (in: hFile=0x5dc, lpBuffer=0x27329a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27329a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.232] WriteFile (in: hFile=0x41c, lpBuffer=0x2736678*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2736678*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.234] WriteFile (in: hFile=0x41c, lpBuffer=0x273a1dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273a1dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.236] WriteFile (in: hFile=0x41c, lpBuffer=0x273dbd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273dbd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.244] WriteFile (in: hFile=0x41c, lpBuffer=0x2741684*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2741684*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.245] WriteFile (in: hFile=0x41c, lpBuffer=0x2745198*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2745198*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.247] WriteFile (in: hFile=0x41c, lpBuffer=0x2748cac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2748cac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.249] WriteFile (in: hFile=0x41c, lpBuffer=0x274c690*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274c690*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.251] WriteFile (in: hFile=0x41c, lpBuffer=0x27500d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27500d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.252] WriteFile (in: hFile=0x41c, lpBuffer=0x2753b78*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2753b78*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.254] WriteFile (in: hFile=0x41c, lpBuffer=0x275761c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275761c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.256] WriteFile (in: hFile=0x41c, lpBuffer=0x275af50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275af50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.258] WriteFile (in: hFile=0x41c, lpBuffer=0x275e9f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275e9f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.260] WriteFile (in: hFile=0x41c, lpBuffer=0x27624f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27624f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.262] WriteFile (in: hFile=0x41c, lpBuffer=0x2765ffc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2765ffc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.263] WriteFile (in: hFile=0x41c, lpBuffer=0x2769990*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2769990*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.265] WriteFile (in: hFile=0x41c, lpBuffer=0x276d444*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276d444*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.266] WriteFile (in: hFile=0x41c, lpBuffer=0x2770f58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2770f58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.334] WriteFile (in: hFile=0x41c, lpBuffer=0x2774a6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2774a6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.336] WriteFile (in: hFile=0x41c, lpBuffer=0x2778450*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2778450*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.337] WriteFile (in: hFile=0x41c, lpBuffer=0x277bf64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277bf64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.338] WriteFile (in: hFile=0x41c, lpBuffer=0x277fad8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277fad8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.340] WriteFile (in: hFile=0x41c, lpBuffer=0x278364c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278364c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.341] WriteFile (in: hFile=0x41c, lpBuffer=0x2787090*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2787090*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.359] WriteFile (in: hFile=0x41c, lpBuffer=0x278ab34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278ab34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.360] WriteFile (in: hFile=0x41c, lpBuffer=0x278e638*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278e638*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.362] WriteFile (in: hFile=0x41c, lpBuffer=0x279213c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279213c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.382] WriteFile (in: hFile=0x41c, lpBuffer=0x2795ad0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2795ad0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.466] WriteFile (in: hFile=0x41c, lpBuffer=0x27996a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27996a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.468] WriteFile (in: hFile=0x41c, lpBuffer=0x279d2d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279d2d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.469] WriteFile (in: hFile=0x41c, lpBuffer=0x27a0f0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a0f0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.471] WriteFile (in: hFile=0x41c, lpBuffer=0x27a4a10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a4a10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.473] WriteFile (in: hFile=0x41c, lpBuffer=0x27a8574*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a8574*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.474] WriteFile (in: hFile=0x41c, lpBuffer=0x27ac138*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ac138*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.475] WriteFile (in: hFile=0x41c, lpBuffer=0x27afcfc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27afcfc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.495] WriteFile (in: hFile=0x41c, lpBuffer=0x27b3750*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b3750*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.497] WriteFile (in: hFile=0x41c, lpBuffer=0x27b7384*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b7384*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.498] WriteFile (in: hFile=0x41c, lpBuffer=0x27bb018*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27bb018*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.546] WriteFile (in: hFile=0x5dc, lpBuffer=0x27bee04*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27bee04*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.547] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c2968*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c2968*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.559] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c640c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c640c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.560] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c9f10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c9f10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.561] WriteFile (in: hFile=0x5dc, lpBuffer=0x27cda14*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27cda14*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.563] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d13a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d13a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.565] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d4d9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d4d9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.566] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d87f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d87f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.567] WriteFile (in: hFile=0x5dc, lpBuffer=0x27dc244*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27dc244*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.569] WriteFile (in: hFile=0x5dc, lpBuffer=0x27dfb68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27dfb68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.575] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e3a58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e3a58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.578] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e79b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e79b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.579] WriteFile (in: hFile=0x5dc, lpBuffer=0x27eb46c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27eb46c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.582] WriteFile (in: hFile=0x5dc, lpBuffer=0x27ef37c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ef37c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.584] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f2d00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f2d00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.608] WriteFile (in: hFile=0x41c, lpBuffer=0x27f73dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f73dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.616] WriteFile (in: hFile=0x41c, lpBuffer=0x27fb4a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27fb4a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.619] WriteFile (in: hFile=0x41c, lpBuffer=0x27ff07c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ff07c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.620] WriteFile (in: hFile=0x41c, lpBuffer=0x2802cb0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2802cb0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.621] WriteFile (in: hFile=0x41c, lpBuffer=0x28068e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28068e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.622] WriteFile (in: hFile=0x41c, lpBuffer=0x280a3e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280a3e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.624] WriteFile (in: hFile=0x41c, lpBuffer=0x280ff64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280ff64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.625] WriteFile (in: hFile=0x41c, lpBuffer=0x2815ae0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2815ae0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.644] WriteFile (in: hFile=0x41c, lpBuffer=0x281adfc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x281adfc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.648] WriteFile (in: hFile=0x41c, lpBuffer=0x2820560*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2820560*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.652] WriteFile (in: hFile=0x41c, lpBuffer=0x2824074*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2824074*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.654] WriteFile (in: hFile=0x41c, lpBuffer=0x2827be8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2827be8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.655] WriteFile (in: hFile=0x41c, lpBuffer=0x282b75c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x282b75c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.685] WriteFile (in: hFile=0x41c, lpBuffer=0x282ffa8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x282ffa8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.688] WriteFile (in: hFile=0x41c, lpBuffer=0x2836bb8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2836bb8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.689] WriteFile (in: hFile=0x41c, lpBuffer=0x283a5fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x283a5fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.691] WriteFile (in: hFile=0x41c, lpBuffer=0x283e500*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x283e500*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.704] WriteFile (in: hFile=0x41c, lpBuffer=0x28421f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28421f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.708] WriteFile (in: hFile=0x41c, lpBuffer=0x2845e18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2845e18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.710] WriteFile (in: hFile=0x41c, lpBuffer=0x2849a9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2849a9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.711] WriteFile (in: hFile=0x41c, lpBuffer=0x284d720*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x284d720*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.712] WriteFile (in: hFile=0x41c, lpBuffer=0x2851234*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2851234*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.715] WriteFile (in: hFile=0x41c, lpBuffer=0x2855038*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2855038*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.717] WriteFile (in: hFile=0x41c, lpBuffer=0x2858e9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2858e9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.720] WriteFile (in: hFile=0x41c, lpBuffer=0x2592020*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2592020*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.721] WriteFile (in: hFile=0x41c, lpBuffer=0x2595d14*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2595d14*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.723] WriteFile (in: hFile=0x41c, lpBuffer=0x2599998*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2599998*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.725] WriteFile (in: hFile=0x41c, lpBuffer=0x259d67c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259d67c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.726] WriteFile (in: hFile=0x41c, lpBuffer=0x25a1360*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a1360*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.728] WriteFile (in: hFile=0x41c, lpBuffer=0x25a4ed4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a4ed4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.730] WriteFile (in: hFile=0x41c, lpBuffer=0x25a88c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a88c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.791] WriteFile (in: hFile=0x41c, lpBuffer=0x25ac864*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ac864*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.792] WriteFile (in: hFile=0x41c, lpBuffer=0x25b02b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b02b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.794] WriteFile (in: hFile=0x41c, lpBuffer=0x25b3bdc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b3bdc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.856] WriteFile (in: hFile=0x5dc, lpBuffer=0x25b7a78*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b7a78*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.858] WriteFile (in: hFile=0x5dc, lpBuffer=0x25bb81c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bb81c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.860] WriteFile (in: hFile=0x5dc, lpBuffer=0x25bf5c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bf5c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.863] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c31f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c31f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.868] WriteFile (in: hFile=0x5dc, lpBuffer=0x25c6f38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c6f38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.870] WriteFile (in: hFile=0x5dc, lpBuffer=0x25cacdc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cacdc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.871] WriteFile (in: hFile=0x5dc, lpBuffer=0x25cea80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cea80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.873] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d26b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d26b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.875] WriteFile (in: hFile=0x5dc, lpBuffer=0x25d63f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d63f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.877] WriteFile (in: hFile=0x5dc, lpBuffer=0x25da19c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25da19c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.878] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ddf40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ddf40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.883] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e1b74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e1b74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.885] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e58b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e58b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.888] WriteFile (in: hFile=0x5dc, lpBuffer=0x25e965c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e965c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.890] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ed400*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ed400*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.892] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f1034*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f1034*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.895] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f4d18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f4d18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.896] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f8a5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f8a5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.934] WriteFile (in: hFile=0x41c, lpBuffer=0x25fc8e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fc8e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.936] WriteFile (in: hFile=0x41c, lpBuffer=0x26004b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26004b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.938] WriteFile (in: hFile=0x41c, lpBuffer=0x260419c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260419c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.940] WriteFile (in: hFile=0x41c, lpBuffer=0x2607ee0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2607ee0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.942] WriteFile (in: hFile=0x41c, lpBuffer=0x260bc24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260bc24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.944] WriteFile (in: hFile=0x41c, lpBuffer=0x260f7f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260f7f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.946] WriteFile (in: hFile=0x41c, lpBuffer=0x26134dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26134dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.951] WriteFile (in: hFile=0x41c, lpBuffer=0x2617220*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2617220*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.954] WriteFile (in: hFile=0x41c, lpBuffer=0x261af64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261af64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.956] WriteFile (in: hFile=0x41c, lpBuffer=0x261eb38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261eb38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.958] WriteFile (in: hFile=0x41c, lpBuffer=0x262281c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262281c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.960] WriteFile (in: hFile=0x41c, lpBuffer=0x2626560*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2626560*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.963] WriteFile (in: hFile=0x41c, lpBuffer=0x262a2a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262a2a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.965] WriteFile (in: hFile=0x41c, lpBuffer=0x262de78*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262de78*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.983] WriteFile (in: hFile=0x41c, lpBuffer=0x2631b5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2631b5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0105.986] WriteFile (in: hFile=0x41c, lpBuffer=0x26358a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26358a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.160] WriteFile (in: hFile=0x41c, lpBuffer=0x2639b2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2639b2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.162] WriteFile (in: hFile=0x41c, lpBuffer=0x263d700*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263d700*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.163] WriteFile (in: hFile=0x41c, lpBuffer=0x2641264*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2641264*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.165] WriteFile (in: hFile=0x41c, lpBuffer=0x2644e28*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2644e28*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.167] WriteFile (in: hFile=0x41c, lpBuffer=0x26489ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26489ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.169] WriteFile (in: hFile=0x41c, lpBuffer=0x264c440*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264c440*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.171] WriteFile (in: hFile=0x41c, lpBuffer=0x264fef4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264fef4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.173] WriteFile (in: hFile=0x41c, lpBuffer=0x2653a08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2653a08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.175] WriteFile (in: hFile=0x41c, lpBuffer=0x265751c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265751c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.177] WriteFile (in: hFile=0x41c, lpBuffer=0x265af00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265af00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.179] WriteFile (in: hFile=0x41c, lpBuffer=0x265e9a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265e9a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.181] WriteFile (in: hFile=0x41c, lpBuffer=0x26624a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26624a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.184] WriteFile (in: hFile=0x41c, lpBuffer=0x2665fac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2665fac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.185] WriteFile (in: hFile=0x41c, lpBuffer=0x2669940*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2669940*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.187] WriteFile (in: hFile=0x41c, lpBuffer=0x266d324*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266d324*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.189] WriteFile (in: hFile=0x41c, lpBuffer=0x2670d68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2670d68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.191] WriteFile (in: hFile=0x41c, lpBuffer=0x26747ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26747ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.193] WriteFile (in: hFile=0x41c, lpBuffer=0x2678080*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2678080*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.195] WriteFile (in: hFile=0x41c, lpBuffer=0x267bb94*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267bb94*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.229] WriteFile (in: hFile=0x41c, lpBuffer=0x267f708*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267f708*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.247] WriteFile (in: hFile=0x41c, lpBuffer=0x268327c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268327c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.249] WriteFile (in: hFile=0x41c, lpBuffer=0x2686cc0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2686cc0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.276] WriteFile (in: hFile=0x41c, lpBuffer=0x268aa14*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268aa14*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.325] WriteFile (in: hFile=0x41c, lpBuffer=0x268e7c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268e7c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.326] WriteFile (in: hFile=0x41c, lpBuffer=0x269257c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269257c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.328] WriteFile (in: hFile=0x41c, lpBuffer=0x2696200*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2696200*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.350] WriteFile (in: hFile=0x5dc, lpBuffer=0x2699d9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2699d9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.352] WriteFile (in: hFile=0x5dc, lpBuffer=0x269d840*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269d840*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.354] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a12e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a12e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.358] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a4c18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a4c18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.360] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a8e68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a8e68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.362] WriteFile (in: hFile=0x5dc, lpBuffer=0x26aca2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26aca2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.364] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b0650*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b0650*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.366] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b4274*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b4274*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.367] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b7d28*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b7d28*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.369] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bb83c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bb83c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.371] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bf3b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bf3b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.373] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c2f24*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c2f24*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.375] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c6968*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c6968*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.387] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ca34c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ca34c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.390] WriteFile (in: hFile=0x5dc, lpBuffer=0x26cdd90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cdd90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.391] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d17d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d17d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.392] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d50a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d50a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.393] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d903c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d903c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.395] WriteFile (in: hFile=0x5dc, lpBuffer=0x26dcd90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26dcd90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.397] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e0b44*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e0b44*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.399] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e5408*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e5408*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.401] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e908c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e908c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.406] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ed2d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ed2d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.408] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f1664*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f1664*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.410] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f54c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f54c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.413] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f8ebc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f8ebc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.416] WriteFile (in: hFile=0x5dc, lpBuffer=0x26fc910*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fc910*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.419] WriteFile (in: hFile=0x5dc, lpBuffer=0x2700364*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2700364*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.421] WriteFile (in: hFile=0x5dc, lpBuffer=0x2703c88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2703c88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.465] WriteFile (in: hFile=0x41c, lpBuffer=0x27079f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27079f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.470] WriteFile (in: hFile=0x41c, lpBuffer=0x270b674*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270b674*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.474] WriteFile (in: hFile=0x41c, lpBuffer=0x270f2f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270f2f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.476] WriteFile (in: hFile=0x41c, lpBuffer=0x2712e0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2712e0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.477] WriteFile (in: hFile=0x41c, lpBuffer=0x2716980*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2716980*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.479] WriteFile (in: hFile=0x41c, lpBuffer=0x271a554*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271a554*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.480] WriteFile (in: hFile=0x41c, lpBuffer=0x271e128*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271e128*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.481] WriteFile (in: hFile=0x41c, lpBuffer=0x2721bcc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2721bcc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.482] WriteFile (in: hFile=0x41c, lpBuffer=0x2725850*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2725850*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.484] WriteFile (in: hFile=0x41c, lpBuffer=0x2729534*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2729534*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.485] WriteFile (in: hFile=0x41c, lpBuffer=0x272d218*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272d218*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.486] WriteFile (in: hFile=0x41c, lpBuffer=0x2730d8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2730d8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.487] WriteFile (in: hFile=0x41c, lpBuffer=0x2734a80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2734a80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.489] WriteFile (in: hFile=0x41c, lpBuffer=0x27387d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27387d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.490] WriteFile (in: hFile=0x41c, lpBuffer=0x273c528*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273c528*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.492] WriteFile (in: hFile=0x41c, lpBuffer=0x274014c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274014c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.525] WriteFile (in: hFile=0x41c, lpBuffer=0x2743ba0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2743ba0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.527] WriteFile (in: hFile=0x41c, lpBuffer=0x2747654*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2747654*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.529] WriteFile (in: hFile=0x41c, lpBuffer=0x274b108*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274b108*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.530] WriteFile (in: hFile=0x41c, lpBuffer=0x274ea8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274ea8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.536] WriteFile (in: hFile=0x41c, lpBuffer=0x27524e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27524e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.539] WriteFile (in: hFile=0x41c, lpBuffer=0x2755f94*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2755f94*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.540] WriteFile (in: hFile=0x41c, lpBuffer=0x2759a48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2759a48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.542] WriteFile (in: hFile=0x41c, lpBuffer=0x275d3cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275d3cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.544] WriteFile (in: hFile=0x41c, lpBuffer=0x276158c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276158c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.546] WriteFile (in: hFile=0x41c, lpBuffer=0x2764ce0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2764ce0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.548] WriteFile (in: hFile=0x41c, lpBuffer=0x2768494*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2768494*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.550] WriteFile (in: hFile=0x41c, lpBuffer=0x276bc48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276bc48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.552] WriteFile (in: hFile=0x41c, lpBuffer=0x276f2cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276f2cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.555] WriteFile (in: hFile=0x41c, lpBuffer=0x27727d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27727d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.557] WriteFile (in: hFile=0x41c, lpBuffer=0x2775cd4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2775cd4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.568] WriteFile (in: hFile=0x41c, lpBuffer=0x277b350*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277b350*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.608] WriteFile (in: hFile=0x2ec, lpBuffer=0x277e854*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277e854*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.610] WriteFile (in: hFile=0x2ec, lpBuffer=0x2781e28*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2781e28*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.612] WriteFile (in: hFile=0x2ec, lpBuffer=0x27855d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27855d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.614] WriteFile (in: hFile=0x2ec, lpBuffer=0x2788a88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2788a88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.616] WriteFile (in: hFile=0x2ec, lpBuffer=0x278bf2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278bf2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.619] WriteFile (in: hFile=0x2ec, lpBuffer=0x2591854*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2591854*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.621] WriteFile (in: hFile=0x2ec, lpBuffer=0x2595468*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2595468*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.623] WriteFile (in: hFile=0x2ec, lpBuffer=0x2598c0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2598c0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.624] WriteFile (in: hFile=0x2ec, lpBuffer=0x259c994*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x259c994*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.626] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a06f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a06f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.646] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a5878*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a5878*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.647] WriteFile (in: hFile=0x2ec, lpBuffer=0x25a9608*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a9608*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.649] WriteFile (in: hFile=0x2ec, lpBuffer=0x25ad8b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ad8b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.651] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b10b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b10b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.652] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b49d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b49d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.653] WriteFile (in: hFile=0x2ec, lpBuffer=0x25b8058*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25b8058*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.656] WriteFile (in: hFile=0x2ec, lpBuffer=0x25bbab4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bbab4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.658] WriteFile (in: hFile=0x2ec, lpBuffer=0x25bf268*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25bf268*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.678] WriteFile (in: hFile=0x41c, lpBuffer=0x25c2ed4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c2ed4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.680] WriteFile (in: hFile=0x41c, lpBuffer=0x25c6798*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c6798*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.681] WriteFile (in: hFile=0x41c, lpBuffer=0x25c9edc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c9edc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.683] WriteFile (in: hFile=0x41c, lpBuffer=0x25cd620*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cd620*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.684] WriteFile (in: hFile=0x41c, lpBuffer=0x25d1348*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d1348*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.687] WriteFile (in: hFile=0x41c, lpBuffer=0x25d4a8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d4a8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.699] WriteFile (in: hFile=0x41c, lpBuffer=0x25e2c9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e2c9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.707] WriteFile (in: hFile=0x41c, lpBuffer=0x25e7508*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e7508*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.710] WriteFile (in: hFile=0x41c, lpBuffer=0x25edba4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25edba4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.749] WriteFile (in: hFile=0x5dc, lpBuffer=0x25f21a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f21a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.796] WriteFile (in: hFile=0x41c, lpBuffer=0x25f5f98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f5f98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.798] WriteFile (in: hFile=0x41c, lpBuffer=0x25f973c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f973c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.800] WriteFile (in: hFile=0x41c, lpBuffer=0x25fde40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fde40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.815] WriteFile (in: hFile=0x41c, lpBuffer=0x260b224*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260b224*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.832] WriteFile (in: hFile=0x41c, lpBuffer=0x26100ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26100ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.846] WriteFile (in: hFile=0x41c, lpBuffer=0x2615c48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2615c48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.856] WriteFile (in: hFile=0x41c, lpBuffer=0x261bf70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261bf70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.858] WriteFile (in: hFile=0x41c, lpBuffer=0x261ffb0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261ffb0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.871] WriteFile (in: hFile=0x41c, lpBuffer=0x26246f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26246f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.873] WriteFile (in: hFile=0x41c, lpBuffer=0x262820c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262820c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.876] WriteFile (in: hFile=0x41c, lpBuffer=0x262c1fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262c1fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.891] WriteFile (in: hFile=0x41c, lpBuffer=0x2631020*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2631020*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.906] WriteFile (in: hFile=0x5dc, lpBuffer=0x2635554*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2635554*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.910] WriteFile (in: hFile=0x5dc, lpBuffer=0x2639058*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2639058*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.924] WriteFile (in: hFile=0x5dc, lpBuffer=0x2660fac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2660fac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.928] WriteFile (in: hFile=0x5dc, lpBuffer=0x2664a00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2664a00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.957] WriteFile (in: hFile=0x5dc, lpBuffer=0x26695c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26695c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.961] WriteFile (in: hFile=0x5dc, lpBuffer=0x266d1f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266d1f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.964] WriteFile (in: hFile=0x5dc, lpBuffer=0x2671740*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2671740*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0106.998] WriteFile (in: hFile=0x41c, lpBuffer=0x2678014*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2678014*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.005] WriteFile (in: hFile=0x5dc, lpBuffer=0x267de8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267de8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.007] WriteFile (in: hFile=0x5dc, lpBuffer=0x26818e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26818e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.008] WriteFile (in: hFile=0x5dc, lpBuffer=0x2686064*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2686064*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.024] WriteFile (in: hFile=0x5dc, lpBuffer=0x268b9d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268b9d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.030] WriteFile (in: hFile=0x41c, lpBuffer=0x26a09bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a09bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.214] WriteFile (in: hFile=0x41c, lpBuffer=0x26d7f88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d7f88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.274] WriteFile (in: hFile=0x41c, lpBuffer=0x27215a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27215a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.277] WriteFile (in: hFile=0x41c, lpBuffer=0x2724f88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2724f88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.279] WriteFile (in: hFile=0x41c, lpBuffer=0x27295e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27295e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.295] WriteFile (in: hFile=0x41c, lpBuffer=0x274f98c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274f98c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.296] WriteFile (in: hFile=0x41c, lpBuffer=0x2753620*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2753620*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.297] WriteFile (in: hFile=0x41c, lpBuffer=0x27572b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27572b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.300] WriteFile (in: hFile=0x41c, lpBuffer=0x275b3e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275b3e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.302] WriteFile (in: hFile=0x41c, lpBuffer=0x275f900*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275f900*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.304] WriteFile (in: hFile=0x41c, lpBuffer=0x27659c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27659c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.305] WriteFile (in: hFile=0x41c, lpBuffer=0x2769524*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2769524*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.313] WriteFile (in: hFile=0x5dc, lpBuffer=0x277e8a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277e8a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.325] WriteFile (in: hFile=0x5dc, lpBuffer=0x27824d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27824d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.333] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a6158*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a6158*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.336] WriteFile (in: hFile=0x5dc, lpBuffer=0x25a9dec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25a9dec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.338] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ada70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ada70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.348] WriteFile (in: hFile=0x41c, lpBuffer=0x25c3828*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c3828*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.350] WriteFile (in: hFile=0x41c, lpBuffer=0x25c98e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25c98e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.352] WriteFile (in: hFile=0x41c, lpBuffer=0x25cd44c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25cd44c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.354] WriteFile (in: hFile=0x41c, lpBuffer=0x25d1080*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d1080*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.356] WriteFile (in: hFile=0x41c, lpBuffer=0x25d4cb4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d4cb4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.358] WriteFile (in: hFile=0x41c, lpBuffer=0x25d8948*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25d8948*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.360] WriteFile (in: hFile=0x41c, lpBuffer=0x25dc5dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25dc5dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.363] WriteFile (in: hFile=0x41c, lpBuffer=0x25e0260*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e0260*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.365] WriteFile (in: hFile=0x41c, lpBuffer=0x25e3dc4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e3dc4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.366] WriteFile (in: hFile=0x41c, lpBuffer=0x25e79f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25e79f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.369] WriteFile (in: hFile=0x41c, lpBuffer=0x25eb62c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25eb62c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.371] WriteFile (in: hFile=0x41c, lpBuffer=0x25ef2c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ef2c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.373] WriteFile (in: hFile=0x41c, lpBuffer=0x25f2f54*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f2f54*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.374] WriteFile (in: hFile=0x41c, lpBuffer=0x25f6bd8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25f6bd8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.376] WriteFile (in: hFile=0x41c, lpBuffer=0x25fb554*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25fb554*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.391] WriteFile (in: hFile=0x5dc, lpBuffer=0x25ff2a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25ff2a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.393] WriteFile (in: hFile=0x5dc, lpBuffer=0x2602ed8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2602ed8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.435] WriteFile (in: hFile=0x41c, lpBuffer=0x2607790*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2607790*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.437] WriteFile (in: hFile=0x41c, lpBuffer=0x260ba9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260ba9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.439] WriteFile (in: hFile=0x41c, lpBuffer=0x260ff3c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260ff3c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.440] WriteFile (in: hFile=0x41c, lpBuffer=0x261413c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261413c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.442] WriteFile (in: hFile=0x41c, lpBuffer=0x26183ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26183ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.443] WriteFile (in: hFile=0x41c, lpBuffer=0x261c76c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261c76c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.450] WriteFile (in: hFile=0x41c, lpBuffer=0x2620570*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2620570*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.453] WriteFile (in: hFile=0x41c, lpBuffer=0x26247e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26247e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.454] WriteFile (in: hFile=0x41c, lpBuffer=0x2628ba0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2628ba0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.456] WriteFile (in: hFile=0x41c, lpBuffer=0x262cfd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262cfd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.458] WriteFile (in: hFile=0x41c, lpBuffer=0x2631460*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2631460*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.470] WriteFile (in: hFile=0x5dc, lpBuffer=0x26358b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26358b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.472] WriteFile (in: hFile=0x5dc, lpBuffer=0x26399d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26399d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.473] WriteFile (in: hFile=0x5dc, lpBuffer=0x263db30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263db30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.505] WriteFile (in: hFile=0x41c, lpBuffer=0x26422e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26422e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.506] WriteFile (in: hFile=0x41c, lpBuffer=0x26465c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26465c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.508] WriteFile (in: hFile=0x41c, lpBuffer=0x264a488*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264a488*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.510] WriteFile (in: hFile=0x41c, lpBuffer=0x264e46c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264e46c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.514] WriteFile (in: hFile=0x41c, lpBuffer=0x2652814*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2652814*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.516] WriteFile (in: hFile=0x41c, lpBuffer=0x2656448*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2656448*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.517] WriteFile (in: hFile=0x41c, lpBuffer=0x265a0dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265a0dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.519] WriteFile (in: hFile=0x41c, lpBuffer=0x265dd70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265dd70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.521] WriteFile (in: hFile=0x41c, lpBuffer=0x2661a04*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2661a04*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.525] WriteFile (in: hFile=0x41c, lpBuffer=0x2665698*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2665698*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.527] WriteFile (in: hFile=0x41c, lpBuffer=0x266932c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266932c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.531] WriteFile (in: hFile=0x41c, lpBuffer=0x266cfc0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266cfc0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.533] WriteFile (in: hFile=0x41c, lpBuffer=0x2670534*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2670534*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.582] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a85a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a85a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.585] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ac6c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ac6c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.589] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b05ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b05ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.592] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b4400*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b4400*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.594] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b8908*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b8908*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.596] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bc5a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bc5a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.610] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e2b10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e2b10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.612] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e66f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e66f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.614] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ea208*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ea208*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.619] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ee40c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ee40c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.644] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f2bf8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f2bf8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.646] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f6948*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f6948*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.658] WriteFile (in: hFile=0x5dc, lpBuffer=0x271d13c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271d13c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.662] WriteFile (in: hFile=0x5dc, lpBuffer=0x27210bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27210bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.665] WriteFile (in: hFile=0x5dc, lpBuffer=0x2724ab0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2724ab0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.667] WriteFile (in: hFile=0x5dc, lpBuffer=0x27286e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27286e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.718] WriteFile (in: hFile=0x5dc, lpBuffer=0x274f5a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274f5a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.721] WriteFile (in: hFile=0x5dc, lpBuffer=0x2753368*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2753368*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.731] WriteFile (in: hFile=0x5dc, lpBuffer=0x2779e04*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2779e04*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.734] WriteFile (in: hFile=0x5dc, lpBuffer=0x277e06c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277e06c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.736] WriteFile (in: hFile=0x5dc, lpBuffer=0x27822f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27822f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.740] WriteFile (in: hFile=0x5dc, lpBuffer=0x27976e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27976e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.742] WriteFile (in: hFile=0x5dc, lpBuffer=0x279b950*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279b950*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.744] WriteFile (in: hFile=0x5dc, lpBuffer=0x279fc50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279fc50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.746] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a3eb8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a3eb8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.780] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b9a4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b9a4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.814] WriteFile (in: hFile=0x5dc, lpBuffer=0x27bf404*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27bf404*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.857] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c441c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c441c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.882] WriteFile (in: hFile=0x5dc, lpBuffer=0x27dab44*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27dab44*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.922] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f1d94*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f1d94*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.926] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f6938*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f6938*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0107.947] WriteFile (in: hFile=0x5dc, lpBuffer=0x27fbf38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27fbf38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.032] WriteFile (in: hFile=0x5dc, lpBuffer=0x280a894*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280a894*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.161] WriteFile (in: hFile=0x5dc, lpBuffer=0x280fc6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280fc6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.166] WriteFile (in: hFile=0x5dc, lpBuffer=0x2813a70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2813a70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.184] WriteFile (in: hFile=0x5dc, lpBuffer=0x281b164*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x281b164*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.187] WriteFile (in: hFile=0x5dc, lpBuffer=0x281f868*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x281f868*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.189] WriteFile (in: hFile=0x5dc, lpBuffer=0x2823f9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2823f9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.227] WriteFile (in: hFile=0x5dc, lpBuffer=0x2839e38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2839e38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.232] WriteFile (in: hFile=0x5dc, lpBuffer=0x283e568*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x283e568*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.236] WriteFile (in: hFile=0x5dc, lpBuffer=0x2841fbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2841fbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.335] WriteFile (in: hFile=0x5dc, lpBuffer=0x260451c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260451c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.365] WriteFile (in: hFile=0x5dc, lpBuffer=0x262cd30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262cd30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.411] WriteFile (in: hFile=0x5dc, lpBuffer=0x26555cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26555cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.415] WriteFile (in: hFile=0x5dc, lpBuffer=0x2659988*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2659988*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.416] WriteFile (in: hFile=0x5dc, lpBuffer=0x265e268*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x265e268*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.420] WriteFile (in: hFile=0x5dc, lpBuffer=0x26625b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26625b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.453] WriteFile (in: hFile=0x5dc, lpBuffer=0x269635c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269635c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.455] WriteFile (in: hFile=0x5dc, lpBuffer=0x269a71c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269a71c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.456] WriteFile (in: hFile=0x5dc, lpBuffer=0x269ec2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269ec2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.458] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a31ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a31ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.488] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b90ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b90ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.490] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bd360*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bd360*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.493] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c1c40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c1c40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.494] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c5f90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c5f90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.501] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ce0e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ce0e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.503] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d24a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d24a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.504] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d69b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d69b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.506] WriteFile (in: hFile=0x5dc, lpBuffer=0x26daf34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26daf34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.509] WriteFile (in: hFile=0x5dc, lpBuffer=0x26df514*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26df514*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.511] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e3788*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e3788*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.513] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e759c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e759c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.515] WriteFile (in: hFile=0x5dc, lpBuffer=0x26eb410*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26eb410*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.517] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ef7d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ef7d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.609] WriteFile (in: hFile=0x5dc, lpBuffer=0x272ef44*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272ef44*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.626] WriteFile (in: hFile=0x5dc, lpBuffer=0x275cd18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275cd18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.628] WriteFile (in: hFile=0x5dc, lpBuffer=0x2761a60*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2761a60*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.632] WriteFile (in: hFile=0x5dc, lpBuffer=0x27659f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27659f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.637] WriteFile (in: hFile=0x5dc, lpBuffer=0x276ce1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276ce1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0108.648] WriteFile (in: hFile=0x5dc, lpBuffer=0x2772f80*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2772f80*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.637] WriteFile (in: hFile=0x5dc, lpBuffer=0x27fd4e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27fd4e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.639] WriteFile (in: hFile=0x5dc, lpBuffer=0x280198c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280198c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.640] WriteFile (in: hFile=0x5dc, lpBuffer=0x2805f38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2805f38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.642] WriteFile (in: hFile=0x5dc, lpBuffer=0x2809e70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2809e70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.644] WriteFile (in: hFile=0x5dc, lpBuffer=0x280dce8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280dce8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.645] WriteFile (in: hFile=0x5dc, lpBuffer=0x28117ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28117ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.647] WriteFile (in: hFile=0x5dc, lpBuffer=0x28158a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28158a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.648] WriteFile (in: hFile=0x5dc, lpBuffer=0x28194d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28194d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.650] WriteFile (in: hFile=0x5dc, lpBuffer=0x281da6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x281da6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.670] WriteFile (in: hFile=0x5dc, lpBuffer=0x2822ac8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2822ac8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.674] WriteFile (in: hFile=0x5dc, lpBuffer=0x2826f34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2826f34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.696] WriteFile (in: hFile=0x5dc, lpBuffer=0x282d228*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x282d228*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.729] WriteFile (in: hFile=0x5dc, lpBuffer=0x28336e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28336e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.773] WriteFile (in: hFile=0x5dc, lpBuffer=0x286c5dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x286c5dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.804] WriteFile (in: hFile=0x5dc, lpBuffer=0x28941a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28941a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.824] WriteFile (in: hFile=0x5dc, lpBuffer=0x28bd35c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28bd35c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.852] WriteFile (in: hFile=0x5dc, lpBuffer=0x28d5240*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28d5240*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.901] WriteFile (in: hFile=0x5dc, lpBuffer=0x28eb69c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28eb69c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.924] WriteFile (in: hFile=0x2ec, lpBuffer=0x2610ae8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2610ae8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.935] WriteFile (in: hFile=0x2ec, lpBuffer=0x2637634*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2637634*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.958] WriteFile (in: hFile=0x2ec, lpBuffer=0x2685f58*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2685f58*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0112.981] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d4920*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d4920*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.224] WriteFile (in: hFile=0x2ec, lpBuffer=0x26fc488*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fc488*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.243] WriteFile (in: hFile=0x2ec, lpBuffer=0x272ac70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272ac70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.251] WriteFile (in: hFile=0x2ec, lpBuffer=0x2736cc4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2736cc4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.254] WriteFile (in: hFile=0x2ec, lpBuffer=0x273c004*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273c004*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.267] WriteFile (in: hFile=0x2ec, lpBuffer=0x27629f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27629f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.268] WriteFile (in: hFile=0x2ec, lpBuffer=0x2766a34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2766a34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.270] WriteFile (in: hFile=0x2ec, lpBuffer=0x276aa78*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276aa78*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.317] WriteFile (in: hFile=0x2ec, lpBuffer=0x2791494*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2791494*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.319] WriteFile (in: hFile=0x2ec, lpBuffer=0x2795e40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2795e40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.322] WriteFile (in: hFile=0x2ec, lpBuffer=0x279a4a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279a4a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.325] WriteFile (in: hFile=0x2ec, lpBuffer=0x279eb74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279eb74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.328] WriteFile (in: hFile=0x2ec, lpBuffer=0x27a32a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a32a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.329] WriteFile (in: hFile=0x2ec, lpBuffer=0x27a7904*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a7904*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.332] WriteFile (in: hFile=0x2ec, lpBuffer=0x27abf64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27abf64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.334] WriteFile (in: hFile=0x2ec, lpBuffer=0x27affa8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27affa8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.336] WriteFile (in: hFile=0x2ec, lpBuffer=0x27b44cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b44cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.339] WriteFile (in: hFile=0x2ec, lpBuffer=0x27b84c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b84c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.342] WriteFile (in: hFile=0x2ec, lpBuffer=0x27bc974*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27bc974*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.344] WriteFile (in: hFile=0x2ec, lpBuffer=0x27c1010*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c1010*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.358] WriteFile (in: hFile=0x2ec, lpBuffer=0x27e7f7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e7f7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.360] WriteFile (in: hFile=0x2ec, lpBuffer=0x27ebbb0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ebbb0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.361] WriteFile (in: hFile=0x2ec, lpBuffer=0x27ef774*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ef774*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.376] WriteFile (in: hFile=0x2ec, lpBuffer=0x2807380*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2807380*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.379] WriteFile (in: hFile=0x2ec, lpBuffer=0x2621028*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2621028*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.382] WriteFile (in: hFile=0x2ec, lpBuffer=0x2625de0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2625de0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.391] WriteFile (in: hFile=0x2ec, lpBuffer=0x2647668*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2647668*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.396] WriteFile (in: hFile=0x2ec, lpBuffer=0x264c39c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264c39c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.413] WriteFile (in: hFile=0x2ec, lpBuffer=0x267f490*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267f490*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.419] WriteFile (in: hFile=0x2ec, lpBuffer=0x26841c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26841c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.475] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c9054*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c9054*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.478] WriteFile (in: hFile=0x2ec, lpBuffer=0x26cd800*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cd800*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.516] WriteFile (in: hFile=0x2ec, lpBuffer=0x26dd300*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26dd300*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.521] WriteFile (in: hFile=0x2ec, lpBuffer=0x26e1acc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e1acc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.539] WriteFile (in: hFile=0x2ec, lpBuffer=0x26fa2a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fa2a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.543] WriteFile (in: hFile=0x2ec, lpBuffer=0x26fefdc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fefdc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.545] WriteFile (in: hFile=0x2ec, lpBuffer=0x2703658*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2703658*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.547] WriteFile (in: hFile=0x2ec, lpBuffer=0x2707d40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2707d40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.578] WriteFile (in: hFile=0x2ec, lpBuffer=0x2742b00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2742b00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.616] WriteFile (in: hFile=0x2ec, lpBuffer=0x27868e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27868e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.618] WriteFile (in: hFile=0x2ec, lpBuffer=0x278b11c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278b11c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.638] WriteFile (in: hFile=0x2ec, lpBuffer=0x27ce330*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ce330*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.641] WriteFile (in: hFile=0x2ec, lpBuffer=0x27d2a8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d2a8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.660] WriteFile (in: hFile=0x2ec, lpBuffer=0x27fc4d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27fc4d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.662] WriteFile (in: hFile=0x2ec, lpBuffer=0x2801508*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2801508*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.681] WriteFile (in: hFile=0x2ec, lpBuffer=0x2646534*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2646534*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.685] WriteFile (in: hFile=0x2ec, lpBuffer=0x264b4b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264b4b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.697] WriteFile (in: hFile=0x2ec, lpBuffer=0x2672468*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2672468*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.699] WriteFile (in: hFile=0x2ec, lpBuffer=0x267701c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267701c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.703] WriteFile (in: hFile=0x2ec, lpBuffer=0x267cab8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267cab8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.706] WriteFile (in: hFile=0x2ec, lpBuffer=0x2681268*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2681268*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.707] WriteFile (in: hFile=0x2ec, lpBuffer=0x2685a18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2685a18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.709] WriteFile (in: hFile=0x2ec, lpBuffer=0x268a5cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268a5cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.713] WriteFile (in: hFile=0x2ec, lpBuffer=0x2690068*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2690068*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.716] WriteFile (in: hFile=0x2ec, lpBuffer=0x2694818*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2694818*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.719] WriteFile (in: hFile=0x2ec, lpBuffer=0x2698fc8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2698fc8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.722] WriteFile (in: hFile=0x2ec, lpBuffer=0x269d5cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269d5cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.723] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a1c74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a1c74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.725] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a6440*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a6440*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.757] WriteFile (in: hFile=0x2ec, lpBuffer=0x26bcf54*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bcf54*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.816] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c1838*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c1838*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.847] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c6774*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c6774*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.849] WriteFile (in: hFile=0x5dc, lpBuffer=0x26caeb4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26caeb4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.851] WriteFile (in: hFile=0x5dc, lpBuffer=0x26cf5f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cf5f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.854] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d3d34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d3d34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.856] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d8474*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d8474*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.858] WriteFile (in: hFile=0x5dc, lpBuffer=0x26dcbb4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26dcbb4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.860] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e12f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e12f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.863] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e5a34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e5a34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.865] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ea244*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ea244*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.868] WriteFile (in: hFile=0x5dc, lpBuffer=0x26eea54*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26eea54*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.869] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f3194*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f3194*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.892] WriteFile (in: hFile=0x2ec, lpBuffer=0x26f7c7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f7c7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.894] WriteFile (in: hFile=0x2ec, lpBuffer=0x26fc3bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fc3bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.896] WriteFile (in: hFile=0x2ec, lpBuffer=0x2700afc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2700afc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.904] WriteFile (in: hFile=0x5dc, lpBuffer=0x2716674*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2716674*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.909] WriteFile (in: hFile=0x5dc, lpBuffer=0x271adb4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271adb4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.911] WriteFile (in: hFile=0x5dc, lpBuffer=0x271f4f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271f4f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.913] WriteFile (in: hFile=0x5dc, lpBuffer=0x2723c34*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2723c34*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.916] WriteFile (in: hFile=0x5dc, lpBuffer=0x2728374*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2728374*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.918] WriteFile (in: hFile=0x5dc, lpBuffer=0x272cab4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272cab4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.921] WriteFile (in: hFile=0x5dc, lpBuffer=0x27311f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27311f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.934] WriteFile (in: hFile=0x5dc, lpBuffer=0x27581fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27581fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.936] WriteFile (in: hFile=0x5dc, lpBuffer=0x275c93c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275c93c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.939] WriteFile (in: hFile=0x5dc, lpBuffer=0x276107c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276107c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.941] WriteFile (in: hFile=0x5dc, lpBuffer=0x27657bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27657bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.943] WriteFile (in: hFile=0x5dc, lpBuffer=0x2769efc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2769efc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.946] WriteFile (in: hFile=0x5dc, lpBuffer=0x276e63c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276e63c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.948] WriteFile (in: hFile=0x5dc, lpBuffer=0x2772d7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2772d7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.950] WriteFile (in: hFile=0x5dc, lpBuffer=0x27774bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27774bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.954] WriteFile (in: hFile=0x5dc, lpBuffer=0x277bccc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277bccc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.958] WriteFile (in: hFile=0x5dc, lpBuffer=0x27804dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27804dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.986] WriteFile (in: hFile=0x5dc, lpBuffer=0x279645c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279645c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.988] WriteFile (in: hFile=0x5dc, lpBuffer=0x279ab9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279ab9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.992] WriteFile (in: hFile=0x5dc, lpBuffer=0x279f2dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279f2dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.994] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a3a1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a3a1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.996] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a815c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a815c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.998] WriteFile (in: hFile=0x5dc, lpBuffer=0x27ac89c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ac89c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.001] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b0fdc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b0fdc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.003] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b571c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b571c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.005] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b9e5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b9e5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.007] WriteFile (in: hFile=0x5dc, lpBuffer=0x27be59c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27be59c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.025] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c2dac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c2dac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.031] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c75bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c75bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.143] WriteFile (in: hFile=0x5dc, lpBuffer=0x27cc430*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27cc430*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.145] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d0b70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0b70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.148] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d52b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d52b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.151] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d99f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d99f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.153] WriteFile (in: hFile=0x5dc, lpBuffer=0x27de130*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27de130*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.155] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e2870*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e2870*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.158] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e6fb0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e6fb0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.160] WriteFile (in: hFile=0x5dc, lpBuffer=0x27eb7c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27eb7c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.162] WriteFile (in: hFile=0x5dc, lpBuffer=0x27effd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27effd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.164] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f4710*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f4710*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.195] WriteFile (in: hFile=0x2ec, lpBuffer=0x27f9088*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f9088*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.196] WriteFile (in: hFile=0x2ec, lpBuffer=0x27fd7c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27fd7c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.199] WriteFile (in: hFile=0x2ec, lpBuffer=0x2801f08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2801f08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.201] WriteFile (in: hFile=0x2ec, lpBuffer=0x28066a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28066a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.203] WriteFile (in: hFile=0x2ec, lpBuffer=0x280ade8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280ade8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.205] WriteFile (in: hFile=0x2ec, lpBuffer=0x280f528*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280f528*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.207] WriteFile (in: hFile=0x2ec, lpBuffer=0x282567c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x282567c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.245] WriteFile (in: hFile=0x5dc, lpBuffer=0x283b1f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x283b1f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.248] WriteFile (in: hFile=0x5dc, lpBuffer=0x283f930*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x283f930*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.250] WriteFile (in: hFile=0x5dc, lpBuffer=0x2844070*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2844070*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.252] WriteFile (in: hFile=0x5dc, lpBuffer=0x28487b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28487b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.255] WriteFile (in: hFile=0x5dc, lpBuffer=0x284cef0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x284cef0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.257] WriteFile (in: hFile=0x5dc, lpBuffer=0x2851630*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2851630*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.259] WriteFile (in: hFile=0x5dc, lpBuffer=0x2855d70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2855d70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.261] WriteFile (in: hFile=0x5dc, lpBuffer=0x285a4b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x285a4b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.263] WriteFile (in: hFile=0x5dc, lpBuffer=0x285ebf0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x285ebf0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.266] WriteFile (in: hFile=0x5dc, lpBuffer=0x2863330*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2863330*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.268] WriteFile (in: hFile=0x5dc, lpBuffer=0x2867a70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2867a70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.270] WriteFile (in: hFile=0x5dc, lpBuffer=0x286c280*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x286c280*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.273] WriteFile (in: hFile=0x5dc, lpBuffer=0x2870a90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2870a90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.275] WriteFile (in: hFile=0x5dc, lpBuffer=0x28751d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28751d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.277] WriteFile (in: hFile=0x5dc, lpBuffer=0x2879910*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2879910*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.278] WriteFile (in: hFile=0x5dc, lpBuffer=0x287e050*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x287e050*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.307] WriteFile (in: hFile=0x5dc, lpBuffer=0x2893d08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2893d08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.309] WriteFile (in: hFile=0x5dc, lpBuffer=0x2898448*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2898448*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.311] WriteFile (in: hFile=0x5dc, lpBuffer=0x289cb88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x289cb88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.314] WriteFile (in: hFile=0x5dc, lpBuffer=0x28a12c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28a12c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.316] WriteFile (in: hFile=0x5dc, lpBuffer=0x28a5a08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28a5a08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.329] WriteFile (in: hFile=0x5dc, lpBuffer=0x28aa148*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28aa148*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.332] WriteFile (in: hFile=0x5dc, lpBuffer=0x28ae888*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28ae888*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.333] WriteFile (in: hFile=0x5dc, lpBuffer=0x28b3098*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28b3098*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.336] WriteFile (in: hFile=0x5dc, lpBuffer=0x28b78a8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28b78a8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.338] WriteFile (in: hFile=0x5dc, lpBuffer=0x28bc048*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28bc048*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.340] WriteFile (in: hFile=0x5dc, lpBuffer=0x28c07e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28c07e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.342] WriteFile (in: hFile=0x5dc, lpBuffer=0x28c4f88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28c4f88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.345] WriteFile (in: hFile=0x5dc, lpBuffer=0x28c9728*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28c9728*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.347] WriteFile (in: hFile=0x5dc, lpBuffer=0x28cdec8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28cdec8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.349] WriteFile (in: hFile=0x5dc, lpBuffer=0x28d2668*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28d2668*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.352] WriteFile (in: hFile=0x5dc, lpBuffer=0x28d6e08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28d6e08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.354] WriteFile (in: hFile=0x5dc, lpBuffer=0x28db628*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28db628*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.356] WriteFile (in: hFile=0x5dc, lpBuffer=0x28dfe48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28dfe48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.543] WriteFile (in: hFile=0x2ec, lpBuffer=0x28e4810*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28e4810*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.544] WriteFile (in: hFile=0x2ec, lpBuffer=0x28e9090*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28e9090*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.547] WriteFile (in: hFile=0x2ec, lpBuffer=0x28ed830*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28ed830*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.550] WriteFile (in: hFile=0x2ec, lpBuffer=0x28f1fd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28f1fd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.553] WriteFile (in: hFile=0x2ec, lpBuffer=0x28f6770*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28f6770*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.554] WriteFile (in: hFile=0x2ec, lpBuffer=0x28faf20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28faf20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.557] WriteFile (in: hFile=0x2ec, lpBuffer=0x28ff6c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28ff6c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.559] WriteFile (in: hFile=0x2ec, lpBuffer=0x2903e60*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2903e60*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.562] WriteFile (in: hFile=0x2ec, lpBuffer=0x2908600*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2908600*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.563] WriteFile (in: hFile=0x2ec, lpBuffer=0x290cda0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x290cda0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.566] WriteFile (in: hFile=0x2ec, lpBuffer=0x2911540*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2911540*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.568] WriteFile (in: hFile=0x2ec, lpBuffer=0x2915ce0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2915ce0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.571] WriteFile (in: hFile=0x2ec, lpBuffer=0x291a480*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x291a480*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.573] WriteFile (in: hFile=0x2ec, lpBuffer=0x291ec20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x291ec20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.575] WriteFile (in: hFile=0x2ec, lpBuffer=0x29233c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29233c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.584] WriteFile (in: hFile=0x5dc, lpBuffer=0x2938f0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2938f0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.587] WriteFile (in: hFile=0x5dc, lpBuffer=0x293d6ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x293d6ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.589] WriteFile (in: hFile=0x5dc, lpBuffer=0x2941e4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2941e4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.591] WriteFile (in: hFile=0x5dc, lpBuffer=0x29465ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29465ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.593] WriteFile (in: hFile=0x5dc, lpBuffer=0x294ad8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x294ad8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.597] WriteFile (in: hFile=0x5dc, lpBuffer=0x294f52c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x294f52c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.598] WriteFile (in: hFile=0x5dc, lpBuffer=0x2953d4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2953d4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.609] WriteFile (in: hFile=0x5dc, lpBuffer=0x296afb8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x296afb8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.612] WriteFile (in: hFile=0x5dc, lpBuffer=0x296f758*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x296f758*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.669] WriteFile (in: hFile=0x5dc, lpBuffer=0x2973ef8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2973ef8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.671] WriteFile (in: hFile=0x5dc, lpBuffer=0x2978698*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2978698*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.673] WriteFile (in: hFile=0x5dc, lpBuffer=0x297ce38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x297ce38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.674] WriteFile (in: hFile=0x5dc, lpBuffer=0x29815d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29815d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.677] WriteFile (in: hFile=0x5dc, lpBuffer=0x2985d78*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2985d78*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.678] WriteFile (in: hFile=0x5dc, lpBuffer=0x298a518*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x298a518*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.687] WriteFile (in: hFile=0x5dc, lpBuffer=0x298ecb8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x298ecb8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.690] WriteFile (in: hFile=0x5dc, lpBuffer=0x2993458*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2993458*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.692] WriteFile (in: hFile=0x5dc, lpBuffer=0x2997bf8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2997bf8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.695] WriteFile (in: hFile=0x5dc, lpBuffer=0x299c418*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x299c418*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.697] WriteFile (in: hFile=0x5dc, lpBuffer=0x29a0c38*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29a0c38*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.698] WriteFile (in: hFile=0x5dc, lpBuffer=0x29a53e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29a53e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.711] WriteFile (in: hFile=0x5dc, lpBuffer=0x29b75e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29b75e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.712] WriteFile (in: hFile=0x5dc, lpBuffer=0x29bbd98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29bbd98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.721] WriteFile (in: hFile=0x5dc, lpBuffer=0x29ccb8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29ccb8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.723] WriteFile (in: hFile=0x5dc, lpBuffer=0x29d133c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29d133c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.727] WriteFile (in: hFile=0x5dc, lpBuffer=0x29d5aec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29d5aec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.728] WriteFile (in: hFile=0x5dc, lpBuffer=0x29da29c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29da29c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.730] WriteFile (in: hFile=0x5dc, lpBuffer=0x29dea4c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29dea4c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.733] WriteFile (in: hFile=0x5dc, lpBuffer=0x29e31fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29e31fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.736] WriteFile (in: hFile=0x5dc, lpBuffer=0x29e79ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29e79ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.737] WriteFile (in: hFile=0x5dc, lpBuffer=0x29ec1bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29ec1bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.751] WriteFile (in: hFile=0x2ec, lpBuffer=0x29f4f30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29f4f30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.753] WriteFile (in: hFile=0x2ec, lpBuffer=0x29f96e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29f96e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.756] WriteFile (in: hFile=0x2ec, lpBuffer=0x29fde90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x29fde90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.759] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a02640*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a02640*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.761] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a06df0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a06df0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.767] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a0b5a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a0b5a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.769] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a0fd50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a0fd50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.772] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a14500*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a14500*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.773] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a18cb0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a18cb0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.776] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a1d460*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a1d460*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.779] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a21c10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a21c10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.786] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a264f8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a264f8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.788] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a2aca8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a2aca8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.790] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a2f458*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a2f458*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.793] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a33cd8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a33cd8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.794] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a38558*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a38558*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.797] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a3cd08*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a3cd08*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.798] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a414b8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a414b8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.800] WriteFile (in: hFile=0x2ec, lpBuffer=0x2a45c68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2a45c68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.807] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a8039a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a851ce, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a851ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0114.808] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a8039a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a851ce, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a851ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.808] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9a851ce, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a989b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.808] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.808] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0114.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Decrypt.txt", lpFilePart=0x0) returned 0x89
	[0114.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.808] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0114.809] GetFileType (hFile=0x2ec) returned 0x1
	[0114.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.809] GetFileType (hFile=0x2ec) returned 0x1
	[0114.809] WriteFile (in: hFile=0x2ec, lpBuffer=0x2605dfc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2605dfc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.810] CloseHandle (hObject=0x2ec) returned 1
	[0114.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", lpFilePart=0x0) returned 0x7d
	[0114.810] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ad0cc4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ad5aed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ad5aed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0114.811] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ad0cc4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ad5aed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ad5aed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.811] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ad5aed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ae6bb6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.811] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ad5aed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ae6bb6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.811] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0114.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.811] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", lpFilePart=0x0) returned 0x7d
	[0114.811] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ad0cc4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ad5aed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ad5aed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0114.811] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ad0cc4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ad5aed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ad5aed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.812] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ad5aed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ae6bb6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.812] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.812] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0114.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Decrypt.txt", lpFilePart=0x0) returned 0x89
	[0114.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0114.813] GetFileType (hFile=0x2ec) returned 0x1
	[0114.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.813] GetFileType (hFile=0x2ec) returned 0x1
	[0114.813] WriteFile (in: hFile=0x2ec, lpBuffer=0x260a5ac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260a5ac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.814] CloseHandle (hObject=0x2ec) returned 1
	[0114.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", lpFilePart=0x0) returned 0x7d
	[0114.815] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9af2f88, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9af56c7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9af56c7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0114.816] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9af2f88, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9af56c7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9af56c7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.816] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9af56c7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9af7d26, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.816] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9af56c7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9af7d26, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.816] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0114.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", lpFilePart=0x0) returned 0x7d
	[0114.817] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9af2f88, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9af56c7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9af56c7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0114.817] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9af2f88, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9af56c7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9af56c7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.817] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9af56c7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9af7d26, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.817] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.817] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0114.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Decrypt.txt", lpFilePart=0x0) returned 0x89
	[0114.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0114.818] GetFileType (hFile=0x2ec) returned 0x1
	[0114.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.818] GetFileType (hFile=0x2ec) returned 0x1
	[0114.818] WriteFile (in: hFile=0x2ec, lpBuffer=0x260ed5c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x260ed5c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.819] CloseHandle (hObject=0x2ec) returned 1
	[0114.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.819] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", lpFilePart=0x0) returned 0x7d
	[0114.819] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b06824, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b08f4d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b08f4d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0114.820] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b06824, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b08f4d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b08f4d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.820] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b08f4d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b12ad6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.820] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b08f4d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b12ad6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.820] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0114.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", lpFilePart=0x0) returned 0x7d
	[0114.820] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b06824, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b08f4d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b08f4d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0114.821] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b06824, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b08f4d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b08f4d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.821] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b08f4d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b12ad6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.821] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.821] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0114.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Decrypt.txt", lpFilePart=0x0) returned 0x89
	[0114.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.821] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0114.822] GetFileType (hFile=0x2ec) returned 0x1
	[0114.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.822] GetFileType (hFile=0x2ec) returned 0x1
	[0114.822] WriteFile (in: hFile=0x2ec, lpBuffer=0x261350c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261350c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.823] CloseHandle (hObject=0x2ec) returned 1
	[0114.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", lpFilePart=0x0) returned 0x7d
	[0114.824] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b1eed3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b23d1a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b23d1a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0114.824] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b1eed3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b23d1a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b23d1a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.825] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b23d1a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b26356, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.825] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b23d1a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b26356, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.825] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0114.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.825] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", lpFilePart=0x0) returned 0x7d
	[0114.825] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b1eed3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b23d1a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b23d1a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0114.826] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b1eed3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b23d1a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b23d1a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.826] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b23d1a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b26356, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.826] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.826] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0114.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.826] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Decrypt.txt", lpFilePart=0x0) returned 0x89
	[0114.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.827] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0114.827] GetFileType (hFile=0x2ec) returned 0x1
	[0114.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.827] GetFileType (hFile=0x2ec) returned 0x1
	[0114.827] WriteFile (in: hFile=0x2ec, lpBuffer=0x2617cbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2617cbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.839] CloseHandle (hObject=0x2ec) returned 1
	[0114.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.839] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", lpFilePart=0x0) returned 0x7d
	[0114.839] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30055, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b34e78, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b34e78, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0114.840] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30055, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b34e78, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b34e78, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.840] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b34e78, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b39bd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.840] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b34e78, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b39bd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.840] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0114.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.841] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", lpFilePart=0x0) returned 0x7d
	[0114.841] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30055, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b34e78, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b34e78, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0114.841] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30055, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b34e78, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b34e78, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.841] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b34e78, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b39bd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.841] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.841] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0114.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.842] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Decrypt.txt", lpFilePart=0x0) returned 0x89
	[0114.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.842] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0114.842] GetFileType (hFile=0x2ec) returned 0x1
	[0114.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.842] GetFileType (hFile=0x2ec) returned 0x1
	[0114.842] WriteFile (in: hFile=0x2ec, lpBuffer=0x261ca04*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261ca04*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.843] CloseHandle (hObject=0x2ec) returned 1
	[0114.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.843] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", lpFilePart=0x0) returned 0x7d
	[0114.843] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b438c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4ae0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b4ae0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0114.844] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b438c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4ae0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b4ae0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.844] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b4ae0d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4d456, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.844] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b4ae0d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4d456, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.844] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0114.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", lpFilePart=0x0) returned 0x7d
	[0114.845] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b438c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4ae0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b4ae0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0114.845] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b438c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4ae0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b4ae0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.845] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b4ae0d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4d456, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.845] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.845] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0114.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.845] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Decrypt.txt", lpFilePart=0x0) returned 0x89
	[0114.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0114.846] GetFileType (hFile=0x2ec) returned 0x1
	[0114.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.846] GetFileType (hFile=0x2ec) returned 0x1
	[0114.846] WriteFile (in: hFile=0x2ec, lpBuffer=0x26211b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26211b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.847] CloseHandle (hObject=0x2ec) returned 1
	[0114.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x80
	[0114.847] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b682d5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6a9e4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b6a9e4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0114.848] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b682d5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6a9e4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b6a9e4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.848] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b6a9e4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6f736, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.849] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b6a9e4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6f736, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.849] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0114.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.849] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x80
	[0114.849] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b682d5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6a9e4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b6a9e4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0114.849] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b682d5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6a9e4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b6a9e4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.849] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b6a9e4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6f736, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.850] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.850] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0114.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.850] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Decrypt.txt", lpFilePart=0x0) returned 0x8c
	[0114.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.850] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0114.860] GetFileType (hFile=0x5dc) returned 0x1
	[0114.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.860] GetFileType (hFile=0x5dc) returned 0x1
	[0114.860] WriteFile (in: hFile=0x5dc, lpBuffer=0x2629664*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2629664*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.861] CloseHandle (hObject=0x5dc) returned 1
	[0114.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.861] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x80
	[0114.861] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b7e26a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b85796, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b85796, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0114.862] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b7e26a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b85796, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b85796, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.862] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b85796, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b87dd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.862] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b85796, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b87dd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.862] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0114.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.863] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x80
	[0114.863] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b7e26a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b85796, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b85796, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0114.863] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b7e26a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b85796, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b85796, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.863] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b85796, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b87dd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.863] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.863] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0114.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.863] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Decrypt.txt", lpFilePart=0x0) returned 0x8c
	[0114.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.864] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0114.864] GetFileType (hFile=0x5dc) returned 0x1
	[0114.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.864] GetFileType (hFile=0x5dc) returned 0x1
	[0114.864] WriteFile (in: hFile=0x5dc, lpBuffer=0x262dee4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262dee4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.874] CloseHandle (hObject=0x5dc) returned 1
	[0114.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af", lpFilePart=0x0) returned 0x7b
	[0114.874] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe827ed1a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8283b3f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8283b3f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0114.874] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe827ed1a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8283b3f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8283b3f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.875] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8283b3f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8283b32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.875] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8283b3f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8283b32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.875] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0114.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.876] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af", lpFilePart=0x0) returned 0x7b
	[0114.876] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe827ed1a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8283b3f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8283b3f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0114.876] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe827ed1a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8283b3f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8283b3f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.876] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8283b3f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8283b32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.876] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.876] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0114.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0114.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.877] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0114.877] GetFileType (hFile=0x5dc) returned 0x1
	[0114.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.877] GetFileType (hFile=0x5dc) returned 0x1
	[0114.877] WriteFile (in: hFile=0x5dc, lpBuffer=0x2632624*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2632624*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.878] CloseHandle (hObject=0x5dc) returned 1
	[0114.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.879] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am", lpFilePart=0x0) returned 0x7b
	[0114.879] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829259d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82973c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82973c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0114.879] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829259d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82973c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82973c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.880] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82973c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82973b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.880] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82973c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82973b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.880] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0114.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am", lpFilePart=0x0) returned 0x7b
	[0114.880] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829259d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82973c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82973c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0114.880] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829259d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82973c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82973c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.881] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82973c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82973b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.881] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.881] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0114.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0114.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.881] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0114.882] GetFileType (hFile=0x5dc) returned 0x1
	[0114.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.882] GetFileType (hFile=0x5dc) returned 0x1
	[0114.882] WriteFile (in: hFile=0x5dc, lpBuffer=0x2636d64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2636d64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.883] CloseHandle (hObject=0x5dc) returned 1
	[0114.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar", lpFilePart=0x0) returned 0x7b
	[0114.883] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829c1de, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82a5e26, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82a5e26, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0114.884] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829c1de, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82a5e26, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82a5e26, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.884] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82a5e26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82a5e12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.884] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82a5e26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82a5e12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.884] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0114.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar", lpFilePart=0x0) returned 0x7b
	[0114.885] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829c1de, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82a5e26, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82a5e26, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0114.885] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829c1de, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82a5e26, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82a5e26, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.885] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82a5e26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82a5e12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.885] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.885] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0114.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.886] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0114.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.886] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0114.900] GetFileType (hFile=0x2ec) returned 0x1
	[0114.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.900] GetFileType (hFile=0x2ec) returned 0x1
	[0114.900] WriteFile (in: hFile=0x2ec, lpBuffer=0x263f3cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263f3cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.901] CloseHandle (hObject=0x2ec) returned 1
	[0114.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az", lpFilePart=0x0) returned 0x7b
	[0114.902] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82ad358, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82afa67, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82afa67, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b440
	[0114.903] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82ad358, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82afa67, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82afa67, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.903] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82afa67, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82afa52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.903] FindNextFileW (in: hFindFile=0x82b440, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82afa67, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82afa52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.903] FindClose (in: hFindFile=0x82b440 | out: hFindFile=0x82b440) returned 1
	[0114.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.904] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az", lpFilePart=0x0) returned 0x7b
	[0114.904] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82ad358, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82afa67, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82afa67, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0114.904] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82ad358, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82afa67, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82afa67, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.904] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82afa67, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82afa52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.904] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.905] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0114.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.905] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0114.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.905] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0114.906] GetFileType (hFile=0x2ec) returned 0x1
	[0114.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.906] GetFileType (hFile=0x2ec) returned 0x1
	[0114.906] WriteFile (in: hFile=0x2ec, lpBuffer=0x2643b0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2643b0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.908] CloseHandle (hObject=0x2ec) returned 1
	[0114.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.908] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg", lpFilePart=0x0) returned 0x7b
	[0114.908] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82b6f8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82b96a9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82b96a9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b000
	[0114.908] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82b6f8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82b96a9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82b96a9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.909] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82b96a9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82bbda2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.909] FindNextFileW (in: hFindFile=0x82b000, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82b96a9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82bbda2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.909] FindClose (in: hFindFile=0x82b000 | out: hFindFile=0x82b000) returned 1
	[0114.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.909] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg", lpFilePart=0x0) returned 0x7b
	[0114.909] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82b6f8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82b96a9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82b96a9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0114.910] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82b6f8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82b96a9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82b96a9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.910] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82b96a9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82bbda2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.910] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.910] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0114.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0114.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.911] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0114.911] GetFileType (hFile=0x2ec) returned 0x1
	[0114.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.911] GetFileType (hFile=0x2ec) returned 0x1
	[0114.911] WriteFile (in: hFile=0x2ec, lpBuffer=0x264824c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264824c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.913] CloseHandle (hObject=0x2ec) returned 1
	[0114.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.913] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn", lpFilePart=0x0) returned 0x7b
	[0114.913] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82cf641, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82d4479, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82d4479, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0114.914] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82cf641, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82d4479, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82d4479, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.914] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82d4479, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82d6b52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.914] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82d4479, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82d6b52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.915] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0114.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.915] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn", lpFilePart=0x0) returned 0x7b
	[0114.915] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82cf641, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82d4479, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82d4479, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0114.915] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82cf641, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82d4479, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82d4479, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.916] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82d4479, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82d6b52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.916] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.916] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0114.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.916] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0114.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.916] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0114.917] GetFileType (hFile=0x2ec) returned 0x1
	[0114.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.917] GetFileType (hFile=0x2ec) returned 0x1
	[0114.917] WriteFile (in: hFile=0x2ec, lpBuffer=0x264c98c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264c98c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.918] CloseHandle (hObject=0x2ec) returned 1
	[0114.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.919] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca", lpFilePart=0x0) returned 0x7b
	[0114.919] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82db992, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82e07b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82e07b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0114.922] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82db992, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82e07b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82e07b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.922] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82e07b4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82e0792, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.923] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82e07b4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82e0792, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.923] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0114.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.923] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca", lpFilePart=0x0) returned 0x7b
	[0114.923] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82db992, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82e07b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82e07b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0114.924] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82db992, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82e07b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82e07b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.924] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82e07b4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82e0792, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.924] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.924] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0114.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0114.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.925] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0114.928] GetFileType (hFile=0x5dc) returned 0x1
	[0114.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.928] GetFileType (hFile=0x5dc) returned 0x1
	[0114.928] WriteFile (in: hFile=0x5dc, lpBuffer=0x2652348*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2652348*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.929] CloseHandle (hObject=0x5dc) returned 1
	[0114.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs", lpFilePart=0x0) returned 0x7b
	[0114.929] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82e7ce6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82ef21b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82ef21b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0114.930] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82e7ce6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82ef21b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82ef21b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.930] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82ef21b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82ef1f2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.930] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82ef21b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82ef1f2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.930] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0114.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.930] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs", lpFilePart=0x0) returned 0x7b
	[0114.931] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82e7ce6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82ef21b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82ef21b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0114.931] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82e7ce6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82ef21b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82ef21b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.931] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82ef21b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82ef1f2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.931] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.931] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0114.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.932] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0114.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.932] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0114.933] GetFileType (hFile=0x5dc) returned 0x1
	[0114.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.933] GetFileType (hFile=0x5dc) returned 0x1
	[0114.933] WriteFile (in: hFile=0x5dc, lpBuffer=0x2656a88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2656a88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.934] CloseHandle (hObject=0x5dc) returned 1
	[0114.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da", lpFilePart=0x0) returned 0x7b
	[0114.934] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82f8e1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe830037f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe830037f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0114.954] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82f8e1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe830037f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe830037f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.954] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe830037f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8300362, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.954] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe830037f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8300362, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.955] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0114.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da", lpFilePart=0x0) returned 0x7b
	[0114.955] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82f8e1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe830037f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe830037f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0114.955] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82f8e1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe830037f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe830037f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.955] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe830037f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8300362, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.955] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.955] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0114.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0114.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.956] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0114.956] GetFileType (hFile=0x5dc) returned 0x1
	[0114.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.956] GetFileType (hFile=0x5dc) returned 0x1
	[0114.956] WriteFile (in: hFile=0x5dc, lpBuffer=0x2661c48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2661c48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.957] CloseHandle (hObject=0x5dc) returned 1
	[0114.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de", lpFilePart=0x0) returned 0x7b
	[0114.958] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83114cd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe831ff69, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe831ff69, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0114.959] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83114cd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe831ff69, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe831ff69, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.959] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe831ff69, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8322642, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.959] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe831ff69, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8322642, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.959] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0114.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de", lpFilePart=0x0) returned 0x7b
	[0114.960] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83114cd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe831ff69, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe831ff69, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0114.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83114cd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe831ff69, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe831ff69, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe831ff69, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8322642, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.960] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.960] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0114.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.961] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0114.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0114.961] GetFileType (hFile=0x5dc) returned 0x1
	[0114.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.961] GetFileType (hFile=0x5dc) returned 0x1
	[0114.962] WriteFile (in: hFile=0x5dc, lpBuffer=0x2666388*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2666388*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.963] CloseHandle (hObject=0x5dc) returned 1
	[0114.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.963] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el", lpFilePart=0x0) returned 0x7b
	[0114.963] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe832e9a1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83385fe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83385fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0114.964] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe832e9a1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83385fe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83385fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.964] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83385fe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe833d3f2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.964] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83385fe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe833d3f2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.964] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0114.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.964] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el", lpFilePart=0x0) returned 0x7b
	[0114.965] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe832e9a1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83385fe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83385fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0114.965] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe832e9a1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83385fe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83385fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.965] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83385fe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe833d3f2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.965] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.965] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0114.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0114.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.977] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0114.978] GetFileType (hFile=0x5dc) returned 0x1
	[0114.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.978] GetFileType (hFile=0x5dc) returned 0x1
	[0114.978] WriteFile (in: hFile=0x5dc, lpBuffer=0x267f0dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267f0dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.979] CloseHandle (hObject=0x5dc) returned 1
	[0114.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB", lpFilePart=0x0) returned 0x7e
	[0114.979] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8355ac3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe835f6df, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe835f6df, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b040
	[0114.981] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8355ac3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe835f6df, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe835f6df, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.981] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe835f6df, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe835f6d2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.982] FindNextFileW (in: hFindFile=0x82b040, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe835f6df, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe835f6d2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.982] FindClose (in: hFindFile=0x82b040 | out: hFindFile=0x82b040) returned 1
	[0114.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.982] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB", lpFilePart=0x0) returned 0x7e
	[0114.982] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8355ac3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe835f6df, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe835f6df, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0114.982] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8355ac3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe835f6df, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe835f6df, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.982] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe835f6df, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe835f6d2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.983] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.983] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0114.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.983] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\Decrypt.txt", lpFilePart=0x0) returned 0x8a
	[0114.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.983] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0114.983] GetFileType (hFile=0x5dc) returned 0x1
	[0114.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.984] GetFileType (hFile=0x5dc) returned 0x1
	[0114.984] WriteFile (in: hFile=0x5dc, lpBuffer=0x26838ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26838ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.985] CloseHandle (hObject=0x5dc) returned 1
	[0114.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US", lpFilePart=0x0) returned 0x7e
	[0114.985] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8372f77, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe837f2eb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe837f2eb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0114.986] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8372f77, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe837f2eb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe837f2eb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.986] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe837f2eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83819b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.986] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe837f2eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83819b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.987] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0114.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US", lpFilePart=0x0) returned 0x7e
	[0114.987] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8372f77, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe837f2eb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe837f2eb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0114.987] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8372f77, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe837f2eb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe837f2eb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.987] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe837f2eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83819b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.987] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.988] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0114.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\Decrypt.txt", lpFilePart=0x0) returned 0x8a
	[0114.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.988] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0114.988] GetFileType (hFile=0x5dc) returned 0x1
	[0114.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.988] GetFileType (hFile=0x5dc) returned 0x1
	[0114.989] WriteFile (in: hFile=0x5dc, lpBuffer=0x26880fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26880fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.990] CloseHandle (hObject=0x5dc) returned 1
	[0114.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es", lpFilePart=0x0) returned 0x7b
	[0114.991] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe839526d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe839eec2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe839eec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0114.992] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe839526d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe839eec2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe839eec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.992] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe839eec2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe839ee72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.992] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe839eec2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe839ee72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.992] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0114.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es", lpFilePart=0x0) returned 0x7b
	[0114.993] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe839526d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe839eec2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe839eec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0114.993] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe839526d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe839eec2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe839eec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.993] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe839eec2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe839ee72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.993] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.993] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0114.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.994] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0114.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.994] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0114.994] GetFileType (hFile=0x5dc) returned 0x1
	[0114.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0114.994] GetFileType (hFile=0x5dc) returned 0x1
	[0114.994] WriteFile (in: hFile=0x5dc, lpBuffer=0x268c83c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268c83c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0114.995] CloseHandle (hObject=0x5dc) returned 1
	[0114.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419", lpFilePart=0x0) returned 0x7f
	[0114.996] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83b0041, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83bea73, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83bea73, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0114.996] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83b0041, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83bea73, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83bea73, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.996] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83bea73, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83c1152, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.996] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83bea73, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83c1152, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0114.997] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0114.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0114.997] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419", lpFilePart=0x0) returned 0x7f
	[0114.997] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83b0041, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83bea73, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83bea73, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0114.997] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83b0041, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83bea73, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83bea73, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.997] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83bea73, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83c1152, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0114.997] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.997] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0114.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0114.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0114.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\Decrypt.txt", lpFilePart=0x0) returned 0x8b
	[0114.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0114.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.008] GetFileType (hFile=0x5dc) returned 0x1
	[0115.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0115.008] GetFileType (hFile=0x5dc) returned 0x1
	[0115.008] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a7cb0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a7cb0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.009] CloseHandle (hObject=0x5dc) returned 1
	[0115.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.009] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et", lpFilePart=0x0) returned 0x7b
	[0115.009] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83d2325, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83d7144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83d7144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0115.011] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83d2325, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83d7144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83d7144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.011] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83d7144, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83d70e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.011] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83d7144, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83d70e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.011] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0115.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.011] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et", lpFilePart=0x0) returned 0x7b
	[0115.012] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83d2325, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83d7144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83d7144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0115.012] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83d2325, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83d7144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83d7144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.012] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83d7144, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83d70e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.012] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.012] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0115.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.013] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0115.013] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.013] GetFileType (hFile=0x5dc) returned 0x1
	[0115.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0115.013] GetFileType (hFile=0x5dc) returned 0x1
	[0115.014] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ac3f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ac3f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.015] CloseHandle (hObject=0x5dc) returned 1
	[0115.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.015] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu", lpFilePart=0x0) returned 0x7b
	[0115.015] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83ed0a8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83f6d0b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83f6d0b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b2c0
	[0115.016] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83ed0a8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83f6d0b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83f6d0b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.016] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83f6d0b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83f6cb2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.016] FindNextFileW (in: hFindFile=0x82b2c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83f6d0b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83f6cb2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.016] FindClose (in: hFindFile=0x82b2c0 | out: hFindFile=0x82b2c0) returned 1
	[0115.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu", lpFilePart=0x0) returned 0x7b
	[0115.017] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83ed0a8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83f6d0b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83f6d0b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b6c0
	[0115.017] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83ed0a8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83f6d0b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83f6d0b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.017] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83f6d0b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83f6cb2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.017] FindNextFileW (in: hFindFile=0x82b6c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.017] FindClose (in: hFindFile=0x82b6c0 | out: hFindFile=0x82b6c0) returned 1
	[0115.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0115.017] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.018] GetFileType (hFile=0x5dc) returned 0x1
	[0115.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0115.018] GetFileType (hFile=0x5dc) returned 0x1
	[0115.018] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b0b30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b0b30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.019] CloseHandle (hObject=0x5dc) returned 1
	[0115.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.019] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa", lpFilePart=0x0) returned 0x7b
	[0115.019] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8407e91, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe841900b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe841900b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b100
	[0115.020] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8407e91, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe841900b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe841900b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.020] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe841900b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe841b6a2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.020] FindNextFileW (in: hFindFile=0x82b100, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe841900b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe841b6a2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.020] FindClose (in: hFindFile=0x82b100 | out: hFindFile=0x82b100) returned 1
	[0115.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.020] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa", lpFilePart=0x0) returned 0x7b
	[0115.020] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8407e91, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe841900b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe841900b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0115.020] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8407e91, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe841900b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe841900b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.020] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe841900b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe841b6a2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.020] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.020] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0115.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.021] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0115.021] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.021] GetFileType (hFile=0x5dc) returned 0x1
	[0115.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0115.021] GetFileType (hFile=0x5dc) returned 0x1
	[0115.021] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b5270*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b5270*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.022] CloseHandle (hObject=0x5dc) returned 1
	[0115.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi", lpFilePart=0x0) returned 0x7b
	[0115.022] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe842c878, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84316cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84316cc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0115.022] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe842c878, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84316cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84316cc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.022] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84316cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8433d42, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.023] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84316cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8433d42, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.023] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0115.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi", lpFilePart=0x0) returned 0x7b
	[0115.023] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe842c878, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84316cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84316cc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0115.023] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe842c878, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84316cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84316cc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.023] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84316cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8433d42, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.023] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.023] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0115.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0115.023] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.024] GetFileType (hFile=0x5dc) returned 0x1
	[0115.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0115.024] GetFileType (hFile=0x5dc) returned 0x1
	[0115.024] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b99b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b99b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.025] CloseHandle (hObject=0x5dc) returned 1
	[0115.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil", lpFilePart=0x0) returned 0x7c
	[0115.026] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8449d3c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe844c461, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe844c461, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b0c0
	[0115.026] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8449d3c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe844c461, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe844c461, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.026] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe844c461, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe844c3e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.026] FindNextFileW (in: hFindFile=0x82b0c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe844c461, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe844c3e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.026] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0115.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.026] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil", lpFilePart=0x0) returned 0x7c
	[0115.026] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8449d3c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe844c461, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe844c461, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0115.026] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8449d3c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe844c461, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe844c461, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.026] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe844c461, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe844c3e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.026] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.027] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0115.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\Decrypt.txt", lpFilePart=0x0) returned 0x88
	[0115.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0115.027] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.027] GetFileType (hFile=0x5dc) returned 0x1
	[0115.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0115.027] GetFileType (hFile=0x5dc) returned 0x1
	[0115.027] WriteFile (in: hFile=0x5dc, lpBuffer=0x26be150*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26be150*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.028] CloseHandle (hObject=0x5dc) returned 1
	[0115.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.029] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr", lpFilePart=0x0) returned 0x7b
	[0115.029] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8469926, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8470e5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8470e5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0115.032] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8469926, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8470e5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8470e5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.033] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8470e5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8475bf2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.033] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8470e5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8475bf2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.033] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0115.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.033] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr", lpFilePart=0x0) returned 0x7b
	[0115.033] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8469926, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8470e5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8470e5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0115.033] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8469926, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8470e5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8470e5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.033] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8470e5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8475bf2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.033] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.033] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0115.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.034] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0115.034] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0115.034] GetFileType (hFile=0x2ec) returned 0x1
	[0115.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0115.034] GetFileType (hFile=0x2ec) returned 0x1
	[0115.034] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c28a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c28a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.035] CloseHandle (hObject=0x2ec) returned 1
	[0115.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.036] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA", lpFilePart=0x0) returned 0x7e
	[0115.036] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe848e306, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8493144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8493144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b480
	[0115.037] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe848e306, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8493144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8493144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.037] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8493144, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84930b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.037] FindNextFileW (in: hFindFile=0x82b480, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8493144, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84930b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.037] FindClose (in: hFindFile=0x82b480 | out: hFindFile=0x82b480) returned 1
	[0115.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.037] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA", lpFilePart=0x0) returned 0x7e
	[0115.037] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe848e306, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8493144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8493144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0115.037] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe848e306, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8493144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8493144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.037] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8493144, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84930b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.037] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.038] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0115.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\Decrypt.txt", lpFilePart=0x0) returned 0x8a
	[0115.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f144) returned 1
	[0115.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0115.038] GetFileType (hFile=0x2ec) returned 0x1
	[0115.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f140) returned 1
	[0115.038] GetFileType (hFile=0x2ec) returned 0x1
	[0115.039] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c70b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c70b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.039] CloseHandle (hObject=0x2ec) returned 1
	[0115.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl", lpFilePart=0x0) returned 0x7b
	[0115.040] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe849cd83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84a42bb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84a42bb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0115.041] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe849cd83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84a42bb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84a42bb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.041] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84a42bb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84a4222, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.041] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84a42bb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84a4222, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.041] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0115.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f244) returned 1
	[0115.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x511f27c) returned 1
	[0115.041] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl", lpFilePart=0x0) returned 0x7b
	[0115.041] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe849cd83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84a42bb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84a42bb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0115.041] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe849cd83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84a42bb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84a42bb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.041] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84a42bb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84a4222, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.042] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.042] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0115.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x511f238) returned 1
	[0115.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.043] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0115.044] GetFileType (hFile=0x2ec) returned 0x1
	[0115.044] GetFileType (hFile=0x2ec) returned 0x1
	[0115.045] WriteFile (in: hFile=0x2ec, lpBuffer=0x26cb860*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cb860*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.046] CloseHandle (hObject=0x2ec) returned 1
	[0115.046] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu", lpFilePart=0x0) returned 0x7b
	[0115.046] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84b7b41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84c8cb7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84c8cb7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0115.047] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84b7b41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84c8cb7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84c8cb7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.047] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84c8cb7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84c8c12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.047] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84c8cb7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84c8c12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.047] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0115.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu", lpFilePart=0x0) returned 0x7b
	[0115.047] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84b7b41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84c8cb7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84c8cb7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0115.047] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84b7b41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84c8cb7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84c8cb7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.047] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84c8cb7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84c8c12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.047] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.048] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0115.048] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.048] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec
	[0115.048] GetFileType (hFile=0x2ec) returned 0x1
	[0115.049] GetFileType (hFile=0x2ec) returned 0x1
	[0115.049] WriteFile (in: hFile=0x2ec, lpBuffer=0x26cffa0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cffa0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.050] CloseHandle (hObject=0x2ec) returned 1
	[0115.050] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi", lpFilePart=0x0) returned 0x7b
	[0115.050] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84d9e2e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84e1327, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84e1327, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0115.057] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84d9e2e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84e1327, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84e1327, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.057] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84e1327, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84e39c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.057] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84e1327, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84e39c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.057] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0115.057] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi", lpFilePart=0x0) returned 0x7b
	[0115.057] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84d9e2e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84e1327, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84e1327, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0115.057] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84d9e2e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84e1327, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84e1327, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.057] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84e1327, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84e39c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.057] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.057] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0115.057] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.057] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.058] GetFileType (hFile=0x5dc) returned 0x1
	[0115.058] GetFileType (hFile=0x5dc) returned 0x1
	[0115.058] WriteFile (in: hFile=0x5dc, lpBuffer=0x26da934*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26da934*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.059] CloseHandle (hObject=0x5dc) returned 1
	[0115.059] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr", lpFilePart=0x0) returned 0x7b
	[0115.059] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84f24cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84f7304, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84f7304, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b280
	[0115.060] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84f24cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84f7304, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84f7304, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.060] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84f7304, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84f7242, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.060] FindNextFileW (in: hFindFile=0x82b280, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84f7304, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84f7242, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.060] FindClose (in: hFindFile=0x82b280 | out: hFindFile=0x82b280) returned 1
	[0115.061] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr", lpFilePart=0x0) returned 0x7b
	[0115.061] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84f24cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84f7304, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84f7304, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b1c0
	[0115.061] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84f24cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84f7304, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84f7304, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.061] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84f7304, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84f7242, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.061] FindNextFileW (in: hFindFile=0x82b1c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.061] FindClose (in: hFindFile=0x82b1c0 | out: hFindFile=0x82b1c0) returned 1
	[0115.061] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.061] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.062] GetFileType (hFile=0x5dc) returned 0x1
	[0115.062] GetFileType (hFile=0x5dc) returned 0x1
	[0115.110] WriteFile (in: hFile=0x5dc, lpBuffer=0x26df074*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26df074*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.111] CloseHandle (hObject=0x5dc) returned 1
	[0115.111] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu", lpFilePart=0x0) returned 0x7b
	[0115.111] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84fe7ef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe850363d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe850363d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0115.112] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84fe7ef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe850363d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe850363d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.112] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe850363d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8505ca2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.112] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe850363d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8505ca2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.112] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0115.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu", lpFilePart=0x0) returned 0x7b
	[0115.112] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84fe7ef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe850363d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe850363d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0115.113] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84fe7ef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe850363d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe850363d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.113] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe850363d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8505ca2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.113] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.113] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0115.113] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.113] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.118] GetFileType (hFile=0x5dc) returned 0x1
	[0115.118] GetFileType (hFile=0x5dc) returned 0x1
	[0115.118] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e5470*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e5470*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.119] CloseHandle (hObject=0x5dc) returned 1
	[0115.119] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy", lpFilePart=0x0) returned 0x7b
	[0115.119] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe851bce8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8520b0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8520b0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b4c0
	[0115.119] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe851bce8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8520b0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8520b0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.119] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8520b0d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8520a52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.119] FindNextFileW (in: hFindFile=0x82b4c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8520b0d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8520a52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.119] FindClose (in: hFindFile=0x82b4c0 | out: hFindFile=0x82b4c0) returned 1
	[0115.119] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy", lpFilePart=0x0) returned 0x7b
	[0115.119] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe851bce8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8520b0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8520b0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0115.119] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe851bce8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8520b0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8520b0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.119] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8520b0d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8520a52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.120] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.120] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0115.120] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.120] GetFileType (hFile=0x5dc) returned 0x1
	[0115.120] GetFileType (hFile=0x5dc) returned 0x1
	[0115.120] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e9bb0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e9bb0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.121] CloseHandle (hObject=0x5dc) returned 1
	[0115.121] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id", lpFilePart=0x0) returned 0x7b
	[0115.121] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85406eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8545507, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8545507, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b300
	[0115.122] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85406eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8545507, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8545507, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.122] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8545507, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8545442, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.122] FindNextFileW (in: hFindFile=0x82b300, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8545507, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8545442, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.122] FindClose (in: hFindFile=0x82b300 | out: hFindFile=0x82b300) returned 1
	[0115.122] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id", lpFilePart=0x0) returned 0x7b
	[0115.123] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85406eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8545507, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8545507, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0115.123] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85406eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8545507, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8545507, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.123] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8545507, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8545442, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.123] FindNextFileW (in: hFindFile=0x82b540, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.123] FindClose (in: hFindFile=0x82b540 | out: hFindFile=0x82b540) returned 1
	[0115.123] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.123] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.123] GetFileType (hFile=0x5dc) returned 0x1
	[0115.123] GetFileType (hFile=0x5dc) returned 0x1
	[0115.123] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ee2f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ee2f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.124] CloseHandle (hObject=0x5dc) returned 1
	[0115.124] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is", lpFilePart=0x0) returned 0x7b
	[0115.125] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8558d8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe855dbac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe855dbac, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0115.125] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8558d8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe855dbac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe855dbac, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.125] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe855dbac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe855dae2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.125] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe855dbac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe855dae2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.125] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0115.126] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is", lpFilePart=0x0) returned 0x7b
	[0115.126] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8558d8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe855dbac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe855dbac, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b380
	[0115.126] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8558d8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe855dbac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe855dbac, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.126] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe855dbac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe855dae2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.126] FindNextFileW (in: hFindFile=0x82b380, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.126] FindClose (in: hFindFile=0x82b380 | out: hFindFile=0x82b380) returned 1
	[0115.126] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.126] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.127] GetFileType (hFile=0x5dc) returned 0x1
	[0115.127] GetFileType (hFile=0x5dc) returned 0x1
	[0115.127] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f2a30*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f2a30*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.128] CloseHandle (hObject=0x5dc) returned 1
	[0115.128] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it", lpFilePart=0x0) returned 0x7b
	[0115.128] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85650da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85677ed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85677ed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0115.129] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85650da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85677ed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85677ed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.129] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85677ed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8569e32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.129] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85677ed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8569e32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.129] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0115.129] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it", lpFilePart=0x0) returned 0x7b
	[0115.130] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85650da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85677ed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85677ed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b400
	[0115.130] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85650da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85677ed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85677ed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.130] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85677ed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8569e32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.130] FindNextFileW (in: hFindFile=0x82b400, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.130] FindClose (in: hFindFile=0x82b400 | out: hFindFile=0x82b400) returned 1
	[0115.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.130] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.131] GetFileType (hFile=0x5dc) returned 0x1
	[0115.131] GetFileType (hFile=0x5dc) returned 0x1
	[0115.131] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f7170*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f7170*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.133] CloseHandle (hObject=0x5dc) returned 1
	[0115.133] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw", lpFilePart=0x0) returned 0x7b
	[0115.133] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe856ed1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8573b41, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8573b41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0115.134] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe856ed1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8573b41, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8573b41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.134] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8573b41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8573a72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.134] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8573b41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8573a72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.134] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0115.134] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw", lpFilePart=0x0) returned 0x7b
	[0115.134] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe856ed1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8573b41, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8573b41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b340
	[0115.135] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe856ed1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8573b41, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8573b41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.135] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8573b41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8573a72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.135] FindNextFileW (in: hFindFile=0x82b340, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.135] FindClose (in: hFindFile=0x82b340 | out: hFindFile=0x82b340) returned 1
	[0115.135] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.135] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.136] GetFileType (hFile=0x5dc) returned 0x1
	[0115.136] GetFileType (hFile=0x5dc) returned 0x1
	[0115.136] WriteFile (in: hFile=0x5dc, lpBuffer=0x26fb8b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fb8b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.137] CloseHandle (hObject=0x5dc) returned 1
	[0115.137] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja", lpFilePart=0x0) returned 0x7b
	[0115.137] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe857b070, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe857fe95, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe857fe95, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82afc0
	[0115.138] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe857b070, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe857fe95, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe857fe95, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.138] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe857fe95, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe857fdc2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.138] FindNextFileW (in: hFindFile=0x82afc0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe857fe95, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe857fdc2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0115.138] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0115.138] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja", lpFilePart=0x0) returned 0x7b
	[0115.138] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe857b070, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe857fe95, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe857fe95, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b5c0
	[0115.138] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe857b070, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe857fe95, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe857fe95, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.138] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe857fe95, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe857fdc2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0115.139] FindNextFileW (in: hFindFile=0x82b5c0, lpFindFileData=0x511efb0 | out: lpFindFileData=0x511efb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.139] FindClose (in: hFindFile=0x82b5c0 | out: hFindFile=0x82b5c0) returned 1
	[0115.139] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x511ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\Decrypt.txt", lpFilePart=0x0) returned 0x87
	[0115.139] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\Decrypt.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5dc
	[0115.140] GetFileType (hFile=0x5dc) returned 0x1
	[0115.140] GetFileType (hFile=0x5dc) returned 0x1
	[0115.140] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ffff0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ffff0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.141] CloseHandle (hObject=0x5dc) returned 1
	[0115.141] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka", nBufferLength=0x105, lpBuffer=0x511ed30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka", lpFilePart=0x0) returned 0x7b
	[0115.141] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\*", lpFindFileData=0x511efa4 | out: lpFindFileData=0x511efa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85873c7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe858e8f6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe858e8f6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82b540
	[0115.148] WriteFile (in: hFile=0x5dc, lpBuffer=0x2704730*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2704730*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.150] WriteFile (in: hFile=0x5dc, lpBuffer=0x2708e70*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2708e70*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.152] WriteFile (in: hFile=0x5dc, lpBuffer=0x270d5b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270d5b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.155] WriteFile (in: hFile=0x5dc, lpBuffer=0x2711cf0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2711cf0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.163] WriteFile (in: hFile=0x5dc, lpBuffer=0x2725450*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2725450*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.165] WriteFile (in: hFile=0x5dc, lpBuffer=0x2729b90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2729b90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.178] WriteFile (in: hFile=0x5dc, lpBuffer=0x2740ed4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2740ed4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.180] WriteFile (in: hFile=0x5dc, lpBuffer=0x2745614*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2745614*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.183] WriteFile (in: hFile=0x5dc, lpBuffer=0x2749d54*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2749d54*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.185] WriteFile (in: hFile=0x5dc, lpBuffer=0x274e494*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274e494*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.194] WriteFile (in: hFile=0x5dc, lpBuffer=0x2752bd4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2752bd4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.204] WriteFile (in: hFile=0x2ec, lpBuffer=0x275b01c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275b01c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.206] WriteFile (in: hFile=0x2ec, lpBuffer=0x275f75c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275f75c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.209] WriteFile (in: hFile=0x2ec, lpBuffer=0x2763e9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2763e9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.211] WriteFile (in: hFile=0x2ec, lpBuffer=0x27685dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27685dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.216] WriteFile (in: hFile=0x5dc, lpBuffer=0x276edac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276edac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.219] WriteFile (in: hFile=0x5dc, lpBuffer=0x27735bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27735bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.222] WriteFile (in: hFile=0x5dc, lpBuffer=0x2777cfc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2777cfc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.224] WriteFile (in: hFile=0x5dc, lpBuffer=0x277c43c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x277c43c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.229] WriteFile (in: hFile=0x5dc, lpBuffer=0x2780b7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2780b7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.232] WriteFile (in: hFile=0x5dc, lpBuffer=0x27852bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27852bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.236] WriteFile (in: hFile=0x5dc, lpBuffer=0x27899fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27899fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.238] WriteFile (in: hFile=0x5dc, lpBuffer=0x278e13c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278e13c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.253] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a8a00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a8a00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.254] WriteFile (in: hFile=0x5dc, lpBuffer=0x27ad140*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ad140*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.257] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b1880*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b1880*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.259] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b5fc0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b5fc0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.273] WriteFile (in: hFile=0x2ec, lpBuffer=0x27ce958*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ce958*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.275] WriteFile (in: hFile=0x2ec, lpBuffer=0x27d3098*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d3098*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.278] WriteFile (in: hFile=0x2ec, lpBuffer=0x27d77d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d77d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.280] WriteFile (in: hFile=0x2ec, lpBuffer=0x27dbf18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27dbf18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.284] WriteFile (in: hFile=0x2ec, lpBuffer=0x27e0658*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e0658*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.285] WriteFile (in: hFile=0x2ec, lpBuffer=0x27e4e68*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e4e68*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.287] WriteFile (in: hFile=0x2ec, lpBuffer=0x27e9678*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27e9678*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.289] WriteFile (in: hFile=0x2ec, lpBuffer=0x27ede88*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ede88*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.292] WriteFile (in: hFile=0x2ec, lpBuffer=0x27f25c8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f25c8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.294] WriteFile (in: hFile=0x2ec, lpBuffer=0x27f6de8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27f6de8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.300] WriteFile (in: hFile=0x2ec, lpBuffer=0x27ffe64*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ffe64*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.303] WriteFile (in: hFile=0x2ec, lpBuffer=0x2804684*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2804684*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.305] WriteFile (in: hFile=0x2ec, lpBuffer=0x2808ea4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2808ea4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.308] WriteFile (in: hFile=0x2ec, lpBuffer=0x280d6c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x280d6c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.310] WriteFile (in: hFile=0x2ec, lpBuffer=0x2811ee4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2811ee4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.313] WriteFile (in: hFile=0x2ec, lpBuffer=0x2816704*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2816704*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.315] WriteFile (in: hFile=0x2ec, lpBuffer=0x281aff4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x281aff4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.318] WriteFile (in: hFile=0x2ec, lpBuffer=0x281f814*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x281f814*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.338] WriteFile (in: hFile=0x2ec, lpBuffer=0x283ff9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x283ff9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.340] WriteFile (in: hFile=0x2ec, lpBuffer=0x28447bc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x28447bc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.344] WriteFile (in: hFile=0x2ec, lpBuffer=0x2848fdc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2848fdc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.346] WriteFile (in: hFile=0x2ec, lpBuffer=0x284d85c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x284d85c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.349] WriteFile (in: hFile=0x2ec, lpBuffer=0x285207c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x285207c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.351] WriteFile (in: hFile=0x2ec, lpBuffer=0x285689c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x285689c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.367] WriteFile (in: hFile=0x2ec, lpBuffer=0x2872ee0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2872ee0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.369] WriteFile (in: hFile=0x2ec, lpBuffer=0x2877700*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2877700*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.371] WriteFile (in: hFile=0x2ec, lpBuffer=0x287bf20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x287bf20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.374] WriteFile (in: hFile=0x2ec, lpBuffer=0x2880740*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2880740*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.385] WriteFile (in: hFile=0x5dc, lpBuffer=0x2612c10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2612c10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.387] WriteFile (in: hFile=0x5dc, lpBuffer=0x2617430*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2617430*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.391] WriteFile (in: hFile=0x5dc, lpBuffer=0x261bc50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261bc50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.394] WriteFile (in: hFile=0x5dc, lpBuffer=0x2620470*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2620470*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.396] WriteFile (in: hFile=0x5dc, lpBuffer=0x2624c90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2624c90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.398] WriteFile (in: hFile=0x5dc, lpBuffer=0x26294b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26294b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.400] WriteFile (in: hFile=0x5dc, lpBuffer=0x262dcd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262dcd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.402] WriteFile (in: hFile=0x5dc, lpBuffer=0x26325c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26325c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.405] WriteFile (in: hFile=0x5dc, lpBuffer=0x2636eb0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2636eb0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.407] WriteFile (in: hFile=0x5dc, lpBuffer=0x263b6d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263b6d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.411] WriteFile (in: hFile=0x2ec, lpBuffer=0x2641d7c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2641d7c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.413] WriteFile (in: hFile=0x2ec, lpBuffer=0x264659c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264659c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.415] WriteFile (in: hFile=0x2ec, lpBuffer=0x264adbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264adbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.427] WriteFile (in: hFile=0x2ec, lpBuffer=0x2665b90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2665b90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.429] WriteFile (in: hFile=0x2ec, lpBuffer=0x266a3b0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266a3b0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.432] WriteFile (in: hFile=0x2ec, lpBuffer=0x266ebd0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x266ebd0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.436] WriteFile (in: hFile=0x2ec, lpBuffer=0x26733f0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26733f0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.438] WriteFile (in: hFile=0x2ec, lpBuffer=0x2677c10*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2677c10*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.440] WriteFile (in: hFile=0x2ec, lpBuffer=0x267c430*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x267c430*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.443] WriteFile (in: hFile=0x2ec, lpBuffer=0x2680d20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2680d20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.448] WriteFile (in: hFile=0x2ec, lpBuffer=0x2685610*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2685610*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.452] WriteFile (in: hFile=0x2ec, lpBuffer=0x2689d50*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2689d50*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.457] WriteFile (in: hFile=0x2ec, lpBuffer=0x268e490*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268e490*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.470] WriteFile (in: hFile=0x2ec, lpBuffer=0x26abde4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26abde4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.481] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b542c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b542c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.511] WriteFile (in: hFile=0x2ec, lpBuffer=0x26bbf3c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26bbf3c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.514] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c067c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c067c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.516] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c4dbc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c4dbc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.518] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c94fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c94fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.520] WriteFile (in: hFile=0x2ec, lpBuffer=0x26cdc3c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cdc3c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.522] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d237c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d237c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.525] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d6b1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26d6b1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.538] WriteFile (in: hFile=0x2ec, lpBuffer=0x26ddb9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ddb9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.540] WriteFile (in: hFile=0x2ec, lpBuffer=0x26e22dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e22dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.541] WriteFile (in: hFile=0x2ec, lpBuffer=0x26e6a1c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e6a1c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.543] WriteFile (in: hFile=0x2ec, lpBuffer=0x26eb15c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26eb15c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.558] WriteFile (in: hFile=0x2ec, lpBuffer=0x26f4af4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f4af4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.560] WriteFile (in: hFile=0x2ec, lpBuffer=0x26f9234*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f9234*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.562] WriteFile (in: hFile=0x2ec, lpBuffer=0x26fd974*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fd974*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.566] WriteFile (in: hFile=0x2ec, lpBuffer=0x27020b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27020b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.576] WriteFile (in: hFile=0x2ec, lpBuffer=0x270d6a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x270d6a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.579] WriteFile (in: hFile=0x2ec, lpBuffer=0x2711de0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2711de0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.581] WriteFile (in: hFile=0x2ec, lpBuffer=0x2716520*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2716520*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.583] WriteFile (in: hFile=0x2ec, lpBuffer=0x271ac60*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271ac60*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.585] WriteFile (in: hFile=0x2ec, lpBuffer=0x271f3a0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x271f3a0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.587] WriteFile (in: hFile=0x2ec, lpBuffer=0x2723bb0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2723bb0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.589] WriteFile (in: hFile=0x2ec, lpBuffer=0x27283c0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27283c0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.591] WriteFile (in: hFile=0x2ec, lpBuffer=0x272cb00*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272cb00*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.600] WriteFile (in: hFile=0x2ec, lpBuffer=0x27332d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27332d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.602] WriteFile (in: hFile=0x2ec, lpBuffer=0x2737a18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2737a18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.604] WriteFile (in: hFile=0x2ec, lpBuffer=0x273c158*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273c158*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.606] WriteFile (in: hFile=0x2ec, lpBuffer=0x2740898*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2740898*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.613] WriteFile (in: hFile=0x2ec, lpBuffer=0x2758018*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2758018*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.615] WriteFile (in: hFile=0x2ec, lpBuffer=0x275c758*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275c758*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.617] WriteFile (in: hFile=0x2ec, lpBuffer=0x2760e98*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2760e98*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.620] WriteFile (in: hFile=0x2ec, lpBuffer=0x27655d8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27655d8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.622] WriteFile (in: hFile=0x2ec, lpBuffer=0x2769d18*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2769d18*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.688] WriteFile (in: hFile=0x2ec, lpBuffer=0x278c5fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278c5fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.689] WriteFile (in: hFile=0x2ec, lpBuffer=0x2790e0c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2790e0c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.692] WriteFile (in: hFile=0x2ec, lpBuffer=0x279576c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279576c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.694] WriteFile (in: hFile=0x2ec, lpBuffer=0x279a0cc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279a0cc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.697] WriteFile (in: hFile=0x2ec, lpBuffer=0x279ea2c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279ea2c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.699] WriteFile (in: hFile=0x2ec, lpBuffer=0x27a338c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a338c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.701] WriteFile (in: hFile=0x2ec, lpBuffer=0x27a7cec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a7cec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.704] WriteFile (in: hFile=0x2ec, lpBuffer=0x27ac64c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ac64c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.707] WriteFile (in: hFile=0x2ec, lpBuffer=0x27b0fac*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b0fac*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.709] WriteFile (in: hFile=0x2ec, lpBuffer=0x27b590c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27b590c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.711] WriteFile (in: hFile=0x2ec, lpBuffer=0x27ba26c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27ba26c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.713] WriteFile (in: hFile=0x2ec, lpBuffer=0x27bebcc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27bebcc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.715] WriteFile (in: hFile=0x2ec, lpBuffer=0x27c352c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c352c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.717] WriteFile (in: hFile=0x2ec, lpBuffer=0x27c7e8c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27c7e8c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.719] WriteFile (in: hFile=0x2ec, lpBuffer=0x27cc7ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27cc7ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.722] WriteFile (in: hFile=0x2ec, lpBuffer=0x27d114c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27d114c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.799] WriteFile (in: hFile=0x2ec, lpBuffer=0x261382c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261382c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.800] WriteFile (in: hFile=0x2ec, lpBuffer=0x261818c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261818c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.899] WriteFile (in: hFile=0x5dc, lpBuffer=0x261ccf4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x261ccf4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.911] WriteFile (in: hFile=0x5dc, lpBuffer=0x2621654*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2621654*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.913] WriteFile (in: hFile=0x5dc, lpBuffer=0x2625fb4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2625fb4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.919] WriteFile (in: hFile=0x5dc, lpBuffer=0x262a914*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262a914*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.921] WriteFile (in: hFile=0x5dc, lpBuffer=0x262f274*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x262f274*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.924] WriteFile (in: hFile=0x5dc, lpBuffer=0x2633bd4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2633bd4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.980] WriteFile (in: hFile=0x5dc, lpBuffer=0x2638534*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2638534*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.982] WriteFile (in: hFile=0x5dc, lpBuffer=0x263ce94*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x263ce94*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.985] WriteFile (in: hFile=0x5dc, lpBuffer=0x26417f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26417f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.988] WriteFile (in: hFile=0x5dc, lpBuffer=0x2646154*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2646154*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.990] WriteFile (in: hFile=0x5dc, lpBuffer=0x264aab4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264aab4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.994] WriteFile (in: hFile=0x5dc, lpBuffer=0x264f414*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x264f414*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0115.995] WriteFile (in: hFile=0x5dc, lpBuffer=0x2653d74*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2653d74*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.054] WriteFile (in: hFile=0x2ec, lpBuffer=0x268cae4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x268cae4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.057] WriteFile (in: hFile=0x2ec, lpBuffer=0x2691444*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2691444*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.060] WriteFile (in: hFile=0x2ec, lpBuffer=0x2695da4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2695da4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.062] WriteFile (in: hFile=0x2ec, lpBuffer=0x269a704*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269a704*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.065] WriteFile (in: hFile=0x2ec, lpBuffer=0x269f064*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x269f064*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.068] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a39c4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a39c4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.071] WriteFile (in: hFile=0x2ec, lpBuffer=0x26a8324*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26a8324*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.073] WriteFile (in: hFile=0x2ec, lpBuffer=0x26acc84*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26acc84*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.075] WriteFile (in: hFile=0x2ec, lpBuffer=0x26b15e4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b15e4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.077] WriteFile (in: hFile=0x2ec, lpBuffer=0x26b5f44*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26b5f44*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.080] WriteFile (in: hFile=0x2ec, lpBuffer=0x26ba8a4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ba8a4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.088] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c10e0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c10e0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.090] WriteFile (in: hFile=0x2ec, lpBuffer=0x26c5a40*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26c5a40*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.204] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ca4e8*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ca4e8*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.207] WriteFile (in: hFile=0x5dc, lpBuffer=0x26cee48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cee48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.213] WriteFile (in: hFile=0x2ec, lpBuffer=0x26e527c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e527c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.216] WriteFile (in: hFile=0x2ec, lpBuffer=0x26e9bdc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26e9bdc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.218] WriteFile (in: hFile=0x2ec, lpBuffer=0x26ee53c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26ee53c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.221] WriteFile (in: hFile=0x2ec, lpBuffer=0x26f2e9c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f2e9c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.226] WriteFile (in: hFile=0x2ec, lpBuffer=0x26f77fc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26f77fc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.229] WriteFile (in: hFile=0x2ec, lpBuffer=0x26fc1dc*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26fc1dc*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.240] WriteFile (in: hFile=0x2ec, lpBuffer=0x2716cc0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2716cc0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.259] WriteFile (in: hFile=0x2ec, lpBuffer=0x27214d4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27214d4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.267] WriteFile (in: hFile=0x2ec, lpBuffer=0x2727308*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2727308*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.269] WriteFile (in: hFile=0x2ec, lpBuffer=0x272c284*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x272c284*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.276] WriteFile (in: hFile=0x2ec, lpBuffer=0x2730f48*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2730f48*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.278] WriteFile (in: hFile=0x2ec, lpBuffer=0x2736224*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2736224*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.281] WriteFile (in: hFile=0x2ec, lpBuffer=0x273ab20*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273ab20*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.285] WriteFile (in: hFile=0x2ec, lpBuffer=0x273ee04*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x273ee04*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.287] WriteFile (in: hFile=0x2ec, lpBuffer=0x2743710*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2743710*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.291] WriteFile (in: hFile=0x2ec, lpBuffer=0x27479f4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27479f4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.293] WriteFile (in: hFile=0x2ec, lpBuffer=0x274c250*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x274c250*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.307] WriteFile (in: hFile=0x2ec, lpBuffer=0x2755a6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2755a6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.310] WriteFile (in: hFile=0x2ec, lpBuffer=0x2759c90*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2759c90*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.330] WriteFile (in: hFile=0x2ec, lpBuffer=0x275e154*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x275e154*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.341] WriteFile (in: hFile=0x2ec, lpBuffer=0x276c538*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x276c538*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.359] WriteFile (in: hFile=0x2ec, lpBuffer=0x278df6c*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x278df6c*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.360] WriteFile (in: hFile=0x2ec, lpBuffer=0x27929d0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27929d0*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.362] WriteFile (in: hFile=0x2ec, lpBuffer=0x27973ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27973ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.364] WriteFile (in: hFile=0x2ec, lpBuffer=0x279d1ec*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x279d1ec*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.368] WriteFile (in: hFile=0x2ec, lpBuffer=0x27a1840*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x27a1840*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0116.369] SleepEx (dwMilliseconds=0xea60, bAlertable=1) returned 0x0
	[0126.548] WriteFile (in: hFile=0x588, lpBuffer=0x26cc4b4*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x511f1c0, lpOverlapped=0x0 | out: lpBuffer=0x26cc4b4*, lpNumberOfBytesWritten=0x511f1c0*=0x2ba, lpOverlapped=0x0) returned 1
	[0126.549] SleepEx (dwMilliseconds=0xea60, bAlertable=1) returned 0x0
	[0136.689] SleepEx (dwMilliseconds=0x7530, bAlertable=1) returned 0x0
	[0146.698] SleepEx (dwMilliseconds=0x7530, bAlertable=1) returned 0x0
	[0156.988] SleepEx (dwMilliseconds=0x7530, bAlertable=1) returned 0x0
	[0167.579] SleepEx (dwMilliseconds=0x7530, bAlertable=1) returned 0x0
	[0177.632] SleepEx (dwMilliseconds=0x7530, bAlertable=1) returned 0x0
	[0187.702] SleepEx (dwMilliseconds=0x7530, bAlertable=1) 

Thread:
	id = 12
	os_tid = 0xd74


Thread:
	id = 13
	os_tid = 0xea8

	[0078.271] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0078.271] CoGetContextToken (in: pToken=0x540f4e4 | out: pToken=0x540f4e4) returned 0x0
	[0078.271] CObjectContext::QueryInterface () returned 0x0
	[0078.271] CObjectContext::GetCurrentThreadType () returned 0x0
	[0078.271] Release () returned 0x0
	[0078.271] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1
	[0078.272] CoUninitialize () 
	[0078.272] RoInitialize () returned 0x1
	[0078.272] RoUninitialize () returned 0x0
	[0078.278] GetFullPathNameW (in: lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\$WINRE_BACKUP_PARTITION.MARKER", lpFilePart=0x0) returned 0x21
	[0078.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0078.278] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0078.279] GetFileType (hFile=0x5dc) returned 0x1
	[0078.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0078.279] GetFileType (hFile=0x5dc) returned 0x1
	[0078.279] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x0
	[0078.279] CloseHandle (hObject=0x5dc) returned 1
	[0078.286] CryptImportKey (in: hProv=0x7f93c0, pbData=0x249f298, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b740) returned 1
	[0078.288] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0078.288] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0078.288] CryptDuplicateKey (in: hKey=0x82b740, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0078.289] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0078.289] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x249f368*=0x1, dwFlags=0x0) returned 1
	[0078.289] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x249f334, dwFlags=0x0) returned 1
	[0078.290] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x249f378*, pdwDataLen=0x540efd4*=0x10, dwBufLen=0x10 | out: pbData=0x249f378*, pdwDataLen=0x540efd4*=0x10) returned 1
	[0078.290] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x249f46c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x249f46c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0078.290] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0078.290] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0078.290] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0078.290] GetFullPathNameW (in: lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\$WINRE_BACKUP_PARTITION.MARKER", lpFilePart=0x0) returned 0x21
	[0078.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0078.290] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0078.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0078.292] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0078.303] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.347] GetFullPathNameW (in: lpFileName="C:\\bootmgr", nBufferLength=0x105, lpBuffer=0x540eb04, lpFilePart=0x0 | out: lpBuffer="C:\\bootmgr", lpFilePart=0x0) returned 0xa
	[0078.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540f004) returned 1
	[0078.347] GetFileAttributesExW (in: lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), fInfoLevelId=0x0, lpFileInformation=0x249fc80 | out: lpFileInformation=0x249fc80*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da)) returned 1
	[0078.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540f000) returned 1
	[0078.350] GetFullPathNameW (in: lpFileName="C:\\bootmgr", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\bootmgr", lpFilePart=0x0) returned 0xa
	[0078.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0078.350] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5f4
	[0078.350] GetFileType (hFile=0x5f4) returned 0x1
	[0078.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0078.350] GetFileType (hFile=0x5f4) returned 0x1
	[0078.350] GetFileSize (in: hFile=0x5f4, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x607da
	[0078.351] ReadFile (in: hFile=0x5f4, lpBuffer=0x34494c8, nNumberOfBytesToRead=0x607da, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesRead=0x540efcc*=0x607da, lpOverlapped=0x0) returned 1
	[0078.357] CloseHandle (hObject=0x5f4) returned 1
	[0078.357] CryptDestroyKey (hKey=0x82b740) returned 1
	[0078.357] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0078.357] CryptImportKey (in: hProv=0x7f93c0, pbData=0x249fe68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0078.357] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0078.357] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0078.357] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0078.357] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0078.358] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x249ff20*=0x1, dwFlags=0x0) returned 1
	[0078.358] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x249feec, dwFlags=0x0) returned 1
	[0078.362] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34a9cc0*, pdwDataLen=0x540efd4*=0x607e0, dwBufLen=0x607e0 | out: pbData=0x34a9cc0*, pdwDataLen=0x540efd4*=0x607e0) returned 1
	[0078.363] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x249ff30*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x249ff30*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0078.363] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0078.363] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0078.363] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0078.363] GetFullPathNameW (in: lpFileName="C:\\bootmgr", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\bootmgr", lpFilePart=0x0) returned 0xa
	[0078.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0078.363] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0078.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0078.365] GetFullPathNameW (in: lpFileName="C:\\BOOTNXT", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\BOOTNXT", lpFilePart=0x0) returned 0xa
	[0078.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0078.365] GetFileAttributesExW (in: lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), fInfoLevelId=0x0, lpFileInformation=0x24a03f8 | out: lpFileInformation=0x24a03f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1)) returned 1
	[0078.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0078.375] GetFullPathNameW (in: lpFileName="C:\\BOOTNXT", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\BOOTNXT", lpFilePart=0x0) returned 0xa
	[0078.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0078.375] CreateFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5f4
	[0078.376] GetFileType (hFile=0x5f4) returned 0x1
	[0078.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0078.376] GetFileType (hFile=0x5f4) returned 0x1
	[0078.376] GetFileSize (in: hFile=0x5f4, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1
	[0078.376] ReadFile (in: hFile=0x5f4, lpBuffer=0x24a0560, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x24a0560*, lpNumberOfBytesRead=0x540efcc*=0x1, lpOverlapped=0x0) returned 1
	[0078.376] CloseHandle (hObject=0x5f4) returned 1
	[0078.377] CryptDestroyKey (hKey=0x82b480) returned 1
	[0078.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0078.377] CryptImportKey (in: hProv=0x7f93c0, pbData=0x24a15fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0078.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0078.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0078.377] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0078.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0078.377] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x24a16b4*=0x1, dwFlags=0x0) returned 1
	[0078.377] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x24a1680, dwFlags=0x0) returned 1
	[0078.377] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x24a16c4*, pdwDataLen=0x540efd4*=0x10, dwBufLen=0x10 | out: pbData=0x24a16c4*, pdwDataLen=0x540efd4*=0x10) returned 1
	[0078.377] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x24a16e0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x24a16e0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0078.377] CryptDestroyKey (hKey=0x82b040) returned 1
	[0078.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0078.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0078.377] GetFullPathNameW (in: lpFileName="C:\\BOOTNXT", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\BOOTNXT", lpFilePart=0x0) returned 0xa
	[0078.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0078.377] CreateFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0078.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0078.379] GetFullPathNameW (in: lpFileName="C:\\BOOTSECT.BAK", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\BOOTSECT.BAK", lpFilePart=0x0) returned 0xf
	[0078.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0078.379] GetFileAttributesExW (in: lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), fInfoLevelId=0x0, lpFileInformation=0x24a1af0 | out: lpFileInformation=0x24a1af0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0078.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0078.379] GetFullPathNameW (in: lpFileName="C:\\BOOTSECT.BAK", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\BOOTSECT.BAK", lpFilePart=0x0) returned 0xf
	[0078.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0078.379] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5f4
	[0078.379] GetFileType (hFile=0x5f4) returned 0x1
	[0078.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0078.379] GetFileType (hFile=0x5f4) returned 0x1
	[0078.379] GetFileSize (in: hFile=0x5f4, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0078.380] ReadFile (in: hFile=0x5f4, lpBuffer=0x24a1c70, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x24a1c70*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0078.383] CloseHandle (hObject=0x5f4) returned 1
	[0078.383] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0078.383] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0078.383] CryptImportKey (in: hProv=0x7f93c0, pbData=0x24a3d0c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0078.383] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0078.383] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0078.383] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0078.383] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0078.383] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x24a3dc4*=0x1, dwFlags=0x0) returned 1
	[0078.383] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x24a3d90, dwFlags=0x0) returned 1
	[0078.384] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x24a3dd4*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x24a3dd4*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0078.384] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x24a5df0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x24a5df0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0078.384] CryptDestroyKey (hKey=0x82b300) returned 1
	[0078.384] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0078.384] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0078.384] GetFullPathNameW (in: lpFileName="C:\\BOOTSECT.BAK", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\BOOTSECT.BAK", lpFilePart=0x0) returned 0xf
	[0078.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0078.384] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0078.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0078.385] GetFullPathNameW (in: lpFileName="C:\\hiberfil.sys", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\hiberfil.sys", lpFilePart=0x0) returned 0xf
	[0078.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0078.385] GetFileAttributesExW (in: lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), fInfoLevelId=0x0, lpFileInformation=0x24a6230 | out: lpFileInformation=0x24a6230*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0078.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0078.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ee5c) returned 1
	[0078.385] FindFirstFileW (in: lpFileName="C:\\hiberfil.sys", lpFindFileData=0x540eb9c | out: lpFindFileData=0x540eb9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 0x82b200
	[0078.386] FindClose (in: hFindFile=0x82b200 | out: hFindFile=0x82b200) returned 1
	[0078.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ee58) returned 1
	[0078.432] GetFullPathNameW (in: lpFileName="C:\\hiberfil.sys", nBufferLength=0x105, lpBuffer=0x540e800, lpFilePart=0x0 | out: lpBuffer="C:\\hiberfil.sys", lpFilePart=0x0) returned 0xf
	[0078.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ed44) returned 1
	[0078.432] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0078.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d720) returned 1
	[0078.536] GetFullPathNameW (in: lpFileName="C:\\pagefile.sys", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\pagefile.sys", lpFilePart=0x0) returned 0xf
	[0078.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0078.536] GetFileAttributesExW (in: lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), fInfoLevelId=0x0, lpFileInformation=0x24ac468 | out: lpFileInformation=0x24ac468*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0078.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0078.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ee5c) returned 1
	[0078.536] FindFirstFileW (in: lpFileName="C:\\pagefile.sys", lpFindFileData=0x540eb9c | out: lpFindFileData=0x540eb9c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 0x82b0c0
	[0078.537] FindClose (in: hFindFile=0x82b0c0 | out: hFindFile=0x82b0c0) returned 1
	[0078.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ee58) returned 1
	[0078.537] GetFullPathNameW (in: lpFileName="C:\\pagefile.sys", nBufferLength=0x105, lpBuffer=0x540e800, lpFilePart=0x0 | out: lpBuffer="C:\\pagefile.sys", lpFilePart=0x0) returned 0xf
	[0078.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ed44) returned 1
	[0078.537] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0078.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d720) returned 1
	[0078.538] GetFullPathNameW (in: lpFileName="C:\\swapfile.sys", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\swapfile.sys", lpFilePart=0x0) returned 0xf
	[0078.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0078.538] GetFileAttributesExW (in: lpFileName="C:\\swapfile.sys" (normalized: "c:\\swapfile.sys"), fInfoLevelId=0x0, lpFileInformation=0x24aca68 | out: lpFileInformation=0x24aca68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0078.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0078.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ee5c) returned 1
	[0078.539] FindFirstFileW (in: lpFileName="C:\\swapfile.sys", lpFindFileData=0x540eb9c | out: lpFindFileData=0x540eb9c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 0x82afc0
	[0078.539] FindClose (in: hFindFile=0x82afc0 | out: hFindFile=0x82afc0) returned 1
	[0078.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ee58) returned 1
	[0078.539] GetFullPathNameW (in: lpFileName="C:\\swapfile.sys", nBufferLength=0x105, lpBuffer=0x540e800, lpFilePart=0x0 | out: lpBuffer="C:\\swapfile.sys", lpFilePart=0x0) returned 0xf
	[0078.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ed44) returned 1
	[0078.539] CreateFileW (lpFileName="C:\\swapfile.sys" (normalized: "c:\\swapfile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0078.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d720) returned 1
	[0078.540] SleepEx (dwMilliseconds=0x3e8, bAlertable=1) returned 0x0
	[0079.542] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DHtmlHeader.html", lpFilePart=0x0) returned 0x26
	[0079.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0079.542] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), fInfoLevelId=0x0, lpFileInformation=0x24b3ccc | out: lpFileInformation=0x24b3ccc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6)) returned 1
	[0079.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0079.543] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DHtmlHeader.html", lpFilePart=0x0) returned 0x26
	[0079.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0079.543] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0079.543] GetFileType (hFile=0x2ec) returned 0x1
	[0079.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0079.543] GetFileType (hFile=0x2ec) returned 0x1
	[0079.543] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3ef6
	[0079.543] ReadFile (in: hFile=0x2ec, lpBuffer=0x24b3ebc, nNumberOfBytesToRead=0x3ef6, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x24b3ebc*, lpNumberOfBytesRead=0x540efcc*=0x3ef6, lpOverlapped=0x0) returned 1
	[0079.553] CloseHandle (hObject=0x2ec) returned 1
	[0079.553] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0079.553] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0079.553] CryptImportKey (in: hProv=0x7f93c0, pbData=0x24b7e50, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0079.553] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0079.553] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0079.553] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0079.553] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0079.553] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x24b7f08*=0x1, dwFlags=0x0) returned 1
	[0079.553] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x24b7ed4, dwFlags=0x0) returned 1
	[0079.553] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x24b7f18*, pdwDataLen=0x540efd4*=0x3f00, dwBufLen=0x3f00 | out: pbData=0x24b7f18*, pdwDataLen=0x540efd4*=0x3f00) returned 1
	[0079.553] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x24bbe24*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x24bbe24*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0079.553] CryptDestroyKey (hKey=0x82b100) returned 1
	[0079.553] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0079.553] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0079.553] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DHtmlHeader.html", lpFilePart=0x0) returned 0x26
	[0079.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0079.553] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0079.554] GetFileType (hFile=0x2ec) returned 0x1
	[0079.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0079.554] GetFileType (hFile=0x2ec) returned 0x1
	[0079.554] WriteFile (in: hFile=0x2ec, lpBuffer=0x24b7f18*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x24b7f18*, lpNumberOfBytesWritten=0x540efc0*=0x3f00, lpOverlapped=0x0) returned 1
	[0079.555] CloseHandle (hObject=0x2ec) returned 1
	[0079.556] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DHtmlHeader.html", lpFilePart=0x0) returned 0x26
	[0079.556] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DHtmlHeader.html id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0079.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0079.556] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x69beb8f6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3f00)) returned 1
	[0079.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0079.556] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0079.557] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DisplayIcon.ico", lpFilePart=0x0) returned 0x25
	[0079.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0079.557] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), fInfoLevelId=0x0, lpFileInformation=0x24bc174 | out: lpFileInformation=0x24bc174*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5)) returned 1
	[0079.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0079.557] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DisplayIcon.ico", lpFilePart=0x0) returned 0x25
	[0079.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0079.557] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0079.557] GetFileType (hFile=0x2ec) returned 0x1
	[0079.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0079.558] GetFileType (hFile=0x2ec) returned 0x1
	[0079.558] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x159d5
	[0079.558] ReadFile (in: hFile=0x2ec, lpBuffer=0x350a4c0, nNumberOfBytesToRead=0x159d5, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x350a4c0*, lpNumberOfBytesRead=0x540efcc*=0x159d5, lpOverlapped=0x0) returned 1
	[0079.568] CloseHandle (hObject=0x2ec) returned 1
	[0079.568] CryptDestroyKey (hKey=0x82b340) returned 1
	[0079.568] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0079.568] CryptImportKey (in: hProv=0x7f93c0, pbData=0x24bc3e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0079.568] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0079.568] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0079.568] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0079.568] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0079.569] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x24bc49c*=0x1, dwFlags=0x0) returned 1
	[0079.569] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x24bc468, dwFlags=0x0) returned 1
	[0079.570] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x351feb8*, pdwDataLen=0x540efd4*=0x159e0, dwBufLen=0x159e0 | out: pbData=0x351feb8*, pdwDataLen=0x540efd4*=0x159e0) returned 1
	[0079.570] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x24bc4ac*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x24bc4ac*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0079.570] CryptDestroyKey (hKey=0x82b540) returned 1
	[0079.570] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0079.570] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0079.570] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DisplayIcon.ico", lpFilePart=0x0) returned 0x25
	[0079.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0079.570] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0079.571] GetFileType (hFile=0x2ec) returned 0x1
	[0079.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0079.571] GetFileType (hFile=0x2ec) returned 0x1
	[0079.571] WriteFile (in: hFile=0x2ec, lpBuffer=0x351feb8*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x351feb8*, lpNumberOfBytesWritten=0x540efc0*=0x159e0, lpOverlapped=0x0) returned 1
	[0079.573] CloseHandle (hObject=0x2ec) returned 1
	[0079.575] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DisplayIcon.ico", lpFilePart=0x0) returned 0x25
	[0079.575] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DisplayIcon.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x54
	[0079.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0079.575] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x69c37c43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x159e0)) returned 1
	[0079.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0079.575] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), lpNewFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0079.575] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\header.bmp", lpFilePart=0x0) returned 0x20
	[0079.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0079.576] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), fInfoLevelId=0x0, lpFileInformation=0x24bc7f0 | out: lpFileInformation=0x24bc7f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c)) returned 1
	[0079.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0079.576] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\header.bmp", lpFilePart=0x0) returned 0x20
	[0079.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0079.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0079.577] GetFileType (hFile=0x2ec) returned 0x1
	[0079.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0079.577] GetFileType (hFile=0x2ec) returned 0x1
	[0079.577] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xe2c
	[0079.577] ReadFile (in: hFile=0x2ec, lpBuffer=0x24bd7e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x24bd7e8*, lpNumberOfBytesRead=0x540efcc*=0xe2c, lpOverlapped=0x0) returned 1
	[0079.592] CloseHandle (hObject=0x2ec) returned 1
	[0079.592] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0079.592] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0079.592] CryptImportKey (in: hProv=0x7f93c0, pbData=0x24c7098, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0079.592] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0079.592] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0079.592] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0079.592] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0079.592] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x24c7150*=0x1, dwFlags=0x0) returned 1
	[0079.592] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x24c711c, dwFlags=0x0) returned 1
	[0079.592] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x24c7160*, pdwDataLen=0x540efd4*=0xe30, dwBufLen=0xe30 | out: pbData=0x24c7160*, pdwDataLen=0x540efd4*=0xe30) returned 1
	[0079.593] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x24c7f9c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x24c7f9c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0079.593] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0079.593] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0079.593] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0079.593] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\header.bmp", lpFilePart=0x0) returned 0x20
	[0079.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0079.593] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0079.593] GetFileType (hFile=0x2ec) returned 0x1
	[0079.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0079.594] GetFileType (hFile=0x2ec) returned 0x1
	[0079.594] WriteFile (in: hFile=0x2ec, lpBuffer=0x24c8088*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x24c8088*, lpNumberOfBytesWritten=0x540ef94*=0xe30, lpOverlapped=0x0) returned 1
	[0079.594] CloseHandle (hObject=0x2ec) returned 1
	[0079.595] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\header.bmp", lpFilePart=0x0) returned 0x20
	[0079.595] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\header.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x4f
	[0079.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0079.595] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x69c5df89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xe30)) returned 1
	[0079.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0079.595] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\header.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\header.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0079.596] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core.mzz", lpFilePart=0x0) returned 0x24
	[0079.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0079.596] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), fInfoLevelId=0x0, lpFileInformation=0x24c92b0 | out: lpFileInformation=0x24c92b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b)) returned 1
	[0079.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0079.596] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz", nBufferLength=0x105, lpBuffer=0x540e800, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core.mzz", lpFilePart=0x0) returned 0x24
	[0079.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ed44) returned 1
	[0079.596] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0079.596] GetFileType (hFile=0x2ec) returned 0x1
	[0079.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ed40) returned 1
	[0079.596] GetFileType (hFile=0x2ec) returned 0x1
	[0079.596] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x540ee4c | out: lpFileSizeHigh=0x540ee4c*=0x0) returned 0xad1384b
	[0079.703] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x0
	[0079.703] ReadFile (in: hFile=0x2ec, lpBuffer=0x35358b8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35358b8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0079.806] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0079.806] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0079.806] CryptImportKey (in: hProv=0x7f93c0, pbData=0x24e5f18, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b100) returned 1
	[0079.806] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0079.806] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0079.806] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b480) returned 1
	[0079.806] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0079.806] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x24e5fd0*=0x1, dwFlags=0x0) returned 1
	[0079.807] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x24e5f9c, dwFlags=0x0) returned 1
	[0079.890] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34494c8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x34494c8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0079.891] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2483874*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2483874*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0079.891] CryptDestroyKey (hKey=0x82b480) returned 1
	[0079.891] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0079.891] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0079.891] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xb71b0
	[0079.891] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0080.211] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x0
	[0080.212] WriteFile (in: hFile=0x2ec, lpBuffer=0x34494c8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0080.322] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=4500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x44aa20
	[0080.323] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a374e8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3a374e8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0080.392] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=750016, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xb71c0
	[0080.393] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0080.481] CryptDestroyKey (hKey=0x82b100) returned 1
	[0080.481] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0080.482] CryptImportKey (in: hProv=0x7f93c0, pbData=0x252c7e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b440) returned 1
	[0080.482] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0080.482] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0080.482] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b1c0) returned 1
	[0080.482] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0080.482] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x252c89c*=0x1, dwFlags=0x0) returned 1
	[0080.482] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x252c868, dwFlags=0x0) returned 1
	[0080.490] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3aee6b8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3aee6b8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0080.491] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x252c8ac*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x252c8ac*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0080.491] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0080.491] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0080.491] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0080.491] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=5250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x501bd0
	[0080.491] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0080.697] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=4500016, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x44aa30
	[0080.697] WriteFile (in: hFile=0x2ec, lpBuffer=0x3aee6b8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3aee6b8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0080.713] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=9000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x895440
	[0080.713] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ba5898, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3ba5898*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0080.721] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=5250032, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x501bf0
	[0080.721] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0080.853] CryptDestroyKey (hKey=0x82b440) returned 1
	[0080.853] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0080.853] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25671d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b1c0) returned 1
	[0080.853] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0080.853] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0080.853] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b480) returned 1
	[0080.853] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0080.853] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2567288*=0x1, dwFlags=0x0) returned 1
	[0080.853] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2567254, dwFlags=0x0) returned 1
	[0080.861] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c5ca68*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3c5ca68*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0080.862] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2567298*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2567298*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0080.862] CryptDestroyKey (hKey=0x82b480) returned 1
	[0080.862] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0080.862] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0080.862] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=9750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x94c5f0
	[0080.862] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0080.977] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=9000032, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x895460
	[0080.977] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c5ca68*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3c5ca68*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0081.139] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=13500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xcdfe60
	[0081.139] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d13c48, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3d13c48*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0081.148] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=9750048, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x94c620
	[0081.149] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0081.318] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0081.318] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0081.319] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25b4e40, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b380) returned 1
	[0081.319] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0081.319] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0081.319] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b5c0) returned 1
	[0081.319] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0081.319] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x25b4ef8*=0x1, dwFlags=0x0) returned 1
	[0081.319] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x25b4ec4, dwFlags=0x0) returned 1
	[0081.464] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3dcae18*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3dcae18*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0081.465] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25b4f08*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x25b4f08*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0081.465] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0081.465] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0081.465] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0081.465] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=14250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xd97010
	[0081.465] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0081.642] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=13500048, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xcdfe90
	[0081.642] WriteFile (in: hFile=0x2ec, lpBuffer=0x3dcae18*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3dcae18*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0081.750] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=18000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x112a880
	[0081.750] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e81ff8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3e81ff8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0081.755] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=14250064, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xd97050
	[0081.755] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0082.157] CryptDestroyKey (hKey=0x82b380) returned 1
	[0082.157] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0082.157] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25d8068, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b1c0) returned 1
	[0082.157] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0082.157] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0082.157] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b280) returned 1
	[0082.157] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0082.157] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x25d8120*=0x1, dwFlags=0x0) returned 1
	[0082.157] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x25d80ec, dwFlags=0x0) returned 1
	[0082.166] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f391c8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3f391c8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0082.167] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25d8130*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x25d8130*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0082.167] CryptDestroyKey (hKey=0x82b280) returned 1
	[0082.167] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0082.167] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0082.167] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=18750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x11e1a30
	[0082.167] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0082.338] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=18000064, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x112a8c0
	[0082.338] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f391c8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3f391c8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0082.350] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=22500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x15752a0
	[0082.350] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ff03a8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3ff03a8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0082.477] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=18750080, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x11e1a80
	[0082.477] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0082.669] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0082.669] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0082.669] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2623260, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b4c0) returned 1
	[0082.669] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0082.669] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0082.669] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b540) returned 1
	[0082.669] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0082.669] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2623318*=0x1, dwFlags=0x0) returned 1
	[0082.669] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26232e4, dwFlags=0x0) returned 1
	[0082.677] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40a7578*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x40a7578*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0082.678] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2623328*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2623328*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0082.678] CryptDestroyKey (hKey=0x82b540) returned 1
	[0082.678] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0082.678] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0082.678] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=23250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x162c450
	[0082.678] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0082.946] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=22500080, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x15752f0
	[0082.946] WriteFile (in: hFile=0x2ec, lpBuffer=0x40a7578*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x40a7578*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0082.962] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=27000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x19bfcc0
	[0082.962] ReadFile (in: hFile=0x2ec, lpBuffer=0x415e758, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x415e758*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0082.971] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=23250096, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x162c4b0
	[0082.971] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0083.104] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0083.104] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0083.112] CryptImportKey (in: hProv=0x7f93c0, pbData=0x24f369c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b6c0) returned 1
	[0083.112] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0083.112] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0083.112] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b540) returned 1
	[0083.112] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0083.112] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x24f3754*=0x1, dwFlags=0x0) returned 1
	[0083.112] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x24f3720, dwFlags=0x0) returned 1
	[0083.120] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4215928*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x4215928*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0083.131] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x24f8b30*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x24f8b30*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0083.132] CryptDestroyKey (hKey=0x82b540) returned 1
	[0083.132] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0083.132] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0083.132] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=27750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x1a76e70
	[0083.132] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0083.234] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=27000096, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x19bfd20
	[0083.234] WriteFile (in: hFile=0x2ec, lpBuffer=0x4215928*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x4215928*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0083.248] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=31500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x1e0a6e0
	[0083.248] ReadFile (in: hFile=0x2ec, lpBuffer=0x42ccb08, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x42ccb08*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0083.253] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=27750112, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x1a76ee0
	[0083.253] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0083.501] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0083.501] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0083.501] CryptImportKey (in: hProv=0x7f93c0, pbData=0x252f818, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b1c0) returned 1
	[0083.501] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0083.501] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0083.603] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b6c0) returned 1
	[0083.603] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0083.603] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2565748*=0x1, dwFlags=0x0) returned 1
	[0083.603] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2565714, dwFlags=0x0) returned 1
	[0083.611] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4383cd8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x4383cd8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0083.612] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2565758*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2565758*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0083.612] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0083.612] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0083.612] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0083.612] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=32250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x1ec1890
	[0083.612] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0083.761] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=31500112, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x1e0a750
	[0083.761] WriteFile (in: hFile=0x2ec, lpBuffer=0x4383cd8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x4383cd8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0083.777] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=36000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x2255100
	[0083.777] ReadFile (in: hFile=0x2ec, lpBuffer=0x5781018, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x5781018*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0083.791] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=32250128, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x1ec1910
	[0083.791] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0083.878] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0083.878] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0083.878] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25c3bd4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b400) returned 1
	[0083.878] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0083.878] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0083.878] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b4c0) returned 1
	[0083.878] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0083.878] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x25c3c8c*=0x1, dwFlags=0x0) returned 1
	[0083.878] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x25c3c58, dwFlags=0x0) returned 1
	[0083.886] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x58381e8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x58381e8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0083.887] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25c3c9c*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x25c3c9c*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0083.887] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0083.887] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0083.887] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0083.887] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=36750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x230c2b0
	[0083.887] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0083.978] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=36000128, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x2255180
	[0083.978] WriteFile (in: hFile=0x2ec, lpBuffer=0x58381e8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x58381e8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0084.090] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=40500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x269fb20
	[0084.090] ReadFile (in: hFile=0x2ec, lpBuffer=0x58ef3c8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x58ef3c8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0084.099] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=36750144, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x230c340
	[0084.099] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0084.215] CryptDestroyKey (hKey=0x82b400) returned 1
	[0084.215] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0084.215] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263e684, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b540) returned 1
	[0084.215] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0084.215] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0084.215] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b5c0) returned 1
	[0084.215] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0084.216] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x263e73c*=0x1, dwFlags=0x0) returned 1
	[0084.216] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x263e708, dwFlags=0x0) returned 1
	[0084.224] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x59a6598*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x59a6598*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0084.224] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263e74c*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x263e74c*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0084.224] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0084.224] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0084.224] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0084.224] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=41250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x2756cd0
	[0084.225] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0084.365] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=40500144, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x269fbb0
	[0084.366] WriteFile (in: hFile=0x2ec, lpBuffer=0x59a6598*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x59a6598*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0084.464] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=45000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x2aea540
	[0084.464] ReadFile (in: hFile=0x2ec, lpBuffer=0x5a5d778, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x5a5d778*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0084.571] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=41250160, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x2756d70
	[0084.571] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0084.713] CryptDestroyKey (hKey=0x82b540) returned 1
	[0084.713] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0084.713] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2695a08, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b280) returned 1
	[0084.713] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0084.713] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0084.713] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b4c0) returned 1
	[0084.713] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0084.713] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2695ac0*=0x1, dwFlags=0x0) returned 1
	[0084.713] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2695a8c, dwFlags=0x0) returned 1
	[0084.721] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5b14948*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x5b14948*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0084.722] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2695ad0*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2695ad0*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0084.722] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0084.722] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0084.722] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0084.722] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=45750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x2ba16f0
	[0084.722] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0085.134] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=45000160, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x2aea5e0
	[0085.134] WriteFile (in: hFile=0x2ec, lpBuffer=0x5b14948*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x5b14948*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0085.248] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=49500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x2f34f60
	[0085.248] ReadFile (in: hFile=0x2ec, lpBuffer=0x5bcbb28, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x5bcbb28*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0085.270] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=45750176, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x2ba17a0
	[0085.270] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0085.485] CryptDestroyKey (hKey=0x82b280) returned 1
	[0085.485] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0085.485] CryptImportKey (in: hProv=0x7f93c0, pbData=0x24eff7c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b380) returned 1
	[0085.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0085.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0085.485] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b2c0) returned 1
	[0085.486] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0085.486] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x24f0034*=0x1, dwFlags=0x0) returned 1
	[0085.486] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x24f0000, dwFlags=0x0) returned 1
	[0085.494] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c82cf8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x5c82cf8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0085.495] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x24f0044*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x24f0044*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0085.495] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0085.495] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0085.495] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0085.495] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=50250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x2fec110
	[0085.495] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0085.668] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=49500176, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x2f35010
	[0085.668] WriteFile (in: hFile=0x2ec, lpBuffer=0x5c82cf8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x5c82cf8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0085.682] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=54000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x337f980
	[0085.683] ReadFile (in: hFile=0x2ec, lpBuffer=0x5d39ed8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x5d39ed8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0085.697] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=50250192, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x2fec1d0
	[0085.697] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0085.822] CryptDestroyKey (hKey=0x82b380) returned 1
	[0085.822] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0085.822] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2517bf0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b400) returned 1
	[0085.822] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0085.822] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0085.822] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b100) returned 1
	[0085.822] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0085.822] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2517ca8*=0x1, dwFlags=0x0) returned 1
	[0085.822] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2517c74, dwFlags=0x0) returned 1
	[0085.910] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df10a8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x5df10a8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0085.911] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2544a20*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2544a20*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0085.911] CryptDestroyKey (hKey=0x82b100) returned 1
	[0085.911] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0085.911] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0085.911] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=54750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x3436b30
	[0085.911] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0085.953] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=54000192, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x337fa40
	[0085.953] WriteFile (in: hFile=0x2ec, lpBuffer=0x5df10a8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x5df10a8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0086.433] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=58500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x37ca3a0
	[0086.433] ReadFile (in: hFile=0x2ec, lpBuffer=0x5ea8288, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x5ea8288*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0086.445] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=54750208, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x3436c00
	[0086.445] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0086.561] CryptDestroyKey (hKey=0x82b400) returned 1
	[0086.561] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0086.561] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2530ad8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b380) returned 1
	[0086.561] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0086.561] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0086.561] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b6c0) returned 1
	[0086.562] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0086.562] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2530b90*=0x1, dwFlags=0x0) returned 1
	[0086.562] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2530b5c, dwFlags=0x0) returned 1
	[0086.563] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5781018*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x5781018*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0086.564] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2530ba0*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2530ba0*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0086.564] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0086.564] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0086.564] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0086.564] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=59250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x3881550
	[0086.564] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0086.726] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=58500208, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x37ca470
	[0086.726] WriteFile (in: hFile=0x2ec, lpBuffer=0x5781018*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x5781018*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0086.735] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=63000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x3c14dc0
	[0086.735] ReadFile (in: hFile=0x2ec, lpBuffer=0x58381f8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x58381f8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0086.836] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=59250224, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x3881630
	[0086.837] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0087.134] CryptDestroyKey (hKey=0x82b380) returned 1
	[0087.134] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0087.134] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25eea78, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b4c0) returned 1
	[0087.134] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0087.134] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0087.134] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b440) returned 1
	[0087.134] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0087.134] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x25eeb30*=0x1, dwFlags=0x0) returned 1
	[0087.135] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x25eeafc, dwFlags=0x0) returned 1
	[0087.136] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x58ef3c8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x58ef3c8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0087.137] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25eeb40*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x25eeb40*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0087.137] CryptDestroyKey (hKey=0x82b440) returned 1
	[0087.137] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0087.137] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0087.137] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=63750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x3ccbf70
	[0087.137] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0087.280] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=63000224, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x3c14ea0
	[0087.280] WriteFile (in: hFile=0x2ec, lpBuffer=0x58ef3c8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x58ef3c8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0087.285] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=67500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x405f7e0
	[0087.285] ReadFile (in: hFile=0x2ec, lpBuffer=0x59a65a8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x59a65a8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0087.299] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=63750240, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x3ccc060
	[0087.299] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0087.418] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0087.418] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0087.418] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2638a88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b100) returned 1
	[0087.418] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0087.418] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0087.418] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b440) returned 1
	[0087.418] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0087.419] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2638b40*=0x1, dwFlags=0x0) returned 1
	[0087.419] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2638b0c, dwFlags=0x0) returned 1
	[0087.420] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5a5d778*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x5a5d778*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0087.421] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2638b50*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2638b50*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0087.421] CryptDestroyKey (hKey=0x82b440) returned 1
	[0087.421] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0087.421] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0087.421] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=68250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x4116990
	[0087.421] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0087.565] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=67500240, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x405f8d0
	[0087.565] WriteFile (in: hFile=0x2ec, lpBuffer=0x5a5d778*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x5a5d778*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0087.575] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=72000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x44aa200
	[0087.575] ReadFile (in: hFile=0x2ec, lpBuffer=0x5b14958, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x5b14958*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0087.584] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=68250256, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x4116a90
	[0087.584] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0087.728] CryptDestroyKey (hKey=0x82b100) returned 1
	[0087.728] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0087.728] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268bc64, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b340) returned 1
	[0087.728] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0087.728] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0087.728] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b1c0) returned 1
	[0087.728] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0087.728] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x268bd1c*=0x1, dwFlags=0x0) returned 1
	[0087.728] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x268bce8, dwFlags=0x0) returned 1
	[0087.889] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5781018*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x5781018*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0087.890] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x24b5594*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x24b5594*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0087.890] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0087.890] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0087.890] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0087.890] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=72750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x45613b0
	[0087.890] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0087.992] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=72000256, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x44aa300
	[0087.992] WriteFile (in: hFile=0x2ec, lpBuffer=0x5781018*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x5781018*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0088.000] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=76500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x48f4c20
	[0088.000] ReadFile (in: hFile=0x2ec, lpBuffer=0x58381f8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x58381f8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0088.057] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=72750272, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x45614c0
	[0088.057] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0088.200] CryptDestroyKey (hKey=0x82b340) returned 1
	[0088.200] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0088.200] CryptImportKey (in: hProv=0x7f93c0, pbData=0x250609c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b300) returned 1
	[0088.200] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0088.200] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0088.200] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b5c0) returned 1
	[0088.200] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0088.200] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2506154*=0x1, dwFlags=0x0) returned 1
	[0088.200] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2506120, dwFlags=0x0) returned 1
	[0088.202] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x58ef3c8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x58ef3c8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0088.203] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2506164*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2506164*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0088.203] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0088.203] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0088.203] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0088.203] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=77250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x49abdd0
	[0088.203] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0088.272] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=76500272, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x48f4d30
	[0088.272] WriteFile (in: hFile=0x2ec, lpBuffer=0x58ef3c8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x58ef3c8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0088.278] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=81000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x4d3f640
	[0088.278] ReadFile (in: hFile=0x2ec, lpBuffer=0x59a65a8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x59a65a8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0088.284] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=77250288, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x49abef0
	[0088.284] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0088.378] CryptDestroyKey (hKey=0x82b300) returned 1
	[0088.378] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0088.378] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2513c88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b6c0) returned 1
	[0088.378] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0088.378] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0088.378] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b540) returned 1
	[0088.378] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0088.378] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2513d40*=0x1, dwFlags=0x0) returned 1
	[0088.378] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2513d0c, dwFlags=0x0) returned 1
	[0088.385] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3aee6b8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3aee6b8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0088.386] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2513d50*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2513d50*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0088.386] CryptDestroyKey (hKey=0x82b540) returned 1
	[0088.386] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0088.386] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0088.386] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=81750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x4df67f0
	[0088.386] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0088.500] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=81000288, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x4d3f760
	[0088.500] WriteFile (in: hFile=0x2ec, lpBuffer=0x3aee6b8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3aee6b8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0088.590] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=85500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x518a060
	[0088.590] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ba5898, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3ba5898*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0088.608] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=81750304, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x4df6920
	[0088.609] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0088.719] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0088.719] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0088.719] CryptImportKey (in: hProv=0x7f93c0, pbData=0x255d400, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b400) returned 1
	[0088.719] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0088.719] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0088.719] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82afc0) returned 1
	[0088.719] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0088.719] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x255d4b8*=0x1, dwFlags=0x0) returned 1
	[0088.719] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x255d484, dwFlags=0x0) returned 1
	[0088.728] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c5ca68*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3c5ca68*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0088.729] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x255d4c8*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x255d4c8*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0088.729] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0088.729] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0088.729] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0088.729] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=86250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x5241210
	[0088.729] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0089.144] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=85500304, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x518a190
	[0089.144] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c5ca68*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3c5ca68*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0089.230] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=90000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x55d4a80
	[0089.230] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d13c48, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3d13c48*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0089.241] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=86250320, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x5241350
	[0089.241] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0089.341] CryptDestroyKey (hKey=0x82b400) returned 1
	[0089.341] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0089.341] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ad608, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b280) returned 1
	[0089.341] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0089.341] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0089.341] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b1c0) returned 1
	[0089.341] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0089.341] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26ad6c0*=0x1, dwFlags=0x0) returned 1
	[0089.341] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26ad68c, dwFlags=0x0) returned 1
	[0089.350] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3dcae18*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3dcae18*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0089.351] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ad6d0*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x26ad6d0*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0089.351] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0089.351] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0089.351] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0089.351] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=90750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x568bc30
	[0089.351] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0089.508] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=90000320, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x55d4bc0
	[0089.508] WriteFile (in: hFile=0x2ec, lpBuffer=0x3dcae18*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3dcae18*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0089.623] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=94500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x5a1f4a0
	[0089.623] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e81ff8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3e81ff8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0089.629] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=90750336, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x568bd80
	[0089.629] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0089.749] CryptDestroyKey (hKey=0x82b280) returned 1
	[0089.749] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0089.749] CryptImportKey (in: hProv=0x7f93c0, pbData=0x255f4a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82afc0) returned 1
	[0089.749] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0089.749] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0089.749] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b6c0) returned 1
	[0089.749] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0089.749] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x255f560*=0x1, dwFlags=0x0) returned 1
	[0089.749] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x255f52c, dwFlags=0x0) returned 1
	[0089.759] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f391c8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3f391c8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0089.760] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x255f570*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x255f570*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0089.760] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0089.760] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0089.760] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0089.760] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=95250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x5ad6650
	[0089.760] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0089.852] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=94500336, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x5a1f5f0
	[0089.852] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f391c8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3f391c8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0089.866] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=99000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x5e69ec0
	[0089.866] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ff03a8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3ff03a8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0089.880] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=95250352, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x5ad67b0
	[0089.880] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0089.956] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0089.956] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0089.956] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25addcc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b280) returned 1
	[0089.956] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0089.956] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0089.956] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b4c0) returned 1
	[0089.956] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0089.956] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x25ade84*=0x1, dwFlags=0x0) returned 1
	[0089.956] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x25ade50, dwFlags=0x0) returned 1
	[0089.965] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40a7578*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x40a7578*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0089.966] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25ade94*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x25ade94*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0089.966] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0089.966] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0089.966] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0089.966] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=99750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x5f21070
	[0089.966] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0090.104] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=99000352, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x5e6a020
	[0090.104] WriteFile (in: hFile=0x2ec, lpBuffer=0x40a7578*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x40a7578*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0090.182] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=103500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x62b48e0
	[0090.182] ReadFile (in: hFile=0x2ec, lpBuffer=0x3aee6b8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3aee6b8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0090.191] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=99750368, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x5f211e0
	[0090.191] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0090.267] CryptDestroyKey (hKey=0x82b280) returned 1
	[0090.267] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0090.267] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25590f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b1c0) returned 1
	[0090.267] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0090.267] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0090.267] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b540) returned 1
	[0090.267] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0090.267] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x25591ac*=0x1, dwFlags=0x0) returned 1
	[0090.267] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2559178, dwFlags=0x0) returned 1
	[0090.269] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ba5888*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3ba5888*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0090.270] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25591bc*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x25591bc*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0090.270] CryptDestroyKey (hKey=0x82b540) returned 1
	[0090.270] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0090.270] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0090.270] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=104250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x636ba90
	[0090.270] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0090.365] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=103500368, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x62b4a50
	[0090.365] WriteFile (in: hFile=0x2ec, lpBuffer=0x3ba5888*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3ba5888*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0090.373] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=108000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x66ff300
	[0090.373] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c5ca68, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3c5ca68*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0090.383] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=104250384, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x636bc10
	[0090.383] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0090.536] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0090.536] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0090.537] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25c7a30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b100) returned 1
	[0090.537] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0090.537] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0090.537] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b080) returned 1
	[0090.537] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0090.537] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x25c7ae8*=0x1, dwFlags=0x0) returned 1
	[0090.537] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x25c7ab4, dwFlags=0x0) returned 1
	[0090.539] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3d13c38*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3d13c38*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0090.540] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25c7af8*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x25c7af8*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0090.540] CryptDestroyKey (hKey=0x82b080) returned 1
	[0090.540] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0090.540] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0090.540] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=108750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x67b64b0
	[0090.540] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0090.666] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=108000384, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x66ff480
	[0090.666] WriteFile (in: hFile=0x2ec, lpBuffer=0x3d13c38*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3d13c38*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0090.672] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=112500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x6b49d20
	[0090.672] ReadFile (in: hFile=0x2ec, lpBuffer=0x3dcae18, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3dcae18*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0090.685] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=108750400, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x67b6640
	[0090.685] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0090.761] CryptDestroyKey (hKey=0x82b100) returned 1
	[0090.761] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0090.761] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2631d30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b1c0) returned 1
	[0090.761] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0090.761] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0090.761] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b440) returned 1
	[0090.761] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0090.761] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2631de8*=0x1, dwFlags=0x0) returned 1
	[0090.761] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2631db4, dwFlags=0x0) returned 1
	[0090.763] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e81fe8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3e81fe8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0090.764] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2631df8*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2631df8*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0090.764] CryptDestroyKey (hKey=0x82b440) returned 1
	[0090.764] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0090.764] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0090.764] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=113250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x6c00ed0
	[0090.764] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0090.849] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=112500400, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x6b49eb0
	[0090.849] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e81fe8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3e81fe8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0090.859] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=117000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x6f94740
	[0090.859] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f391c8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3f391c8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0090.867] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=113250416, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x6c01070
	[0090.867] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0090.928] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0090.928] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0090.928] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26778d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b300) returned 1
	[0090.928] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0090.928] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0090.928] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b340) returned 1
	[0090.928] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0090.928] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x2677990*=0x1, dwFlags=0x0) returned 1
	[0090.928] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x267795c, dwFlags=0x0) returned 1
	[0090.986] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3aee6b8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3aee6b8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0090.987] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x24f3778*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x24f3778*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0090.987] CryptDestroyKey (hKey=0x82b340) returned 1
	[0090.987] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0090.987] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0090.987] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=117750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x704b8f0
	[0090.987] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0091.126] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=117000416, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x6f948e0
	[0091.126] WriteFile (in: hFile=0x2ec, lpBuffer=0x3aee6b8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3aee6b8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0091.134] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=121500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x73df160
	[0091.135] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ba5898, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3ba5898*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0091.145] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=117750432, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x704baa0
	[0091.145] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0091.213] CryptDestroyKey (hKey=0x82b300) returned 1
	[0091.213] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0091.213] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2543ac8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b0c0) returned 1
	[0091.213] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0091.213] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0091.213] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b1c0) returned 1
	[0091.213] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0091.213] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2543b80*=0x1, dwFlags=0x0) returned 1
	[0091.213] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2543b4c, dwFlags=0x0) returned 1
	[0091.215] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c5ca68*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3c5ca68*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0091.217] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2543b90*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2543b90*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0091.217] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0091.217] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0091.217] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0091.217] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=122250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x7496310
	[0091.217] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0091.258] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=121500432, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x73df310
	[0091.258] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c5ca68*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3c5ca68*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0091.266] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=126000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x7829b80
	[0091.266] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d13c48, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3d13c48*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0091.271] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=122250448, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x74964d0
	[0091.271] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0091.319] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0091.319] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0091.319] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25499f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b6c0) returned 1
	[0091.319] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0091.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0091.320] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b480) returned 1
	[0091.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0091.320] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2549aa8*=0x1, dwFlags=0x0) returned 1
	[0091.320] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2549a74, dwFlags=0x0) returned 1
	[0091.326] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ff0398*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3ff0398*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0091.326] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2549ab8*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2549ab8*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0091.326] CryptDestroyKey (hKey=0x82b480) returned 1
	[0091.326] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0091.326] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0091.326] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=126750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x78e0d30
	[0091.327] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0091.696] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=126000448, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x7829d40
	[0091.696] WriteFile (in: hFile=0x2ec, lpBuffer=0x3ff0398*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3ff0398*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0091.702] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=130500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x7c745a0
	[0091.702] ReadFile (in: hFile=0x2ec, lpBuffer=0x3dcae18, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3dcae18*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0091.718] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=126750464, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x78e0f00
	[0091.718] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0091.757] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0091.757] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0091.757] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2550310, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b1c0) returned 1
	[0091.757] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0091.757] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0091.757] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82afc0) returned 1
	[0091.757] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0091.757] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x25503c8*=0x1, dwFlags=0x0) returned 1
	[0091.757] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2550394, dwFlags=0x0) returned 1
	[0091.765] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40a7578*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x40a7578*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0091.765] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25503d8*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x25503d8*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0091.766] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0091.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0091.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0091.766] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=131250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x7d2b750
	[0091.766] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0094.051] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=130500464, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x7c74770
	[0094.051] WriteFile (in: hFile=0x2ec, lpBuffer=0x40a7578*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x40a7578*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0094.067] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=135000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x80befc0
	[0094.067] ReadFile (in: hFile=0x2ec, lpBuffer=0x415e758, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x415e758*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0094.075] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=131250480, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x7d2b930
	[0094.075] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0094.156] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0094.156] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0094.156] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2560084, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b1c0) returned 1
	[0094.156] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0094.156] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0094.156] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b6c0) returned 1
	[0094.156] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0094.156] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x256013c*=0x1, dwFlags=0x0) returned 1
	[0094.156] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2560108, dwFlags=0x0) returned 1
	[0094.164] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4215928*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x4215928*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0094.165] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x256014c*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x256014c*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0094.165] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0094.165] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0094.165] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0094.165] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=135750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x8176170
	[0094.165] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0094.203] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=135000480, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x80bf1a0
	[0094.203] WriteFile (in: hFile=0x2ec, lpBuffer=0x4215928*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x4215928*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0094.218] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=139500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x85099e0
	[0094.218] ReadFile (in: hFile=0x2ec, lpBuffer=0x42ccb08, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x42ccb08*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0094.221] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=135750496, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x8176360
	[0094.221] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0094.262] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0094.262] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0094.263] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25602c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b400) returned 1
	[0094.263] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0094.263] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0094.263] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b440) returned 1
	[0094.263] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0094.263] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2560378*=0x1, dwFlags=0x0) returned 1
	[0094.263] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2560344, dwFlags=0x0) returned 1
	[0094.271] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4383cd8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x4383cd8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0094.272] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2560388*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2560388*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0094.272] CryptDestroyKey (hKey=0x82b440) returned 1
	[0094.272] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0094.272] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0094.272] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=140250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x85c0b90
	[0094.272] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0095.113] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=139500496, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x8509bd0
	[0095.113] WriteFile (in: hFile=0x2ec, lpBuffer=0x4383cd8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x4383cd8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0095.160] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=144000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x8954400
	[0095.160] ReadFile (in: hFile=0x2ec, lpBuffer=0x5781018, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x5781018*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0095.242] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=140250512, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x85c0d90
	[0095.242] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0095.355] CryptDestroyKey (hKey=0x82b400) returned 1
	[0095.355] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0095.355] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2690ad4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b1c0) returned 1
	[0095.356] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0095.356] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0095.356] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b200) returned 1
	[0095.356] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0095.356] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2690b8c*=0x1, dwFlags=0x0) returned 1
	[0095.356] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2690b58, dwFlags=0x0) returned 1
	[0095.364] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x58381e8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x58381e8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0095.365] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690b9c*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2690b9c*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0095.365] CryptDestroyKey (hKey=0x82b200) returned 1
	[0095.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0095.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0095.365] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=144750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x8a0b5b0
	[0095.365] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0095.529] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=144000512, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x8954600
	[0095.529] WriteFile (in: hFile=0x2ec, lpBuffer=0x58381e8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x58381e8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0095.652] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=148500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x8d9ee20
	[0095.653] ReadFile (in: hFile=0x2ec, lpBuffer=0x58ef3c8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x58ef3c8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0095.660] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=144750528, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x8a0b7c0
	[0095.660] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0095.758] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0095.758] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0095.758] CryptImportKey (in: hProv=0x7f93c0, pbData=0x259ea14, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b4c0) returned 1
	[0095.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0095.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0095.759] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b1c0) returned 1
	[0095.759] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0095.759] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x259eacc*=0x1, dwFlags=0x0) returned 1
	[0095.759] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x259ea98, dwFlags=0x0) returned 1
	[0095.766] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3aee6b8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3aee6b8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0095.767] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x259eadc*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x259eadc*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0095.767] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0095.767] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0095.767] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0095.767] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=149250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x8e55fd0
	[0095.767] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0095.814] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=148500528, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x8d9f030
	[0095.814] WriteFile (in: hFile=0x2ec, lpBuffer=0x3aee6b8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3aee6b8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0095.856] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=153000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x91e9840
	[0095.856] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ba5898, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3ba5898*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0095.898] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=149250544, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x8e561f0
	[0095.898] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0095.978] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0095.978] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0095.978] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260c870, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b2c0) returned 1
	[0095.978] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0095.978] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0095.978] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b540) returned 1
	[0095.978] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0095.978] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x260c928*=0x1, dwFlags=0x0) returned 1
	[0095.978] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x260c8f4, dwFlags=0x0) returned 1
	[0095.986] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c5ca68*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3c5ca68*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0095.987] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260c938*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x260c938*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0095.987] CryptDestroyKey (hKey=0x82b540) returned 1
	[0095.987] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0095.987] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0095.987] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=153750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x92a09f0
	[0095.987] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0096.144] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=153000544, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x91e9a60
	[0096.144] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c5ca68*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3c5ca68*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0096.173] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=157500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x9634260
	[0096.173] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d13c48, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3d13c48*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0096.178] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=153750560, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x92a0c20
	[0096.179] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0096.249] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0096.249] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0096.249] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b2d10, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b2c0) returned 1
	[0096.249] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0096.249] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0096.249] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b400) returned 1
	[0096.249] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0096.249] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x26b2dc8*=0x1, dwFlags=0x0) returned 1
	[0096.249] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26b2d94, dwFlags=0x0) returned 1
	[0096.257] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3dcae18*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3dcae18*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0096.258] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b2dd8*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x26b2dd8*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0096.258] CryptDestroyKey (hKey=0x82b400) returned 1
	[0096.258] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0096.258] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0096.258] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=158250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x96eb410
	[0096.258] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0096.356] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=157500560, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x9634490
	[0096.356] WriteFile (in: hFile=0x2ec, lpBuffer=0x3dcae18*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3dcae18*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0096.404] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=162000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x9a7ec80
	[0096.404] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e81ff8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3e81ff8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0096.417] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=158250576, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x96eb650
	[0096.417] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0096.495] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0096.495] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0096.495] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277cce8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b040) returned 1
	[0096.495] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0096.495] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0096.495] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b100) returned 1
	[0096.495] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0096.495] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x277cda0*=0x1, dwFlags=0x0) returned 1
	[0096.495] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x277cd6c, dwFlags=0x0) returned 1
	[0096.506] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f391c8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3f391c8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0096.506] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277cdb0*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x277cdb0*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0096.506] CryptDestroyKey (hKey=0x82b100) returned 1
	[0096.506] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0096.506] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0096.506] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=162750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x9b35e30
	[0096.507] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0096.538] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=162000576, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x9a7eec0
	[0096.539] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f391c8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3f391c8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0096.555] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=166500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x9ec96a0
	[0096.555] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ff03a8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3ff03a8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0096.602] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=162750592, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x9b36080
	[0096.602] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0096.670] CryptDestroyKey (hKey=0x82b040) returned 1
	[0096.670] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0096.671] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27db1d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b2c0) returned 1
	[0096.671] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0096.671] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0096.671] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b280) returned 1
	[0096.671] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0096.671] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27db290*=0x1, dwFlags=0x0) returned 1
	[0096.671] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27db25c, dwFlags=0x0) returned 1
	[0096.722] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3aee6b8*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3aee6b8*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0096.723] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x252f2ec*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x252f2ec*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0096.723] CryptDestroyKey (hKey=0x82b280) returned 1
	[0096.723] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0096.723] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0096.723] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=167250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x9f80850
	[0096.723] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0096.833] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=166500592, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x9ec98f0
	[0096.834] WriteFile (in: hFile=0x2ec, lpBuffer=0x3aee6b8*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3aee6b8*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0096.842] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=171000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xa3140c0
	[0096.842] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ba5898, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3ba5898*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0096.846] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=167250608, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0x9f80ab0
	[0096.846] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0096.924] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0096.924] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0096.924] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2620538, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b2c0) returned 1
	[0096.924] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0096.924] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0096.924] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b5c0) returned 1
	[0096.924] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0096.924] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26205f0*=0x1, dwFlags=0x0) returned 1
	[0096.924] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26205bc, dwFlags=0x0) returned 1
	[0096.926] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c5ca68*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3c5ca68*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0096.927] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2620600*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x2620600*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0096.927] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0096.927] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0096.927] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0096.927] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=171750000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xa3cb270
	[0096.927] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0096.963] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=171000608, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xa314320
	[0096.963] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c5ca68*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3c5ca68*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0096.969] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=175500000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xa75eae0
	[0096.969] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d13c48, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3d13c48*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0097.050] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=171750624, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xa3cb4e0
	[0097.050] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0097.129] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0097.129] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0097.129] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d41ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ed70 | out: phKey=0x540ed70*=0x82b480) returned 1
	[0097.129] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0097.129] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0097.129] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ed60 | out: phKey=0x540ed60*=0x82b440) returned 1
	[0097.129] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0097.129] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26d4264*=0x1, dwFlags=0x0) returned 1
	[0097.129] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26d4230, dwFlags=0x0) returned 1
	[0097.131] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3dcae18*, pdwDataLen=0x540edcc*=0xb71c0, dwBufLen=0xb71c0 | out: pbData=0x3dcae18*, pdwDataLen=0x540edcc*=0xb71c0) returned 1
	[0097.132] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d4274*, pdwDataLen=0x540edd4*=0x0, dwBufLen=0x10 | out: pbData=0x26d4274*, pdwDataLen=0x540edd4*=0x10) returned 1
	[0097.132] CryptDestroyKey (hKey=0x82b440) returned 1
	[0097.132] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0097.132] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0097.132] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=176250000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xa815c90
	[0097.132] ReadFile (in: hFile=0x2ec, lpBuffer=0x35eca88, nNumberOfBytesToRead=0x393870, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesRead=0x540edf8*=0x393870, lpOverlapped=0x0) returned 1
	[0097.189] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=175500624, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xa75ed50
	[0097.189] WriteFile (in: hFile=0x2ec, lpBuffer=0x3dcae18*, nNumberOfBytesToWrite=0xb71c0, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x3dcae18*, lpNumberOfBytesWritten=0x540ee00*=0xb71c0, lpOverlapped=0x0) returned 1
	[0097.199] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=180000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xaba9500
	[0097.199] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e81ff8, nNumberOfBytesToRead=0xb71b0, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x3e81ff8*, lpNumberOfBytesRead=0x540edf8*=0xb71b0, lpOverlapped=0x0) returned 1
	[0097.207] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=176250640, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xa815f10
	[0097.207] WriteFile (in: hFile=0x2ec, lpBuffer=0x35eca88*, nNumberOfBytesToWrite=0x393870, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x35eca88*, lpNumberOfBytesWritten=0x540ee00*=0x393870, lpOverlapped=0x0) returned 1
	[0097.257] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=180000000, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xaba9500
	[0097.257] ReadFile (in: hFile=0x2ec, lpBuffer=0x40a7578, nNumberOfBytesToRead=0x16a34b, lpNumberOfBytesRead=0x540edf8, lpOverlapped=0x0 | out: lpBuffer=0x40a7578*, lpNumberOfBytesRead=0x540edf8*=0x16a34b, lpOverlapped=0x0) returned 1
	[0097.311] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=180000640, lpDistanceToMoveHigh=0x540edd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x540edd8*=0) returned 0xaba9780
	[0097.311] WriteFile (in: hFile=0x2ec, lpBuffer=0x40a7578*, nNumberOfBytesToWrite=0x16a34b, lpNumberOfBytesWritten=0x540ee00, lpOverlapped=0x0 | out: lpBuffer=0x40a7578*, lpNumberOfBytesWritten=0x540ee00*=0x16a34b, lpOverlapped=0x0) returned 1
	[0097.328] CloseHandle (hObject=0x2ec) returned 1
	[0097.836] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz", nBufferLength=0x105, lpBuffer=0x540e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core.mzz", lpFilePart=0x0) returned 0x24
	[0097.836] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core.mzz id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x53
	[0097.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ed9c) returned 1
	[0097.841] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), fInfoLevelId=0x0, lpFileInformation=0x540ee18 | out: lpFileInformation=0x540ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x74a3dfa3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xad13acb)) returned 1
	[0097.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ed98) returned 1
	[0097.842] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0097.842] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", lpFilePart=0x0) returned 0x28
	[0097.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0097.842] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x2864698 | out: lpFileInformation=0x2864698*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200)) returned 1
	[0097.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0097.844] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", lpFilePart=0x0) returned 0x28
	[0097.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0097.844] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0097.844] GetFileType (hFile=0x2ec) returned 0x1
	[0097.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0097.844] GetFileType (hFile=0x2ec) returned 0x1
	[0097.844] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1d0200
	[0097.848] ReadFile (in: hFile=0x2ec, lpBuffer=0x42118e0, nNumberOfBytesToRead=0x1d0200, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x42118e0*, lpNumberOfBytesRead=0x540efcc*=0x1d0200, lpOverlapped=0x0) returned 1
	[0097.908] CloseHandle (hObject=0x2ec) returned 1
	[0097.908] CryptDestroyKey (hKey=0x82b480) returned 1
	[0097.908] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0097.908] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2871c04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0097.908] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0097.908] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0097.908] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0097.908] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0097.908] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2871cbc*=0x1, dwFlags=0x0) returned 1
	[0097.908] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2871c88, dwFlags=0x0) returned 1
	[0097.963] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34494c8*, pdwDataLen=0x540efd4*=0x1d0210, dwBufLen=0x1d0210 | out: pbData=0x34494c8*, pdwDataLen=0x540efd4*=0x1d0210) returned 1
	[0097.965] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x252f2ec*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x252f2ec*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0097.965] CryptDestroyKey (hKey=0x82b380) returned 1
	[0097.965] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0097.965] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0097.965] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", lpFilePart=0x0) returned 0x28
	[0097.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0097.965] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0097.972] GetFileType (hFile=0x5dc) returned 0x1
	[0097.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0097.972] GetFileType (hFile=0x5dc) returned 0x1
	[0097.972] WriteFile (in: hFile=0x5dc, lpBuffer=0x34494c8*, nNumberOfBytesToWrite=0x1d0210, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesWritten=0x540efc0*=0x1d0210, lpOverlapped=0x0) returned 1
	[0097.996] CloseHandle (hObject=0x5dc) returned 1
	[0098.088] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", lpFilePart=0x0) returned 0x28
	[0098.088] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0098.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0098.088] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x74cabc60, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0210)) returned 1
	[0098.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0098.088] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0098.089] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", lpFilePart=0x0) returned 0x28
	[0098.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0098.089] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x25aa594 | out: lpFileInformation=0x25aa594*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000)) returned 1
	[0098.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0098.090] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", lpFilePart=0x0) returned 0x28
	[0098.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0098.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0098.090] GetFileType (hFile=0x5dc) returned 0x1
	[0098.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0098.090] GetFileType (hFile=0x5dc) returned 0x1
	[0098.090] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x11c000
	[0098.093] ReadFile (in: hFile=0x5dc, lpBuffer=0x36196f8, nNumberOfBytesToRead=0x11c000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x36196f8*, lpNumberOfBytesRead=0x540efcc*=0x11c000, lpOverlapped=0x0) returned 1
	[0098.145] CloseHandle (hObject=0x5dc) returned 1
	[0098.146] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0098.146] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0098.146] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25daba4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0098.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0098.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0098.146] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0098.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0098.146] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x25dac5c*=0x1, dwFlags=0x0) returned 1
	[0098.146] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x25dac28, dwFlags=0x0) returned 1
	[0098.149] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3735718*, pdwDataLen=0x540efd4*=0x11c010, dwBufLen=0x11c010 | out: pbData=0x3735718*, pdwDataLen=0x540efd4*=0x11c010) returned 1
	[0098.149] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25dac6c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x25dac6c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0098.150] CryptDestroyKey (hKey=0x82b280) returned 1
	[0098.150] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0098.150] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0098.150] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", lpFilePart=0x0) returned 0x28
	[0098.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0098.150] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0098.206] GetFileType (hFile=0x5dc) returned 0x1
	[0098.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0098.206] GetFileType (hFile=0x5dc) returned 0x1
	[0098.206] WriteFile (in: hFile=0x5dc, lpBuffer=0x3735718*, nNumberOfBytesToWrite=0x11c010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x3735718*, lpNumberOfBytesWritten=0x540efc0*=0x11c010, lpOverlapped=0x0) returned 1
	[0098.221] CloseHandle (hObject=0x5dc) returned 1
	[0098.239] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", lpFilePart=0x0) returned 0x28
	[0098.239] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Core_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0098.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0098.239] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x74e29497, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11c010)) returned 1
	[0098.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0098.239] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0098.240] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended.mzz", lpFilePart=0x0) returned 0x28
	[0098.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0098.240] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), fInfoLevelId=0x0, lpFileInformation=0x25dafd4 | out: lpFileInformation=0x25dafd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7)) returned 1
	[0098.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0098.240] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended.mzz", lpFilePart=0x0) returned 0x28
	[0098.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0098.240] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0098.240] GetFileType (hFile=0x5dc) returned 0x1
	[0098.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0098.240] GetFileType (hFile=0x5dc) returned 0x1
	[0098.240] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x29222c7
	[0098.425] ReadFile (in: hFile=0x5dc, lpBuffer=0x68b1018, nNumberOfBytesToRead=0x29222c7, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x68b1018*, lpNumberOfBytesRead=0x540efcc*=0x29222c7, lpOverlapped=0x0) returned 1
	[0101.367] CloseHandle (hObject=0x5dc) returned 1
	[0101.367] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0101.367] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0101.368] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c00c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0101.368] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0101.368] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0101.368] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0101.368] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0101.368] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27c0178*=0x1, dwFlags=0x0) returned 1
	[0101.368] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27c0144, dwFlags=0x0) returned 1
	[0101.961] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x98b1018*, pdwDataLen=0x540efd4*=0x29222d0, dwBufLen=0x29222d0 | out: pbData=0x98b1018*, pdwDataLen=0x540efd4*=0x29222d0) returned 1
	[0102.197] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29aa670*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x29aa670*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0102.197] CryptDestroyKey (hKey=0x82b540) returned 1
	[0102.197] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0102.197] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0102.198] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended.mzz", lpFilePart=0x0) returned 0x28
	[0102.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0102.198] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0102.200] GetFileType (hFile=0x5dc) returned 0x1
	[0102.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0102.200] GetFileType (hFile=0x5dc) returned 0x1
	[0102.200] WriteFile (in: hFile=0x5dc, lpBuffer=0x98b1018*, nNumberOfBytesToWrite=0x29222d0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x98b1018*, lpNumberOfBytesWritten=0x540efc0*=0x29222d0, lpOverlapped=0x0) returned 1
	[0103.571] CloseHandle (hObject=0x5dc) returned 1
	[0104.471] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended.mzz", lpFilePart=0x0) returned 0x28
	[0104.471] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended.mzz id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0104.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0104.471] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x780f528a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x29222d0)) returned 1
	[0104.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0104.472] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0104.472] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", lpFilePart=0x0) returned 0x2c
	[0104.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0104.472] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x2722758 | out: lpFileInformation=0x2722758*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000)) returned 1
	[0104.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0104.474] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", lpFilePart=0x0) returned 0x2c
	[0104.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0104.474] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0104.474] GetFileType (hFile=0x5dc) returned 0x1
	[0104.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0104.474] GetFileType (hFile=0x5dc) returned 0x1
	[0104.474] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xd5000
	[0104.476] ReadFile (in: hFile=0x5dc, lpBuffer=0x34494c8, nNumberOfBytesToRead=0xd5000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesRead=0x540efcc*=0xd5000, lpOverlapped=0x0) returned 1
	[0104.505] CloseHandle (hObject=0x5dc) returned 1
	[0104.505] CryptDestroyKey (hKey=0x82b080) returned 1
	[0104.505] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.506] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2740de4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0104.506] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.506] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.506] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0104.506] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.506] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2740e9c*=0x1, dwFlags=0x0) returned 1
	[0104.506] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2740e68, dwFlags=0x0) returned 1
	[0104.515] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x351e4e8*, pdwDataLen=0x540efd4*=0xd5010, dwBufLen=0xd5010 | out: pbData=0x351e4e8*, pdwDataLen=0x540efd4*=0xd5010) returned 1
	[0104.515] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2740eac*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2740eac*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0104.516] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0104.516] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.516] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.516] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", lpFilePart=0x0) returned 0x2c
	[0104.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0104.516] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0104.522] GetFileType (hFile=0x5dc) returned 0x1
	[0104.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0104.522] GetFileType (hFile=0x5dc) returned 0x1
	[0104.522] WriteFile (in: hFile=0x5dc, lpBuffer=0x351e4e8*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x351e4e8*, lpNumberOfBytesWritten=0x540efc0*=0xd5010, lpOverlapped=0x0) returned 1
	[0104.556] CloseHandle (hObject=0x5dc) returned 1
	[0104.556] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", lpFilePart=0x0) returned 0x2c
	[0104.556] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0104.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0104.557] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x78a58577, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xd5010)) returned 1
	[0104.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0104.557] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0104.557] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", lpFilePart=0x0) returned 0x2c
	[0104.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0104.557] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x27638f0 | out: lpFileInformation=0x27638f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000)) returned 1
	[0104.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0104.558] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", lpFilePart=0x0) returned 0x2c
	[0104.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0104.558] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0104.558] GetFileType (hFile=0x5dc) returned 0x1
	[0104.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0104.558] GetFileType (hFile=0x5dc) returned 0x1
	[0104.558] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x79000
	[0104.559] ReadFile (in: hFile=0x5dc, lpBuffer=0x35f3518, nNumberOfBytesToRead=0x79000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x35f3518*, lpNumberOfBytesRead=0x540efcc*=0x79000, lpOverlapped=0x0) returned 1
	[0104.575] CloseHandle (hObject=0x5dc) returned 1
	[0104.575] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0104.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.575] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27769fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0104.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.575] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0104.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.575] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2776ab4*=0x1, dwFlags=0x0) returned 1
	[0104.575] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2776a80, dwFlags=0x0) returned 1
	[0104.579] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x366c538*, pdwDataLen=0x540efd4*=0x79010, dwBufLen=0x79010 | out: pbData=0x366c538*, pdwDataLen=0x540efd4*=0x79010) returned 1
	[0104.580] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2776ac4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2776ac4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0104.580] CryptDestroyKey (hKey=0x82b300) returned 1
	[0104.580] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.580] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.580] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", lpFilePart=0x0) returned 0x2c
	[0104.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0104.580] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0104.583] GetFileType (hFile=0x5dc) returned 0x1
	[0104.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0104.584] GetFileType (hFile=0x5dc) returned 0x1
	[0104.584] WriteFile (in: hFile=0x5dc, lpBuffer=0x366c538*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x366c538*, lpNumberOfBytesWritten=0x540efc0*=0x79010, lpOverlapped=0x0) returned 1
	[0104.620] CloseHandle (hObject=0x5dc) returned 1
	[0104.620] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", lpFilePart=0x0) returned 0x2c
	[0104.620] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0104.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0104.620] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x78af0f60, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x79010)) returned 1
	[0104.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0104.620] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0104.623] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\ParameterInfo.xml", lpFilePart=0x0) returned 0x27
	[0104.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0104.623] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x25960b0 | out: lpFileInformation=0x25960b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae)) returned 1
	[0104.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0104.624] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\ParameterInfo.xml", lpFilePart=0x0) returned 0x27
	[0104.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0104.624] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0104.624] GetFileType (hFile=0x5dc) returned 0x1
	[0104.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0104.624] GetFileType (hFile=0x5dc) returned 0x1
	[0104.624] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x426ae
	[0104.624] ReadFile (in: hFile=0x5dc, lpBuffer=0x36e5568, nNumberOfBytesToRead=0x426ae, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x36e5568*, lpNumberOfBytesRead=0x540efcc*=0x426ae, lpOverlapped=0x0) returned 1
	[0104.642] CloseHandle (hObject=0x5dc) returned 1
	[0104.642] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0104.642] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.642] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25a2b5c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0104.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.643] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0104.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.643] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x25a2c14*=0x1, dwFlags=0x0) returned 1
	[0104.643] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x25a2be0, dwFlags=0x0) returned 1
	[0104.645] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3727c38*, pdwDataLen=0x540efd4*=0x426b0, dwBufLen=0x426b0 | out: pbData=0x3727c38*, pdwDataLen=0x540efd4*=0x426b0) returned 1
	[0104.645] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25a2c24*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x25a2c24*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0104.645] CryptDestroyKey (hKey=0x82b300) returned 1
	[0104.645] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.645] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.645] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\ParameterInfo.xml", lpFilePart=0x0) returned 0x27
	[0104.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0104.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0104.648] GetFileType (hFile=0x5dc) returned 0x1
	[0104.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0104.648] GetFileType (hFile=0x5dc) returned 0x1
	[0104.648] WriteFile (in: hFile=0x5dc, lpBuffer=0x3727c38*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x3727c38*, lpNumberOfBytesWritten=0x540efc0*=0x426b0, lpOverlapped=0x0) returned 1
	[0104.653] CloseHandle (hObject=0x5dc) returned 1
	[0104.653] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\ParameterInfo.xml", lpFilePart=0x0) returned 0x27
	[0104.653] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\ParameterInfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0104.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0104.653] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x78b63766, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x426b0)) returned 1
	[0104.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0104.653] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0104.654] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", lpFilePart=0x0) returned 0x26
	[0104.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0104.654] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x25a2f80 | out: lpFileInformation=0x25a2f80*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200)) returned 1
	[0104.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0104.654] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", lpFilePart=0x0) returned 0x26
	[0104.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0104.654] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0104.654] GetFileType (hFile=0x5dc) returned 0x1
	[0104.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0104.655] GetFileType (hFile=0x5dc) returned 0x1
	[0104.655] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d200
	[0104.655] ReadFile (in: hFile=0x5dc, lpBuffer=0x376a308, nNumberOfBytesToRead=0x2d200, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x376a308*, lpNumberOfBytesRead=0x540efcc*=0x2d200, lpOverlapped=0x0) returned 1
	[0104.660] CloseHandle (hObject=0x5dc) returned 1
	[0104.661] CryptDestroyKey (hKey=0x82b340) returned 1
	[0104.661] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.661] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25a5b64, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0104.661] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.661] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.661] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0104.661] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.661] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x25a5c1c*=0x1, dwFlags=0x0) returned 1
	[0104.661] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x25a5be8, dwFlags=0x0) returned 1
	[0104.663] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3797528*, pdwDataLen=0x540efd4*=0x2d210, dwBufLen=0x2d210 | out: pbData=0x3797528*, pdwDataLen=0x540efd4*=0x2d210) returned 1
	[0104.663] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25a5c2c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x25a5c2c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0104.663] CryptDestroyKey (hKey=0x82b080) returned 1
	[0104.663] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.663] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.663] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", lpFilePart=0x0) returned 0x26
	[0104.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0104.664] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0104.665] GetFileType (hFile=0x5dc) returned 0x1
	[0104.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0104.665] GetFileType (hFile=0x5dc) returned 0x1
	[0104.666] WriteFile (in: hFile=0x5dc, lpBuffer=0x3797528*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x3797528*, lpNumberOfBytesWritten=0x540efc0*=0x2d210, lpOverlapped=0x0) returned 1
	[0104.709] CloseHandle (hObject=0x5dc) returned 1
	[0104.709] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", lpFilePart=0x0) returned 0x26
	[0104.709] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0104.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0104.709] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x78bd5fa0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d210)) returned 1
	[0104.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0104.709] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0104.710] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", lpFilePart=0x0) returned 0x26
	[0104.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0104.710] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x25bcb04 | out: lpFileInformation=0x25bcb04*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200)) returned 1
	[0104.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0104.710] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", lpFilePart=0x0) returned 0x26
	[0104.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0104.710] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0104.710] GetFileType (hFile=0x5dc) returned 0x1
	[0104.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0104.710] GetFileType (hFile=0x5dc) returned 0x1
	[0104.710] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x17200
	[0104.711] ReadFile (in: hFile=0x5dc, lpBuffer=0x37c4758, nNumberOfBytesToRead=0x17200, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x37c4758*, lpNumberOfBytesRead=0x540efcc*=0x17200, lpOverlapped=0x0) returned 1
	[0104.728] CloseHandle (hObject=0x5dc) returned 1
	[0104.729] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0104.729] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.729] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25cbfb0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0104.729] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.729] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.729] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0104.729] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.729] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x25cc068*=0x1, dwFlags=0x0) returned 1
	[0104.729] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x25cc034, dwFlags=0x0) returned 1
	[0104.731] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x37db978*, pdwDataLen=0x540efd4*=0x17210, dwBufLen=0x17210 | out: pbData=0x37db978*, pdwDataLen=0x540efd4*=0x17210) returned 1
	[0104.731] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25cc078*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x25cc078*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0104.731] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0104.731] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.731] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.731] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", lpFilePart=0x0) returned 0x26
	[0104.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0104.731] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0104.733] GetFileType (hFile=0x5dc) returned 0x1
	[0104.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0104.733] GetFileType (hFile=0x5dc) returned 0x1
	[0104.733] WriteFile (in: hFile=0x5dc, lpBuffer=0x37db978*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x37db978*, lpNumberOfBytesWritten=0x540efc0*=0x17210, lpOverlapped=0x0) returned 1
	[0104.735] CloseHandle (hObject=0x5dc) returned 1
	[0104.735] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", lpFilePart=0x0) returned 0x26
	[0104.735] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0104.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0104.735] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x78c2228f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x17210)) returned 1
	[0104.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0104.735] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), lpNewFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0104.736] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Setup.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Setup.exe", lpFilePart=0x0) returned 0x1f
	[0104.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0104.736] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), fInfoLevelId=0x0, lpFileInformation=0x25cc3c8 | out: lpFileInformation=0x25cc3c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148)) returned 1
	[0104.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0105.115] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.187] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.187] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.189] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.189] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.190] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.195] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.195] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.237] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.297] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.355] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.365] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.365] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.376] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.377] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.387] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.403] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.500] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.549] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.695] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.763] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", lpFilePart=0x0) returned 0x37
	[0105.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0105.763] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.763] GetFileType (hFile=0x5dc) returned 0x1
	[0105.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0105.763] GetFileType (hFile=0x5dc) returned 0x1
	[0105.763] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x217520
	[0105.768] ReadFile (in: hFile=0x5dc, lpBuffer=0x3faa7a0, nNumberOfBytesToRead=0x217520, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x3faa7a0*, lpNumberOfBytesRead=0x540efcc*=0x217520, lpOverlapped=0x0) returned 1
	[0105.842] CloseHandle (hObject=0x5dc) returned 1
	[0105.842] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0105.842] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.842] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25b5370, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0105.842] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.842] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.842] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0105.842] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.843] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x25b5428*=0x1, dwFlags=0x0) returned 1
	[0105.843] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x25b53f4, dwFlags=0x0) returned 1
	[0105.903] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x41c1ce0*, pdwDataLen=0x540efd4*=0x217530, dwBufLen=0x217530 | out: pbData=0x41c1ce0*, pdwDataLen=0x540efd4*=0x217530) returned 1
	[0105.905] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25fb364*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x25fb364*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0105.905] CryptDestroyKey (hKey=0x82b540) returned 1
	[0105.905] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.905] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.905] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", lpFilePart=0x0) returned 0x37
	[0105.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0105.905] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.909] GetFileType (hFile=0x5dc) returned 0x1
	[0105.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0105.909] GetFileType (hFile=0x5dc) returned 0x1
	[0105.909] WriteFile (in: hFile=0x5dc, lpBuffer=0x41c1ce0*, nNumberOfBytesToWrite=0x217530, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x41c1ce0*, lpNumberOfBytesWritten=0x540efc0*=0x217530, lpOverlapped=0x0) returned 1
	[0106.001] CloseHandle (hObject=0x5dc) returned 1
	[0106.002] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", lpFilePart=0x0) returned 0x37
	[0106.002] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0106.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0106.002] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x798341fd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x217530)) returned 1
	[0106.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0106.002] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0106.003] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", lpFilePart=0x0) returned 0x37
	[0106.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0106.003] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), fInfoLevelId=0x0, lpFileInformation=0x2638480 | out: lpFileInformation=0x2638480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce)) returned 1
	[0106.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0106.003] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", lpFilePart=0x0) returned 0x37
	[0106.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0106.004] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0106.004] GetFileType (hFile=0x5dc) returned 0x1
	[0106.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0106.004] GetFileType (hFile=0x5dc) returned 0x1
	[0106.004] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x4db1ce
	[0106.019] ReadFile (in: hFile=0x5dc, lpBuffer=0xc1d3308, nNumberOfBytesToRead=0x4db1ce, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0xc1d3308*, lpNumberOfBytesRead=0x540efcc*=0x4db1ce, lpOverlapped=0x0) returned 1
	[0106.336] CloseHandle (hObject=0x5dc) returned 1
	[0106.336] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0106.336] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.336] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26978b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0106.336] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.336] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.336] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0106.336] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.336] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x269796c*=0x1, dwFlags=0x0) returned 1
	[0106.336] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2697938, dwFlags=0x0) returned 1
	[0106.441] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xc8b1018*, pdwDataLen=0x540efd4*=0x4db1d0, dwBufLen=0x4db1d0 | out: pbData=0xc8b1018*, pdwDataLen=0x540efd4*=0x4db1d0) returned 1
	[0106.445] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2705338*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2705338*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0106.445] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0106.445] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.445] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.445] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", lpFilePart=0x0) returned 0x37
	[0106.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0106.445] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0106.452] GetFileType (hFile=0x5dc) returned 0x1
	[0106.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0106.452] GetFileType (hFile=0x5dc) returned 0x1
	[0106.452] WriteFile (in: hFile=0x5dc, lpBuffer=0xc8b1018*, nNumberOfBytesToWrite=0x4db1d0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0xc8b1018*, lpNumberOfBytesWritten=0x540efc0*=0x4db1d0, lpOverlapped=0x0) returned 1
	[0106.631] CloseHandle (hObject=0x5dc) returned 1
	[0106.632] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", lpFilePart=0x0) returned 0x37
	[0106.632] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0106.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0106.632] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x79e29fd3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4db1d0)) returned 1
	[0106.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0106.632] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0106.633] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", lpFilePart=0x0) returned 0x37
	[0106.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0106.633] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), fInfoLevelId=0x0, lpFileInformation=0x25a20b0 | out: lpFileInformation=0x25a20b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9)) returned 1
	[0106.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0106.633] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", lpFilePart=0x0) returned 0x37
	[0106.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0106.634] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0106.634] GetFileType (hFile=0x5dc) returned 0x1
	[0106.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0106.634] GetFileType (hFile=0x5dc) returned 0x1
	[0106.634] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x20acf9
	[0106.639] ReadFile (in: hFile=0x5dc, lpBuffer=0xcd8c208, nNumberOfBytesToRead=0x20acf9, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0xcd8c208*, lpNumberOfBytesRead=0x540efcc*=0x20acf9, lpOverlapped=0x0) returned 1
	[0106.740] CloseHandle (hObject=0x5dc) returned 1
	[0106.740] CryptDestroyKey (hKey=0x82b440) returned 1
	[0106.740] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.740] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25ef108, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0106.740] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.740] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.740] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0106.740] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.740] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x25ef1c0*=0x1, dwFlags=0x0) returned 1
	[0106.740] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x25ef18c, dwFlags=0x0) returned 1
	[0106.766] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcf96f20*, pdwDataLen=0x540efd4*=0x20ad00, dwBufLen=0x20ad00 | out: pbData=0xcf96f20*, pdwDataLen=0x540efd4*=0x20ad00) returned 1
	[0106.768] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25f4a18*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x25f4a18*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0106.768] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0106.768] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.768] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.768] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", lpFilePart=0x0) returned 0x37
	[0106.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0106.768] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0106.770] GetFileType (hFile=0x5dc) returned 0x1
	[0106.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0106.770] GetFileType (hFile=0x5dc) returned 0x1
	[0106.770] WriteFile (in: hFile=0x5dc, lpBuffer=0xcf96f20*, nNumberOfBytesToWrite=0x20ad00, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0xcf96f20*, lpNumberOfBytesWritten=0x540efc0*=0x20ad00, lpOverlapped=0x0) returned 1
	[0106.828] CloseHandle (hObject=0x5dc) returned 1
	[0106.835] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", lpFilePart=0x0) returned 0x37
	[0106.835] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0106.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0106.836] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x7a019eef, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x20ad00)) returned 1
	[0106.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0106.836] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0106.836] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD", lpFilePart=0x0) returned 0xb
	[0106.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0106.837] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), fInfoLevelId=0x0, lpFileInformation=0x2611978 | out: lpFileInformation=0x2611978*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000)) returned 1
	[0106.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0106.837] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD", lpFilePart=0x0) returned 0xb
	[0106.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0106.837] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0106.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0106.839] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD.LOG", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD.LOG", lpFilePart=0x0) returned 0xf
	[0106.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0106.839] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), fInfoLevelId=0x0, lpFileInformation=0x2611e84 | out: lpFileInformation=0x2611e84*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0106.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0106.839] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD.LOG", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD.LOG", lpFilePart=0x0) returned 0xf
	[0106.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0106.839] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0106.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0106.849] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD.LOG1", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD.LOG1", lpFilePart=0x0) returned 0x10
	[0106.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0106.849] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), fInfoLevelId=0x0, lpFileInformation=0x2617258 | out: lpFileInformation=0x2617258*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0106.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0106.851] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD.LOG1", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD.LOG1", lpFilePart=0x0) returned 0x10
	[0106.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0106.851] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0106.851] GetFileType (hFile=0x5dc) returned 0x1
	[0106.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0106.851] GetFileType (hFile=0x5dc) returned 0x1
	[0106.851] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x0
	[0106.851] CloseHandle (hObject=0x5dc) returned 1
	[0106.852] CryptDestroyKey (hKey=0x82b280) returned 1
	[0106.852] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.852] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261746c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0106.852] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.852] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.852] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0106.852] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.852] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2617524*=0x1, dwFlags=0x0) returned 1
	[0106.852] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26174f0, dwFlags=0x0) returned 1
	[0106.852] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2617534*, pdwDataLen=0x540efd4*=0x10, dwBufLen=0x10 | out: pbData=0x2617534*, pdwDataLen=0x540efd4*=0x10) returned 1
	[0106.852] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2617550*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2617550*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0106.852] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0106.852] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.852] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.852] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD.LOG1", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD.LOG1", lpFilePart=0x0) returned 0x10
	[0106.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0106.852] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0106.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0106.863] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD.LOG2", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD.LOG2", lpFilePart=0x0) returned 0x10
	[0106.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0106.863] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), fInfoLevelId=0x0, lpFileInformation=0x26218c4 | out: lpFileInformation=0x26218c4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0106.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0106.864] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD.LOG2", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD.LOG2", lpFilePart=0x0) returned 0x10
	[0106.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0106.864] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0106.864] GetFileType (hFile=0x41c) returned 0x1
	[0106.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0106.864] GetFileType (hFile=0x41c) returned 0x1
	[0106.864] GetFileSize (in: hFile=0x41c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x0
	[0106.864] CloseHandle (hObject=0x41c) returned 1
	[0106.864] CryptDestroyKey (hKey=0x82b540) returned 1
	[0106.864] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.864] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2621ad8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0106.865] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.865] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.865] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0106.865] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.865] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2621b90*=0x1, dwFlags=0x0) returned 1
	[0106.865] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2621b5c, dwFlags=0x0) returned 1
	[0106.865] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2621ba0*, pdwDataLen=0x540efd4*=0x10, dwBufLen=0x10 | out: pbData=0x2621ba0*, pdwDataLen=0x540efd4*=0x10) returned 1
	[0106.865] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2621bbc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2621bbc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0106.865] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0106.865] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.865] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.865] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD.LOG2", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD.LOG2", lpFilePart=0x0) returned 0x10
	[0106.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0106.865] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0106.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0106.867] GetFullPathNameW (in: lpFileName="C:\\Boot\\bootspaces.dll", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\bootspaces.dll", lpFilePart=0x0) returned 0x16
	[0106.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0106.868] GetFileAttributesExW (in: lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), fInfoLevelId=0x0, lpFileInformation=0x2622000 | out: lpFileInformation=0x2622000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0)) returned 1
	[0106.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0106.880] GetFullPathNameW (in: lpFileName="C:\\Boot\\bootspaces.dll", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\bootspaces.dll", lpFilePart=0x0) returned 0x16
	[0106.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0106.880] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0106.880] GetFileType (hFile=0x5dc) returned 0x1
	[0106.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0106.880] GetFileType (hFile=0x5dc) returned 0x1
	[0106.880] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x175a0
	[0106.880] ReadFile (in: hFile=0x5dc, lpBuffer=0x43d9230, nNumberOfBytesToRead=0x175a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x43d9230*, lpNumberOfBytesRead=0x540efcc*=0x175a0, lpOverlapped=0x0) returned 1
	[0106.900] CloseHandle (hObject=0x5dc) returned 1
	[0106.900] CryptDestroyKey (hKey=0x82b440) returned 1
	[0106.900] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.900] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2633b3c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0106.900] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.900] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.900] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0106.900] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.900] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x2633bf4*=0x1, dwFlags=0x0) returned 1
	[0106.900] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x2633bc0, dwFlags=0x0) returned 1
	[0106.901] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x43f07f0*, pdwDataLen=0x540efd4*=0x175b0, dwBufLen=0x175b0 | out: pbData=0x43f07f0*, pdwDataLen=0x540efd4*=0x175b0) returned 1
	[0106.902] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2633c04*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2633c04*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0106.902] CryptDestroyKey (hKey=0x82b340) returned 1
	[0106.902] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.902] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.902] GetFullPathNameW (in: lpFileName="C:\\Boot\\bootspaces.dll", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\bootspaces.dll", lpFilePart=0x0) returned 0x16
	[0106.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0106.902] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0106.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0106.904] GetFullPathNameW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BOOTSTAT.DAT", lpFilePart=0x0) returned 0x14
	[0106.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0106.905] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), fInfoLevelId=0x0, lpFileInformation=0x2634084 | out: lpFileInformation=0x2634084*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0106.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0106.914] GetFullPathNameW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BOOTSTAT.DAT", lpFilePart=0x0) returned 0x14
	[0106.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0106.914] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0106.915] GetFileType (hFile=0x41c) returned 0x1
	[0106.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0106.915] GetFileType (hFile=0x41c) returned 0x1
	[0106.915] GetFileSize (in: hFile=0x41c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10000
	[0106.915] ReadFile (in: hFile=0x41c, lpBuffer=0x263a764, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x263a764*, lpNumberOfBytesRead=0x540efcc*=0x10000, lpOverlapped=0x0) returned 1
	[0106.917] CloseHandle (hObject=0x41c) returned 1
	[0106.917] CryptDestroyKey (hKey=0x82b440) returned 1
	[0106.917] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.917] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264a800, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0106.917] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.917] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.917] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0106.917] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.918] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x264a8b8*=0x1, dwFlags=0x0) returned 1
	[0106.918] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x264a884, dwFlags=0x0) returned 1
	[0106.918] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264a8c8*, pdwDataLen=0x540efd4*=0x10010, dwBufLen=0x10010 | out: pbData=0x264a8c8*, pdwDataLen=0x540efd4*=0x10010) returned 1
	[0106.918] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265a8e4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x265a8e4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0106.918] CryptDestroyKey (hKey=0x82b340) returned 1
	[0106.918] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.918] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.918] GetFullPathNameW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BOOTSTAT.DAT", lpFilePart=0x0) returned 0x14
	[0106.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0106.918] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0106.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0106.920] GetFullPathNameW (in: lpFileName="C:\\Boot\\bootvhd.dll", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\bootvhd.dll", lpFilePart=0x0) returned 0x13
	[0106.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0106.920] GetFileAttributesExW (in: lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), fInfoLevelId=0x0, lpFileInformation=0x265ad50 | out: lpFileInformation=0x265ad50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0)) returned 1
	[0106.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0107.705] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.816] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.860] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.951] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.952] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.992] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.202] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.202] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.215] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.216] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.216] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.216] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.239] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.296] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.297] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.336] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.353] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.355] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.369] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.369] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.385] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.385] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.500] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.585] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.600] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.601] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.640] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.640] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.641] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.650] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.657] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.664] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.666] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.666] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.678] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.679] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.679] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.680] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.694] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.710] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.732] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.734] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.734] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.772] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.804] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.835] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.839] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.864] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.865] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.865] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.865] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.815] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.817] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.830] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.841] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.856] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.929] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.929] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.930] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.243] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.243] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.244] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.244] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.262] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.276] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.294] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.309] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.343] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.343] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.343] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.343] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.343] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.557] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.559] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.559] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.575] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.859] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.010] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.029] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.129] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.160] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.533] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.557] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.562] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.614] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.666] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.723] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.787] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.787] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.787] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.787] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.790] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.802] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.852] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0117.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0117.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0117.290] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0117.363] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.221] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.243] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.250] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.258] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.258] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.259] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.259] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.277] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.281] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.284] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.296] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.319] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.328] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.374] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.374] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.374] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.374] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.374] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.376] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.376] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.377] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.406] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.413] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.423] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.507] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.528] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.528] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.529] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.553] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.553] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.561] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.582] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.582] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.607] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.608] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.633] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.638] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.638] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.647] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.787] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.834] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.881] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.928] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.975] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.021] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.058] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.065] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.065] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.065] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.067] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.067] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.067] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.067] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.069] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.087] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.088] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.088] GetFileType (hFile=0x5dc) returned 0x1
	[0119.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.088] GetFileType (hFile=0x5dc) returned 0x1
	[0119.088] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x121a0
	[0119.088] ReadFile (in: hFile=0x5dc, lpBuffer=0x26f581c, nNumberOfBytesToRead=0x121a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f581c*, lpNumberOfBytesRead=0x540efcc*=0x121a0, lpOverlapped=0x0) returned 1
	[0119.090] CloseHandle (hObject=0x5dc) returned 1
	[0119.090] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0119.090] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.090] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2707a58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0119.090] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.090] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.090] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0119.090] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.090] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2707b10*=0x1, dwFlags=0x0) returned 1
	[0119.090] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2707adc, dwFlags=0x0) returned 1
	[0119.090] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2707b20*, pdwDataLen=0x540efd4*=0x121b0, dwBufLen=0x121b0 | out: pbData=0x2707b20*, pdwDataLen=0x540efd4*=0x121b0) returned 1
	[0119.091] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2719cdc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2719cdc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.091] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0119.091] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.091] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.091] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.091] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.093] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.093] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x271a190 | out: lpFileInformation=0x271a190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0)) returned 1
	[0119.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.093] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.093] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.094] GetFileType (hFile=0x5dc) returned 0x1
	[0119.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.094] GetFileType (hFile=0x5dc) returned 0x1
	[0119.094] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xafa0
	[0119.094] ReadFile (in: hFile=0x5dc, lpBuffer=0x271a350, nNumberOfBytesToRead=0xafa0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271a350*, lpNumberOfBytesRead=0x540efcc*=0xafa0, lpOverlapped=0x0) returned 1
	[0119.098] CloseHandle (hObject=0x5dc) returned 1
	[0119.098] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0119.098] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.098] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272538c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0119.098] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.098] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.098] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0119.098] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.098] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2725444*=0x1, dwFlags=0x0) returned 1
	[0119.099] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2725410, dwFlags=0x0) returned 1
	[0119.099] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2725454*, pdwDataLen=0x540efd4*=0xafb0, dwBufLen=0xafb0 | out: pbData=0x2725454*, pdwDataLen=0x540efd4*=0xafb0) returned 1
	[0119.099] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2730410*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2730410*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.099] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0119.099] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.099] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.099] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.099] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.102] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.102] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27308c4 | out: lpFileInformation=0x27308c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60)) returned 1
	[0119.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.103] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.103] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.103] GetFileType (hFile=0x5dc) returned 0x1
	[0119.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.103] GetFileType (hFile=0x5dc) returned 0x1
	[0119.103] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12f60
	[0119.103] ReadFile (in: hFile=0x5dc, lpBuffer=0x2730a84, nNumberOfBytesToRead=0x12f60, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2730a84*, lpNumberOfBytesRead=0x540efcc*=0x12f60, lpOverlapped=0x0) returned 1
	[0119.105] CloseHandle (hObject=0x5dc) returned 1
	[0119.106] CryptDestroyKey (hKey=0x82b280) returned 1
	[0119.106] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.106] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2743a80, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0119.106] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.106] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.106] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0119.106] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.106] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2743b38*=0x1, dwFlags=0x0) returned 1
	[0119.106] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2743b04, dwFlags=0x0) returned 1
	[0119.106] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2743b48*, pdwDataLen=0x540efd4*=0x12f70, dwBufLen=0x12f70 | out: pbData=0x2743b48*, pdwDataLen=0x540efd4*=0x12f70) returned 1
	[0119.106] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2756ac4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2756ac4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.106] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0119.106] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.106] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.106] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.107] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.108] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.109] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2756f78 | out: lpFileInformation=0x2756f78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0)) returned 1
	[0119.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.109] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.109] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.109] GetFileType (hFile=0x5dc) returned 0x1
	[0119.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.109] GetFileType (hFile=0x5dc) returned 0x1
	[0119.109] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb3a0
	[0119.110] ReadFile (in: hFile=0x5dc, lpBuffer=0x2757138, nNumberOfBytesToRead=0xb3a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2757138*, lpNumberOfBytesRead=0x540efcc*=0xb3a0, lpOverlapped=0x0) returned 1
	[0119.111] CloseHandle (hObject=0x5dc) returned 1
	[0119.111] CryptDestroyKey (hKey=0x82b300) returned 1
	[0119.111] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.112] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2762574, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0119.112] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.112] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.112] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0119.112] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.112] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x276262c*=0x1, dwFlags=0x0) returned 1
	[0119.112] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27625f8, dwFlags=0x0) returned 1
	[0119.112] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276263c*, pdwDataLen=0x540efd4*=0xb3b0, dwBufLen=0xb3b0 | out: pbData=0x276263c*, pdwDataLen=0x540efd4*=0xb3b0) returned 1
	[0119.112] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276d9f8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x276d9f8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.112] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0119.112] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.112] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.112] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.112] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.114] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-MX\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.115] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x276deac | out: lpFileInformation=0x276deac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60)) returned 1
	[0119.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.115] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-MX\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.115] CreateFileW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.115] GetFileType (hFile=0x5dc) returned 0x1
	[0119.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.115] GetFileType (hFile=0x5dc) returned 0x1
	[0119.115] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12f60
	[0119.116] ReadFile (in: hFile=0x5dc, lpBuffer=0x276e06c, nNumberOfBytesToRead=0x12f60, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x276e06c*, lpNumberOfBytesRead=0x540efcc*=0x12f60, lpOverlapped=0x0) returned 1
	[0119.154] CloseHandle (hObject=0x5dc) returned 1
	[0119.155] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0119.155] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.155] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2781068, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0119.155] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.155] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.155] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0119.155] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.155] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2781120*=0x1, dwFlags=0x0) returned 1
	[0119.155] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27810ec, dwFlags=0x0) returned 1
	[0119.155] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2781130*, pdwDataLen=0x540efd4*=0x12f70, dwBufLen=0x12f70 | out: pbData=0x2781130*, pdwDataLen=0x540efd4*=0x12f70) returned 1
	[0119.155] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27940ac*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27940ac*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.155] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0119.155] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.155] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.155] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-MX\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.156] CreateFileW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.158] GetFullPathNameW (in: lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\et-EE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.160] GetFileAttributesExW (in: lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2794560 | out: lpFileInformation=0x2794560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560)) returned 1
	[0119.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.161] GetFullPathNameW (in: lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\et-EE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.161] CreateFileW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.161] GetFileType (hFile=0x5dc) returned 0x1
	[0119.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.161] GetFileType (hFile=0x5dc) returned 0x1
	[0119.161] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12560
	[0119.162] ReadFile (in: hFile=0x5dc, lpBuffer=0x2794720, nNumberOfBytesToRead=0x12560, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2794720*, lpNumberOfBytesRead=0x540efcc*=0x12560, lpOverlapped=0x0) returned 1
	[0119.164] CloseHandle (hObject=0x5dc) returned 1
	[0119.164] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0119.164] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.164] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a6d1c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0119.164] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.164] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.165] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0119.165] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.165] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27a6dd4*=0x1, dwFlags=0x0) returned 1
	[0119.165] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27a6da0, dwFlags=0x0) returned 1
	[0119.165] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a6de4*, pdwDataLen=0x540efd4*=0x12570, dwBufLen=0x12570 | out: pbData=0x27a6de4*, pdwDataLen=0x540efd4*=0x12570) returned 1
	[0119.165] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b9360*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b9360*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.165] CryptDestroyKey (hKey=0x82b280) returned 1
	[0119.165] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.165] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.165] GetFullPathNameW (in: lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\et-EE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.165] CreateFileW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.167] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.167] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27b9814 | out: lpFileInformation=0x27b9814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60)) returned 1
	[0119.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.168] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.168] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.168] GetFileType (hFile=0x5dc) returned 0x1
	[0119.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.168] GetFileType (hFile=0x5dc) returned 0x1
	[0119.168] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12b60
	[0119.168] ReadFile (in: hFile=0x5dc, lpBuffer=0x27b99d4, nNumberOfBytesToRead=0x12b60, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b99d4*, lpNumberOfBytesRead=0x540efcc*=0x12b60, lpOverlapped=0x0) returned 1
	[0119.174] CloseHandle (hObject=0x5dc) returned 1
	[0119.175] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0119.175] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.175] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27cc5d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0119.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.175] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0119.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.175] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27cc688*=0x1, dwFlags=0x0) returned 1
	[0119.175] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x27cc654, dwFlags=0x0) returned 1
	[0119.175] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27cc698*, pdwDataLen=0x540efd4*=0x12b70, dwBufLen=0x12b70 | out: pbData=0x27cc698*, pdwDataLen=0x540efd4*=0x12b70) returned 1
	[0119.175] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27df214*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27df214*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.175] CryptDestroyKey (hKey=0x82b080) returned 1
	[0119.175] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.175] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.175] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.176] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.178] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.178] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27df6c8 | out: lpFileInformation=0x27df6c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0)) returned 1
	[0119.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.178] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.178] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.178] GetFileType (hFile=0x5dc) returned 0x1
	[0119.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.178] GetFileType (hFile=0x5dc) returned 0x1
	[0119.179] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb1a0
	[0119.179] ReadFile (in: hFile=0x5dc, lpBuffer=0x27df888, nNumberOfBytesToRead=0xb1a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27df888*, lpNumberOfBytesRead=0x540efcc*=0xb1a0, lpOverlapped=0x0) returned 1
	[0119.180] CloseHandle (hObject=0x5dc) returned 1
	[0119.180] CryptDestroyKey (hKey=0x82b100) returned 1
	[0119.180] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.181] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27eaac4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0119.181] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.181] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.181] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0119.181] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.181] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27eab7c*=0x1, dwFlags=0x0) returned 1
	[0119.181] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27eab48, dwFlags=0x0) returned 1
	[0119.181] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27eab8c*, pdwDataLen=0x540efd4*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x27eab8c*, pdwDataLen=0x540efd4*=0xb1b0) returned 1
	[0119.181] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f5d48*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f5d48*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.181] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0119.181] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.181] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.181] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.181] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.183] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\chs_boot.ttf", lpFilePart=0x0) returned 0x1a
	[0119.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.183] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27f61fc | out: lpFileInformation=0x27f61fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467)) returned 1
	[0119.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.184] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\chs_boot.ttf", lpFilePart=0x0) returned 0x1a
	[0119.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.184] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.184] GetFileType (hFile=0x5dc) returned 0x1
	[0119.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.184] GetFileType (hFile=0x5dc) returned 0x1
	[0119.184] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x386467
	[0119.201] ReadFile (in: hFile=0x5dc, lpBuffer=0x34d96e8, nNumberOfBytesToRead=0x386467, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x34d96e8*, lpNumberOfBytesRead=0x540efcc*=0x386467, lpOverlapped=0x0) returned 1
	[0119.361] CloseHandle (hObject=0x5dc) returned 1
	[0119.361] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0119.361] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.362] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f643c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0119.362] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.362] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.362] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0119.362] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.362] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27f64f4*=0x1, dwFlags=0x0) returned 1
	[0119.362] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27f64c0, dwFlags=0x0) returned 1
	[0119.414] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x385fb70*, pdwDataLen=0x540efd4*=0x386470, dwBufLen=0x386470 | out: pbData=0x385fb70*, pdwDataLen=0x540efd4*=0x386470) returned 1
	[0119.417] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f6504*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f6504*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.417] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0119.417] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.417] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.417] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\chs_boot.ttf", lpFilePart=0x0) returned 0x1a
	[0119.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.417] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.423] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\cht_boot.ttf", lpFilePart=0x0) returned 0x1a
	[0119.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.423] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27f69a0 | out: lpFileInformation=0x27f69a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a)) returned 1
	[0119.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.432] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\cht_boot.ttf", lpFilePart=0x0) returned 0x1a
	[0119.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.432] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.432] GetFileType (hFile=0x5dc) returned 0x1
	[0119.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.432] GetFileType (hFile=0x5dc) returned 0x1
	[0119.432] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3b2e0a
	[0119.441] ReadFile (in: hFile=0x5dc, lpBuffer=0x3be6000, nNumberOfBytesToRead=0x3b2e0a, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x3be6000*, lpNumberOfBytesRead=0x540efcc*=0x3b2e0a, lpOverlapped=0x0) returned 1
	[0119.580] CloseHandle (hObject=0x5dc) returned 1
	[0119.581] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0119.581] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.581] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f6be0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0119.581] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.581] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.581] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0119.581] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.581] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27f6c98*=0x1, dwFlags=0x0) returned 1
	[0119.581] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27f6c64, dwFlags=0x0) returned 1
	[0119.633] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f98e28*, pdwDataLen=0x540efd4*=0x3b2e10, dwBufLen=0x3b2e10 | out: pbData=0x3f98e28*, pdwDataLen=0x540efd4*=0x3b2e10) returned 1
	[0119.636] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f6ca8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f6ca8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.636] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0119.636] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.636] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.636] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\cht_boot.ttf", lpFilePart=0x0) returned 0x1a
	[0119.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.637] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.639] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\jpn_boot.ttf", lpFilePart=0x0) returned 0x1a
	[0119.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.639] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27f7144 | out: lpFileInformation=0x27f7144*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b)) returned 1
	[0119.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.641] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\jpn_boot.ttf", lpFilePart=0x0) returned 0x1a
	[0119.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.642] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.642] GetFileType (hFile=0x5dc) returned 0x1
	[0119.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.642] GetFileType (hFile=0x5dc) returned 0x1
	[0119.642] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1e4d4b
	[0119.647] ReadFile (in: hFile=0x5dc, lpBuffer=0x5ea1018, nNumberOfBytesToRead=0x1e4d4b, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x5ea1018*, lpNumberOfBytesRead=0x540efcc*=0x1e4d4b, lpOverlapped=0x0) returned 1
	[0119.715] CloseHandle (hObject=0x5dc) returned 1
	[0119.715] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0119.715] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.715] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f7384, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0119.716] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.716] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.716] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0119.716] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.716] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x27f743c*=0x1, dwFlags=0x0) returned 1
	[0119.716] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x27f7408, dwFlags=0x0) returned 1
	[0119.743] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6085d80*, pdwDataLen=0x540efd4*=0x1e4d50, dwBufLen=0x1e4d50 | out: pbData=0x6085d80*, pdwDataLen=0x540efd4*=0x1e4d50) returned 1
	[0119.744] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f744c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f744c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.744] CryptDestroyKey (hKey=0x82b440) returned 1
	[0119.744] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.744] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.744] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\jpn_boot.ttf", lpFilePart=0x0) returned 0x1a
	[0119.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.745] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.747] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\kor_boot.ttf", lpFilePart=0x0) returned 0x1a
	[0119.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.747] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27f78e8 | out: lpFileInformation=0x27f78e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588)) returned 1
	[0119.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.770] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\kor_boot.ttf", lpFilePart=0x0) returned 0x1a
	[0119.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.770] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.770] GetFileType (hFile=0x5dc) returned 0x1
	[0119.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.770] GetFileType (hFile=0x5dc) returned 0x1
	[0119.770] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x243588
	[0119.777] ReadFile (in: hFile=0x5dc, lpBuffer=0x626aaf0, nNumberOfBytesToRead=0x243588, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x626aaf0*, lpNumberOfBytesRead=0x540efcc*=0x243588, lpOverlapped=0x0) returned 1
	[0119.862] CloseHandle (hObject=0x5dc) returned 1
	[0119.862] CryptDestroyKey (hKey=0x82b400) returned 1
	[0119.862] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.862] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f7b28, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0119.862] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.862] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.862] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0119.862] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.862] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27f7be0*=0x1, dwFlags=0x0) returned 1
	[0119.862] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27f7bac, dwFlags=0x0) returned 1
	[0119.894] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x64ae098*, pdwDataLen=0x540efd4*=0x243590, dwBufLen=0x243590 | out: pbData=0x64ae098*, pdwDataLen=0x540efd4*=0x243590) returned 1
	[0119.896] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f7bf0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f7bf0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.896] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0119.896] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.896] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.897] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\kor_boot.ttf", lpFilePart=0x0) returned 0x1a
	[0119.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.897] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.899] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\malgunn_boot.ttf", lpFilePart=0x0) returned 0x1e
	[0119.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.899] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27f808c | out: lpFileInformation=0x27f808c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f)) returned 1
	[0119.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.916] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\malgunn_boot.ttf", lpFilePart=0x0) returned 0x1e
	[0119.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.916] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.917] GetFileType (hFile=0x5dc) returned 0x1
	[0119.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.917] GetFileType (hFile=0x5dc) returned 0x1
	[0119.917] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2ab6f
	[0119.917] ReadFile (in: hFile=0x5dc, lpBuffer=0x434bc58, nNumberOfBytesToRead=0x2ab6f, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x434bc58*, lpNumberOfBytesRead=0x540efcc*=0x2ab6f, lpOverlapped=0x0) returned 1
	[0119.934] CloseHandle (hObject=0x5dc) returned 1
	[0119.934] CryptDestroyKey (hKey=0x82b340) returned 1
	[0119.934] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.934] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f82ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0119.934] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.934] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.934] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0119.934] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.934] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x27f83a4*=0x1, dwFlags=0x0) returned 1
	[0119.934] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x27f8370, dwFlags=0x0) returned 1
	[0119.937] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x43767e8*, pdwDataLen=0x540efd4*=0x2ab70, dwBufLen=0x2ab70 | out: pbData=0x43767e8*, pdwDataLen=0x540efd4*=0x2ab70) returned 1
	[0119.937] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f83b4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f83b4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.937] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0119.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.937] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\malgunn_boot.ttf", lpFilePart=0x0) returned 0x1e
	[0119.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.937] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.939] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\malgun_boot.ttf", lpFilePart=0x0) returned 0x1d
	[0119.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.939] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27f8878 | out: lpFileInformation=0x27f8878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506)) returned 1
	[0119.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0119.960] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\malgun_boot.ttf", lpFilePart=0x0) returned 0x1d
	[0119.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0119.960] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.961] GetFileType (hFile=0x5dc) returned 0x1
	[0119.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0119.961] GetFileType (hFile=0x5dc) returned 0x1
	[0119.961] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2b506
	[0119.961] ReadFile (in: hFile=0x5dc, lpBuffer=0x43a1378, nNumberOfBytesToRead=0x2b506, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x43a1378*, lpNumberOfBytesRead=0x540efcc*=0x2b506, lpOverlapped=0x0) returned 1
	[0119.989] CloseHandle (hObject=0x5dc) returned 1
	[0119.989] CryptDestroyKey (hKey=0x82b540) returned 1
	[0119.989] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.989] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f8ac8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0119.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.989] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0119.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.989] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27f8b80*=0x1, dwFlags=0x0) returned 1
	[0119.989] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27f8b4c, dwFlags=0x0) returned 1
	[0119.991] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x43cc8a0*, pdwDataLen=0x540efd4*=0x2b510, dwBufLen=0x2b510 | out: pbData=0x43cc8a0*, pdwDataLen=0x540efd4*=0x2b510) returned 1
	[0119.992] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f8b90*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f8b90*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0119.992] CryptDestroyKey (hKey=0x82b100) returned 1
	[0119.992] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.992] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.992] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\malgun_boot.ttf", lpFilePart=0x0) returned 0x1d
	[0119.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0119.992] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0119.993] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\meiryon_boot.ttf", lpFilePart=0x0) returned 0x1e
	[0119.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0119.993] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27f9044 | out: lpFileInformation=0x27f9044*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a)) returned 1
	[0120.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.011] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\meiryon_boot.ttf", lpFilePart=0x0) returned 0x1e
	[0120.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.012] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.012] GetFileType (hFile=0x5dc) returned 0x1
	[0120.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.012] GetFileType (hFile=0x5dc) returned 0x1
	[0120.012] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2318a
	[0120.012] ReadFile (in: hFile=0x5dc, lpBuffer=0x43f7dd0, nNumberOfBytesToRead=0x2318a, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x43f7dd0*, lpNumberOfBytesRead=0x540efcc*=0x2318a, lpOverlapped=0x0) returned 1
	[0120.047] CloseHandle (hObject=0x5dc) returned 1
	[0120.047] CryptDestroyKey (hKey=0x82b200) returned 1
	[0120.047] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.047] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f92a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0120.047] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.047] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.047] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0120.047] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.047] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27f935c*=0x1, dwFlags=0x0) returned 1
	[0120.047] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27f9328, dwFlags=0x0) returned 1
	[0120.050] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x441af78*, pdwDataLen=0x540efd4*=0x23190, dwBufLen=0x23190 | out: pbData=0x441af78*, pdwDataLen=0x540efd4*=0x23190) returned 1
	[0120.050] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f936c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f936c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.050] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0120.050] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.050] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.050] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\meiryon_boot.ttf", lpFilePart=0x0) returned 0x1e
	[0120.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.050] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.052] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\meiryo_boot.ttf", lpFilePart=0x0) returned 0x1d
	[0120.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.052] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27f9830 | out: lpFileInformation=0x27f9830*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b)) returned 1
	[0120.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.066] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\meiryo_boot.ttf", lpFilePart=0x0) returned 0x1d
	[0120.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.066] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.066] GetFileType (hFile=0x5dc) returned 0x1
	[0120.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.066] GetFileType (hFile=0x5dc) returned 0x1
	[0120.066] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2380b
	[0120.067] ReadFile (in: hFile=0x5dc, lpBuffer=0x66f1648, nNumberOfBytesToRead=0x2380b, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x66f1648*, lpNumberOfBytesRead=0x540efcc*=0x2380b, lpOverlapped=0x0) returned 1
	[0120.071] CloseHandle (hObject=0x5dc) returned 1
	[0120.071] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0120.071] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.071] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f9a80, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0120.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.071] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0120.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.072] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27f9b38*=0x1, dwFlags=0x0) returned 1
	[0120.072] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x27f9b04, dwFlags=0x0) returned 1
	[0120.074] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6714e70*, pdwDataLen=0x540efd4*=0x23810, dwBufLen=0x23810 | out: pbData=0x6714e70*, pdwDataLen=0x540efd4*=0x23810) returned 1
	[0120.074] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f9b48*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f9b48*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.074] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0120.074] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.074] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.074] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\meiryo_boot.ttf", lpFilePart=0x0) returned 0x1d
	[0120.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.074] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.076] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\msjhn_boot.ttf", lpFilePart=0x0) returned 0x1c
	[0120.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.077] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27f9ffc | out: lpFileInformation=0x27f9ffc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b)) returned 1
	[0120.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.077] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\msjhn_boot.ttf", lpFilePart=0x0) returned 0x1c
	[0120.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.077] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.077] GetFileType (hFile=0x5dc) returned 0x1
	[0120.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.077] GetFileType (hFile=0x5dc) returned 0x1
	[0120.077] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x27a1b
	[0120.078] ReadFile (in: hFile=0x5dc, lpBuffer=0x67386a0, nNumberOfBytesToRead=0x27a1b, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x67386a0*, lpNumberOfBytesRead=0x540efcc*=0x27a1b, lpOverlapped=0x0) returned 1
	[0120.082] CloseHandle (hObject=0x5dc) returned 1
	[0120.082] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0120.082] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.082] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fa24c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0120.082] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.082] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.082] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0120.082] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.082] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27fa304*=0x1, dwFlags=0x0) returned 1
	[0120.082] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x27fa2d0, dwFlags=0x0) returned 1
	[0120.085] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x67600d8*, pdwDataLen=0x540efd4*=0x27a20, dwBufLen=0x27a20 | out: pbData=0x67600d8*, pdwDataLen=0x540efd4*=0x27a20) returned 1
	[0120.085] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fa314*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27fa314*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.085] CryptDestroyKey (hKey=0x82b080) returned 1
	[0120.085] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.085] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.085] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\msjhn_boot.ttf", lpFilePart=0x0) returned 0x1c
	[0120.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.086] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.088] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\msjh_boot.ttf", lpFilePart=0x0) returned 0x1b
	[0120.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.088] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27fa7c4 | out: lpFileInformation=0x27fa7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb)) returned 1
	[0120.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.089] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\msjh_boot.ttf", lpFilePart=0x0) returned 0x1b
	[0120.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.089] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.089] GetFileType (hFile=0x5dc) returned 0x1
	[0120.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.089] GetFileType (hFile=0x5dc) returned 0x1
	[0120.090] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x281fb
	[0120.090] ReadFile (in: hFile=0x5dc, lpBuffer=0x6787b18, nNumberOfBytesToRead=0x281fb, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x6787b18*, lpNumberOfBytesRead=0x540efcc*=0x281fb, lpOverlapped=0x0) returned 1
	[0120.099] CloseHandle (hObject=0x5dc) returned 1
	[0120.099] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0120.099] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.099] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27faa04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0120.100] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.100] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.100] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0120.100] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.100] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27faabc*=0x1, dwFlags=0x0) returned 1
	[0120.100] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27faa88, dwFlags=0x0) returned 1
	[0120.102] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x67afd30*, pdwDataLen=0x540efd4*=0x28200, dwBufLen=0x28200 | out: pbData=0x67afd30*, pdwDataLen=0x540efd4*=0x28200) returned 1
	[0120.102] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27faacc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27faacc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.102] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0120.102] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.102] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.103] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\msjh_boot.ttf", lpFilePart=0x0) returned 0x1b
	[0120.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.103] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.105] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\msyhn_boot.ttf", lpFilePart=0x0) returned 0x1c
	[0120.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.105] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27faf6c | out: lpFileInformation=0x27faf6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b)) returned 1
	[0120.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.105] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\msyhn_boot.ttf", lpFilePart=0x0) returned 0x1c
	[0120.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.105] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.105] GetFileType (hFile=0x5dc) returned 0x1
	[0120.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.106] GetFileType (hFile=0x5dc) returned 0x1
	[0120.106] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x25b3b
	[0120.106] ReadFile (in: hFile=0x5dc, lpBuffer=0x67d7f50, nNumberOfBytesToRead=0x25b3b, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x67d7f50*, lpNumberOfBytesRead=0x540efcc*=0x25b3b, lpOverlapped=0x0) returned 1
	[0120.111] CloseHandle (hObject=0x5dc) returned 1
	[0120.111] CryptDestroyKey (hKey=0x82b480) returned 1
	[0120.111] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.111] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fb1bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b000) returned 1
	[0120.112] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.112] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.112] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0120.112] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.112] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27fb274*=0x1, dwFlags=0x0) returned 1
	[0120.112] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27fb240, dwFlags=0x0) returned 1
	[0120.114] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x67fdaa8*, pdwDataLen=0x540efd4*=0x25b40, dwBufLen=0x25b40 | out: pbData=0x67fdaa8*, pdwDataLen=0x540efd4*=0x25b40) returned 1
	[0120.114] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fb284*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27fb284*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.115] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.115] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\msyhn_boot.ttf", lpFilePart=0x0) returned 0x1c
	[0120.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.172] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.174] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\msyh_boot.ttf", lpFilePart=0x0) returned 0x1b
	[0120.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.174] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27fb734 | out: lpFileInformation=0x27fb734*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255)) returned 1
	[0120.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.174] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\msyh_boot.ttf", lpFilePart=0x0) returned 0x1b
	[0120.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.174] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.175] GetFileType (hFile=0x5dc) returned 0x1
	[0120.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.175] GetFileType (hFile=0x5dc) returned 0x1
	[0120.175] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x26255
	[0120.175] ReadFile (in: hFile=0x5dc, lpBuffer=0x6823608, nNumberOfBytesToRead=0x26255, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x6823608*, lpNumberOfBytesRead=0x540efcc*=0x26255, lpOverlapped=0x0) returned 1
	[0120.180] CloseHandle (hObject=0x5dc) returned 1
	[0120.180] CryptDestroyKey (hKey=0x82b000) returned 1
	[0120.180] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.180] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fb974, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0120.180] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.180] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.180] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0120.180] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.180] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27fba2c*=0x1, dwFlags=0x0) returned 1
	[0120.180] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27fb9f8, dwFlags=0x0) returned 1
	[0120.183] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6849880*, pdwDataLen=0x540efd4*=0x26260, dwBufLen=0x26260 | out: pbData=0x6849880*, pdwDataLen=0x540efd4*=0x26260) returned 1
	[0120.183] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fba3c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27fba3c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.183] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0120.183] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.183] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.183] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\msyh_boot.ttf", lpFilePart=0x0) returned 0x1b
	[0120.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.183] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.185] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\segmono_boot.ttf", lpFilePart=0x0) returned 0x1e
	[0120.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.186] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27fbedc | out: lpFileInformation=0x27fbedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b)) returned 1
	[0120.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.187] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\segmono_boot.ttf", lpFilePart=0x0) returned 0x1e
	[0120.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.187] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.187] GetFileType (hFile=0x5dc) returned 0x1
	[0120.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.187] GetFileType (hFile=0x5dc) returned 0x1
	[0120.187] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xaf3b
	[0120.188] ReadFile (in: hFile=0x5dc, lpBuffer=0x27fc0ac, nNumberOfBytesToRead=0xaf3b, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27fc0ac*, lpNumberOfBytesRead=0x540efcc*=0xaf3b, lpOverlapped=0x0) returned 1
	[0120.292] CloseHandle (hObject=0x5dc) returned 1
	[0120.292] CryptDestroyKey (hKey=0x82b540) returned 1
	[0120.292] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.292] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2807084, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0120.292] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.292] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.292] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0120.292] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.293] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x280713c*=0x1, dwFlags=0x0) returned 1
	[0120.293] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2807108, dwFlags=0x0) returned 1
	[0120.293] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x280714c*, pdwDataLen=0x540efd4*=0xaf40, dwBufLen=0xaf40 | out: pbData=0x280714c*, pdwDataLen=0x540efd4*=0xaf40) returned 1
	[0120.293] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2812098*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2812098*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.293] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.293] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.293] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.293] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\segmono_boot.ttf", lpFilePart=0x0) returned 0x1e
	[0120.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.293] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.295] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\segoen_slboot.ttf", lpFilePart=0x0) returned 0x1f
	[0120.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.295] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x281255c | out: lpFileInformation=0x281255c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66)) returned 1
	[0120.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.296] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\segoen_slboot.ttf", lpFilePart=0x0) returned 0x1f
	[0120.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.296] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.296] GetFileType (hFile=0x5dc) returned 0x1
	[0120.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.296] GetFileType (hFile=0x5dc) returned 0x1
	[0120.296] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x14f66
	[0120.297] ReadFile (in: hFile=0x5dc, lpBuffer=0x686fb00, nNumberOfBytesToRead=0x14f66, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x686fb00*, lpNumberOfBytesRead=0x540efcc*=0x14f66, lpOverlapped=0x0) returned 1
	[0120.299] CloseHandle (hObject=0x5dc) returned 1
	[0120.300] CryptDestroyKey (hKey=0x82b380) returned 1
	[0120.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.300] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28127bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0120.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.306] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0120.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.306] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x260cf58*=0x1, dwFlags=0x0) returned 1
	[0120.306] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x260cf18, dwFlags=0x0) returned 1
	[0120.307] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6884a88*, pdwDataLen=0x540efd4*=0x14f70, dwBufLen=0x14f70 | out: pbData=0x6884a88*, pdwDataLen=0x540efd4*=0x14f70) returned 1
	[0120.308] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260cf68*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x260cf68*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.308] CryptDestroyKey (hKey=0x82b380) returned 1
	[0120.308] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.308] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.308] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\segoen_slboot.ttf", lpFilePart=0x0) returned 0x1f
	[0120.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.308] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.310] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\segoe_slboot.ttf", lpFilePart=0x0) returned 0x1e
	[0120.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.310] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x260d430 | out: lpFileInformation=0x260d430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2)) returned 1
	[0120.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.311] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\segoe_slboot.ttf", lpFilePart=0x0) returned 0x1e
	[0120.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.311] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.311] GetFileType (hFile=0x5dc) returned 0x1
	[0120.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.311] GetFileType (hFile=0x5dc) returned 0x1
	[0120.311] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x150a2
	[0120.312] ReadFile (in: hFile=0x5dc, lpBuffer=0x6899a18, nNumberOfBytesToRead=0x150a2, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x6899a18*, lpNumberOfBytesRead=0x540efcc*=0x150a2, lpOverlapped=0x0) returned 1
	[0120.314] CloseHandle (hObject=0x5dc) returned 1
	[0120.314] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0120.314] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.315] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260d690, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0120.315] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.315] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.315] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0120.315] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.315] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x260d748*=0x1, dwFlags=0x0) returned 1
	[0120.315] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x260d714, dwFlags=0x0) returned 1
	[0120.316] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68aead8*, pdwDataLen=0x540efd4*=0x150b0, dwBufLen=0x150b0 | out: pbData=0x68aead8*, pdwDataLen=0x540efd4*=0x150b0) returned 1
	[0120.316] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260d758*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x260d758*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.316] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.316] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.316] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.316] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\segoe_slboot.ttf", lpFilePart=0x0) returned 0x1e
	[0120.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.317] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.319] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\wgl4_boot.ttf", lpFilePart=0x0) returned 0x1b
	[0120.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.319] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x260dc1c | out: lpFileInformation=0x260dc1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3)) returned 1
	[0120.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.319] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\wgl4_boot.ttf", lpFilePart=0x0) returned 0x1b
	[0120.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.319] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.319] GetFileType (hFile=0x5dc) returned 0x1
	[0120.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.319] GetFileType (hFile=0x5dc) returned 0x1
	[0120.320] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xbfc3
	[0120.320] ReadFile (in: hFile=0x5dc, lpBuffer=0x260ddcc, nNumberOfBytesToRead=0xbfc3, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x260ddcc*, lpNumberOfBytesRead=0x540efcc*=0xbfc3, lpOverlapped=0x0) returned 1
	[0120.321] CloseHandle (hObject=0x5dc) returned 1
	[0120.321] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.321] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.321] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2619e2c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0120.322] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.322] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.322] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0120.322] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.322] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2619ee4*=0x1, dwFlags=0x0) returned 1
	[0120.322] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2619eb0, dwFlags=0x0) returned 1
	[0120.322] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2619ef4*, pdwDataLen=0x540efd4*=0xbfd0, dwBufLen=0xbfd0 | out: pbData=0x2619ef4*, pdwDataLen=0x540efd4*=0xbfd0) returned 1
	[0120.322] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2625ed0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2625ed0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.322] CryptDestroyKey (hKey=0x82b380) returned 1
	[0120.322] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.322] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.322] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\wgl4_boot.ttf", lpFilePart=0x0) returned 0x1b
	[0120.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.323] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.324] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-CA\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.325] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2626370 | out: lpFileInformation=0x2626370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560)) returned 1
	[0120.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.325] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-CA\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.325] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.325] GetFileType (hFile=0x5dc) returned 0x1
	[0120.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.325] GetFileType (hFile=0x5dc) returned 0x1
	[0120.326] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x13560
	[0120.326] ReadFile (in: hFile=0x5dc, lpBuffer=0x2626530, nNumberOfBytesToRead=0x13560, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2626530*, lpNumberOfBytesRead=0x540efcc*=0x13560, lpOverlapped=0x0) returned 1
	[0120.327] CloseHandle (hObject=0x5dc) returned 1
	[0120.328] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.328] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.328] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2639b2c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0120.328] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.328] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.328] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0120.328] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.328] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2639be4*=0x1, dwFlags=0x0) returned 1
	[0120.328] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2639bb0, dwFlags=0x0) returned 1
	[0120.328] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2639bf4*, pdwDataLen=0x540efd4*=0x13570, dwBufLen=0x13570 | out: pbData=0x2639bf4*, pdwDataLen=0x540efd4*=0x13570) returned 1
	[0120.328] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264d170*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x264d170*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.328] CryptDestroyKey (hKey=0x82b300) returned 1
	[0120.329] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.329] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.329] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-CA\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.329] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.331] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.331] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x264d624 | out: lpFileInformation=0x264d624*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558)) returned 1
	[0120.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.331] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.331] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.331] GetFileType (hFile=0x5dc) returned 0x1
	[0120.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.332] GetFileType (hFile=0x5dc) returned 0x1
	[0120.332] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x13558
	[0120.332] ReadFile (in: hFile=0x5dc, lpBuffer=0x264d7e4, nNumberOfBytesToRead=0x13558, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x264d7e4*, lpNumberOfBytesRead=0x540efcc*=0x13558, lpOverlapped=0x0) returned 1
	[0120.357] CloseHandle (hObject=0x5dc) returned 1
	[0120.357] CryptDestroyKey (hKey=0x82b340) returned 1
	[0120.357] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.357] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2660dd8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0120.357] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.357] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.357] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0120.358] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.358] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2660e90*=0x1, dwFlags=0x0) returned 1
	[0120.358] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2660e5c, dwFlags=0x0) returned 1
	[0120.358] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2660ea0*, pdwDataLen=0x540efd4*=0x13560, dwBufLen=0x13560 | out: pbData=0x2660ea0*, pdwDataLen=0x540efd4*=0x13560) returned 1
	[0120.358] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267440c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x267440c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.358] CryptDestroyKey (hKey=0x82b080) returned 1
	[0120.358] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.358] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.358] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.358] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.360] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.360] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26748c0 | out: lpFileInformation=0x26748c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0)) returned 1
	[0120.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.361] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.361] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.361] GetFileType (hFile=0x5dc) returned 0x1
	[0120.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.361] GetFileType (hFile=0x5dc) returned 0x1
	[0120.361] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb3a0
	[0120.361] ReadFile (in: hFile=0x5dc, lpBuffer=0x2674a80, nNumberOfBytesToRead=0xb3a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2674a80*, lpNumberOfBytesRead=0x540efcc*=0xb3a0, lpOverlapped=0x0) returned 1
	[0120.363] CloseHandle (hObject=0x5dc) returned 1
	[0120.363] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.363] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.363] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267febc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0120.363] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.363] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.363] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0120.363] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.363] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x267ff74*=0x1, dwFlags=0x0) returned 1
	[0120.364] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x267ff40, dwFlags=0x0) returned 1
	[0120.364] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267ff84*, pdwDataLen=0x540efd4*=0xb3b0, dwBufLen=0xb3b0 | out: pbData=0x267ff84*, pdwDataLen=0x540efd4*=0xb3b0) returned 1
	[0120.364] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268b340*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x268b340*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.364] CryptDestroyKey (hKey=0x82b200) returned 1
	[0120.364] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.364] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.364] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.364] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.366] GetFullPathNameW (in: lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hr-HR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.366] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x268b7f4 | out: lpFileInformation=0x268b7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60)) returned 1
	[0120.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.367] GetFullPathNameW (in: lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hr-HR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.367] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.367] GetFileType (hFile=0x5dc) returned 0x1
	[0120.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.367] GetFileType (hFile=0x5dc) returned 0x1
	[0120.367] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12b60
	[0120.367] ReadFile (in: hFile=0x5dc, lpBuffer=0x268b9b4, nNumberOfBytesToRead=0x12b60, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x268b9b4*, lpNumberOfBytesRead=0x540efcc*=0x12b60, lpOverlapped=0x0) returned 1
	[0120.369] CloseHandle (hObject=0x5dc) returned 1
	[0120.369] CryptDestroyKey (hKey=0x82b080) returned 1
	[0120.369] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.369] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269e5b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0120.369] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.369] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.369] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0120.369] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.369] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x269e668*=0x1, dwFlags=0x0) returned 1
	[0120.369] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x269e634, dwFlags=0x0) returned 1
	[0120.370] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269e678*, pdwDataLen=0x540efd4*=0x12b70, dwBufLen=0x12b70 | out: pbData=0x269e678*, pdwDataLen=0x540efd4*=0x12b70) returned 1
	[0120.370] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b11f4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b11f4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.370] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.370] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.370] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.370] GetFullPathNameW (in: lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hr-HR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.370] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.372] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.372] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26b16a8 | out: lpFileInformation=0x26b16a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360)) returned 1
	[0120.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.372] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.372] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.372] GetFileType (hFile=0x5dc) returned 0x1
	[0120.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.373] GetFileType (hFile=0x5dc) returned 0x1
	[0120.373] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x13360
	[0120.373] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b1868, nNumberOfBytesToRead=0x13360, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26b1868*, lpNumberOfBytesRead=0x540efcc*=0x13360, lpOverlapped=0x0) returned 1
	[0120.375] CloseHandle (hObject=0x5dc) returned 1
	[0120.375] CryptDestroyKey (hKey=0x82b540) returned 1
	[0120.375] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.375] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c4c64, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0120.375] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.375] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.375] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0120.375] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.375] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x26c4d1c*=0x1, dwFlags=0x0) returned 1
	[0120.375] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26c4ce8, dwFlags=0x0) returned 1
	[0120.375] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c4d2c*, pdwDataLen=0x540efd4*=0x13370, dwBufLen=0x13370 | out: pbData=0x26c4d2c*, pdwDataLen=0x540efd4*=0x13370) returned 1
	[0120.376] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d80a8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26d80a8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.376] CryptDestroyKey (hKey=0x82b400) returned 1
	[0120.376] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.376] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.376] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.376] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.378] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.378] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26d855c | out: lpFileInformation=0x26d855c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398)) returned 1
	[0120.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.378] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.378] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.379] GetFileType (hFile=0x5dc) returned 0x1
	[0120.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.379] GetFileType (hFile=0x5dc) returned 0x1
	[0120.379] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb398
	[0120.379] ReadFile (in: hFile=0x5dc, lpBuffer=0x26d871c, nNumberOfBytesToRead=0xb398, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d871c*, lpNumberOfBytesRead=0x540efcc*=0xb398, lpOverlapped=0x0) returned 1
	[0120.381] CloseHandle (hObject=0x5dc) returned 1
	[0120.381] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.381] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e3b50, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0120.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.381] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0120.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.381] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26e3c08*=0x1, dwFlags=0x0) returned 1
	[0120.381] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26e3bd4, dwFlags=0x0) returned 1
	[0120.381] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e3c18*, pdwDataLen=0x540efd4*=0xb3a0, dwBufLen=0xb3a0 | out: pbData=0x26e3c18*, pdwDataLen=0x540efd4*=0xb3a0) returned 1
	[0120.381] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26eefc4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26eefc4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.381] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.381] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.382] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.383] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.384] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26ef478 | out: lpFileInformation=0x26ef478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58)) returned 1
	[0120.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.384] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.384] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.384] GetFileType (hFile=0x5dc) returned 0x1
	[0120.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.384] GetFileType (hFile=0x5dc) returned 0x1
	[0120.384] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12d58
	[0120.384] ReadFile (in: hFile=0x5dc, lpBuffer=0x26ef638, nNumberOfBytesToRead=0x12d58, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ef638*, lpNumberOfBytesRead=0x540efcc*=0x12d58, lpOverlapped=0x0) returned 1
	[0120.387] CloseHandle (hObject=0x5dc) returned 1
	[0120.387] CryptDestroyKey (hKey=0x82b540) returned 1
	[0120.387] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.387] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270242c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0120.387] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.387] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.387] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0120.387] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.387] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27024e4*=0x1, dwFlags=0x0) returned 1
	[0120.387] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27024b0, dwFlags=0x0) returned 1
	[0120.387] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27024f4*, pdwDataLen=0x540efd4*=0x12d60, dwBufLen=0x12d60 | out: pbData=0x27024f4*, pdwDataLen=0x540efd4*=0x12d60) returned 1
	[0120.387] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2715260*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2715260*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.387] CryptDestroyKey (hKey=0x82b480) returned 1
	[0120.387] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.387] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.388] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.388] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.390] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.390] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2715714 | out: lpFileInformation=0x2715714*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0)) returned 1
	[0120.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.390] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.390] CreateFileW (lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.390] GetFileType (hFile=0x5dc) returned 0x1
	[0120.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.390] GetFileType (hFile=0x5dc) returned 0x1
	[0120.390] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb1a0
	[0120.391] ReadFile (in: hFile=0x5dc, lpBuffer=0x27158d4, nNumberOfBytesToRead=0xb1a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27158d4*, lpNumberOfBytesRead=0x540efcc*=0xb1a0, lpOverlapped=0x0) returned 1
	[0120.396] CloseHandle (hObject=0x5dc) returned 1
	[0120.397] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.397] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.397] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2720b10, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0120.397] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.397] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.397] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0120.397] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.397] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2720bc8*=0x1, dwFlags=0x0) returned 1
	[0120.397] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2720b94, dwFlags=0x0) returned 1
	[0120.397] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2720bd8*, pdwDataLen=0x540efd4*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x2720bd8*, pdwDataLen=0x540efd4*=0xb1b0) returned 1
	[0120.397] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272bd94*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x272bd94*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.397] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0120.397] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.397] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.397] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.398] CreateFileW (lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.400] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.400] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x272c248 | out: lpFileInformation=0x272c248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760)) returned 1
	[0120.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.401] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.401] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.401] GetFileType (hFile=0x5dc) returned 0x1
	[0120.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.401] GetFileType (hFile=0x5dc) returned 0x1
	[0120.401] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10760
	[0120.401] ReadFile (in: hFile=0x5dc, lpBuffer=0x272c408, nNumberOfBytesToRead=0x10760, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x272c408*, lpNumberOfBytesRead=0x540efcc*=0x10760, lpOverlapped=0x0) returned 1
	[0120.404] CloseHandle (hObject=0x5dc) returned 1
	[0120.404] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.404] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.404] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273cc04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0120.405] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.405] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.405] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0120.405] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.405] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x273ccbc*=0x1, dwFlags=0x0) returned 1
	[0120.405] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x273cc88, dwFlags=0x0) returned 1
	[0120.405] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273cccc*, pdwDataLen=0x540efd4*=0x10770, dwBufLen=0x10770 | out: pbData=0x273cccc*, pdwDataLen=0x540efd4*=0x10770) returned 1
	[0120.405] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274d448*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x274d448*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.405] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.405] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.405] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.405] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.405] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.407] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.407] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x274d8fc | out: lpFileInformation=0x274d8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798)) returned 1
	[0120.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.408] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.408] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.408] GetFileType (hFile=0x5dc) returned 0x1
	[0120.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.408] GetFileType (hFile=0x5dc) returned 0x1
	[0120.408] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xa798
	[0120.408] ReadFile (in: hFile=0x5dc, lpBuffer=0x274dabc, nNumberOfBytesToRead=0xa798, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x274dabc*, lpNumberOfBytesRead=0x540efcc*=0xa798, lpOverlapped=0x0) returned 1
	[0120.412] CloseHandle (hObject=0x5dc) returned 1
	[0120.412] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0120.412] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.412] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27582f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0120.412] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.412] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.412] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0120.412] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.412] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27583a8*=0x1, dwFlags=0x0) returned 1
	[0120.413] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x2758374, dwFlags=0x0) returned 1
	[0120.413] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27583b8*, pdwDataLen=0x540efd4*=0xa7a0, dwBufLen=0xa7a0 | out: pbData=0x27583b8*, pdwDataLen=0x540efd4*=0xa7a0) returned 1
	[0120.413] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2762b64*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2762b64*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.413] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0120.413] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.413] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.413] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.413] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.415] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.415] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2763018 | out: lpFileInformation=0x2763018*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560)) returned 1
	[0120.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.416] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.416] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.416] GetFileType (hFile=0x5dc) returned 0x1
	[0120.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.416] GetFileType (hFile=0x5dc) returned 0x1
	[0120.416] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10560
	[0120.416] ReadFile (in: hFile=0x5dc, lpBuffer=0x27631d8, nNumberOfBytesToRead=0x10560, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27631d8*, lpNumberOfBytesRead=0x540efcc*=0x10560, lpOverlapped=0x0) returned 1
	[0120.418] CloseHandle (hObject=0x5dc) returned 1
	[0120.418] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.418] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.418] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27737d4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0120.418] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.418] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.418] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0120.418] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.418] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x277388c*=0x1, dwFlags=0x0) returned 1
	[0120.419] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2773858, dwFlags=0x0) returned 1
	[0120.419] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277389c*, pdwDataLen=0x540efd4*=0x10570, dwBufLen=0x10570 | out: pbData=0x277389c*, pdwDataLen=0x540efd4*=0x10570) returned 1
	[0120.419] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2783e18*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2783e18*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.419] CryptDestroyKey (hKey=0x82b480) returned 1
	[0120.419] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.419] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.419] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.419] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.421] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.421] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27842cc | out: lpFileInformation=0x27842cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0)) returned 1
	[0120.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.421] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.422] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.422] GetFileType (hFile=0x5dc) returned 0x1
	[0120.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.422] GetFileType (hFile=0x5dc) returned 0x1
	[0120.422] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xa7a0
	[0120.422] ReadFile (in: hFile=0x5dc, lpBuffer=0x278448c, nNumberOfBytesToRead=0xa7a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x278448c*, lpNumberOfBytesRead=0x540efcc*=0xa7a0, lpOverlapped=0x0) returned 1
	[0120.424] CloseHandle (hObject=0x5dc) returned 1
	[0120.424] CryptDestroyKey (hKey=0x82b440) returned 1
	[0120.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.424] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278ecc8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b0c0) returned 1
	[0120.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.424] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0120.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.424] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x278ed80*=0x1, dwFlags=0x0) returned 1
	[0120.424] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x278ed4c, dwFlags=0x0) returned 1
	[0120.424] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278ed90*, pdwDataLen=0x540efd4*=0xa7b0, dwBufLen=0xa7b0 | out: pbData=0x278ed90*, pdwDataLen=0x540efd4*=0xa7b0) returned 1
	[0120.424] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279954c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x279954c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.424] CryptDestroyKey (hKey=0x82b400) returned 1
	[0120.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.425] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.425] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.427] GetFullPathNameW (in: lpFileName="C:\\Boot\\lt-LT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\lt-LT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.427] GetFileAttributesExW (in: lpFileName="C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2799a00 | out: lpFileInformation=0x2799a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760)) returned 1
	[0120.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.427] GetFullPathNameW (in: lpFileName="C:\\Boot\\lt-LT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\lt-LT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.427] CreateFileW (lpFileName="C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.428] GetFileType (hFile=0x5dc) returned 0x1
	[0120.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.428] GetFileType (hFile=0x5dc) returned 0x1
	[0120.428] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12760
	[0120.428] ReadFile (in: hFile=0x5dc, lpBuffer=0x2799bc0, nNumberOfBytesToRead=0x12760, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2799bc0*, lpNumberOfBytesRead=0x540efcc*=0x12760, lpOverlapped=0x0) returned 1
	[0120.430] CloseHandle (hObject=0x5dc) returned 1
	[0120.430] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0120.430] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.430] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ac3bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0120.430] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.430] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.430] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0120.430] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.430] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27ac474*=0x1, dwFlags=0x0) returned 1
	[0120.430] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27ac440, dwFlags=0x0) returned 1
	[0120.430] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ac484*, pdwDataLen=0x540efd4*=0x12770, dwBufLen=0x12770 | out: pbData=0x27ac484*, pdwDataLen=0x540efd4*=0x12770) returned 1
	[0120.430] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27bec00*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27bec00*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.431] CryptDestroyKey (hKey=0x82b380) returned 1
	[0120.431] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.431] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.431] GetFullPathNameW (in: lpFileName="C:\\Boot\\lt-LT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\lt-LT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.431] CreateFileW (lpFileName="C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.433] GetFullPathNameW (in: lpFileName="C:\\Boot\\lv-LV\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\lv-LV\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.433] GetFileAttributesExW (in: lpFileName="C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27bf0b4 | out: lpFileInformation=0x27bf0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758)) returned 1
	[0120.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.433] GetFullPathNameW (in: lpFileName="C:\\Boot\\lv-LV\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\lv-LV\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.433] CreateFileW (lpFileName="C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.433] GetFileType (hFile=0x5dc) returned 0x1
	[0120.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.434] GetFileType (hFile=0x5dc) returned 0x1
	[0120.434] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12758
	[0120.434] ReadFile (in: hFile=0x5dc, lpBuffer=0x27bf274, nNumberOfBytesToRead=0x12758, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27bf274*, lpNumberOfBytesRead=0x540efcc*=0x12758, lpOverlapped=0x0) returned 1
	[0120.457] CloseHandle (hObject=0x5dc) returned 1
	[0120.457] CryptDestroyKey (hKey=0x82b100) returned 1
	[0120.457] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.458] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d1a68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0120.458] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.458] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.458] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0120.458] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.458] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x27d1b20*=0x1, dwFlags=0x0) returned 1
	[0120.458] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x27d1aec, dwFlags=0x0) returned 1
	[0120.458] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d1b30*, pdwDataLen=0x540efd4*=0x12760, dwBufLen=0x12760 | out: pbData=0x27d1b30*, pdwDataLen=0x540efd4*=0x12760) returned 1
	[0120.458] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e429c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27e429c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.458] CryptDestroyKey (hKey=0x82b000) returned 1
	[0120.458] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.458] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.458] GetFullPathNameW (in: lpFileName="C:\\Boot\\lv-LV\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\lv-LV\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.458] CreateFileW (lpFileName="C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.460] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.461] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27e4750 | out: lpFileInformation=0x27e4750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760)) returned 1
	[0120.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.461] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.461] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.461] GetFileType (hFile=0x5dc) returned 0x1
	[0120.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.461] GetFileType (hFile=0x5dc) returned 0x1
	[0120.461] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12760
	[0120.462] ReadFile (in: hFile=0x5dc, lpBuffer=0x27e4910, nNumberOfBytesToRead=0x12760, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27e4910*, lpNumberOfBytesRead=0x540efcc*=0x12760, lpOverlapped=0x0) returned 1
	[0120.468] CloseHandle (hObject=0x5dc) returned 1
	[0120.468] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.468] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.468] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f710c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0120.468] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.468] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.468] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0120.468] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.468] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27f71c4*=0x1, dwFlags=0x0) returned 1
	[0120.468] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27f7190, dwFlags=0x0) returned 1
	[0120.468] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f71d4*, pdwDataLen=0x540efd4*=0x12770, dwBufLen=0x12770 | out: pbData=0x27f71d4*, pdwDataLen=0x540efd4*=0x12770) returned 1
	[0120.468] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2809950*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2809950*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.468] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.468] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.468] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.468] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.469] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.470] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.471] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2809e04 | out: lpFileInformation=0x2809e04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0)) returned 1
	[0120.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.471] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.471] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.471] GetFileType (hFile=0x5dc) returned 0x1
	[0120.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.471] GetFileType (hFile=0x5dc) returned 0x1
	[0120.471] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb1a0
	[0120.471] ReadFile (in: hFile=0x5dc, lpBuffer=0x2809fc4, nNumberOfBytesToRead=0xb1a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2809fc4*, lpNumberOfBytesRead=0x540efcc*=0xb1a0, lpOverlapped=0x0) returned 1
	[0120.473] CloseHandle (hObject=0x5dc) returned 1
	[0120.473] CryptDestroyKey (hKey=0x82b340) returned 1
	[0120.473] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.473] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2815200, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0120.473] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.473] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.473] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0120.473] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.474] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x28152b8*=0x1, dwFlags=0x0) returned 1
	[0120.474] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2815284, dwFlags=0x0) returned 1
	[0120.477] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26188b4*, pdwDataLen=0x540efd4*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x26188b4*, pdwDataLen=0x540efd4*=0xb1b0) returned 1
	[0120.478] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2623a70*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2623a70*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.478] CryptDestroyKey (hKey=0x82b040) returned 1
	[0120.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.478] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.478] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.481] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.481] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2623f24 | out: lpFileInformation=0x2623f24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160)) returned 1
	[0120.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.481] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.481] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.482] GetFileType (hFile=0x5dc) returned 0x1
	[0120.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.482] GetFileType (hFile=0x5dc) returned 0x1
	[0120.482] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x13160
	[0120.482] ReadFile (in: hFile=0x5dc, lpBuffer=0x26240e4, nNumberOfBytesToRead=0x13160, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26240e4*, lpNumberOfBytesRead=0x540efcc*=0x13160, lpOverlapped=0x0) returned 1
	[0120.484] CloseHandle (hObject=0x5dc) returned 1
	[0120.484] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.484] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.484] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26372e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0120.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.485] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0120.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.485] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2637398*=0x1, dwFlags=0x0) returned 1
	[0120.485] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2637364, dwFlags=0x0) returned 1
	[0120.485] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26373a8*, pdwDataLen=0x540efd4*=0x13170, dwBufLen=0x13170 | out: pbData=0x26373a8*, pdwDataLen=0x540efd4*=0x13170) returned 1
	[0120.485] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264a524*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x264a524*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.485] CryptDestroyKey (hKey=0x82b280) returned 1
	[0120.485] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.485] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.485] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.485] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.487] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.487] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x264a9d8 | out: lpFileInformation=0x264a9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0)) returned 1
	[0120.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.488] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.488] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.488] GetFileType (hFile=0x5dc) returned 0x1
	[0120.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.488] GetFileType (hFile=0x5dc) returned 0x1
	[0120.488] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb1a0
	[0120.489] ReadFile (in: hFile=0x5dc, lpBuffer=0x264ab98, nNumberOfBytesToRead=0xb1a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x264ab98*, lpNumberOfBytesRead=0x540efcc*=0xb1a0, lpOverlapped=0x0) returned 1
	[0120.491] CloseHandle (hObject=0x5dc) returned 1
	[0120.491] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0120.491] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.491] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2655dd4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0120.491] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.491] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.491] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0120.491] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.491] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2655e8c*=0x1, dwFlags=0x0) returned 1
	[0120.492] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2655e58, dwFlags=0x0) returned 1
	[0120.492] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2655e9c*, pdwDataLen=0x540efd4*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x2655e9c*, pdwDataLen=0x540efd4*=0xb1b0) returned 1
	[0120.492] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2661058*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2661058*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.492] CryptDestroyKey (hKey=0x82b200) returned 1
	[0120.492] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.492] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.492] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.492] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.494] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.494] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x266150c | out: lpFileInformation=0x266150c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58)) returned 1
	[0120.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.495] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.495] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.495] GetFileType (hFile=0x5dc) returned 0x1
	[0120.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.496] GetFileType (hFile=0x5dc) returned 0x1
	[0120.496] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12f58
	[0120.496] ReadFile (in: hFile=0x5dc, lpBuffer=0x26616cc, nNumberOfBytesToRead=0x12f58, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26616cc*, lpNumberOfBytesRead=0x540efcc*=0x12f58, lpOverlapped=0x0) returned 1
	[0120.498] CloseHandle (hObject=0x5dc) returned 1
	[0120.498] CryptDestroyKey (hKey=0x82b280) returned 1
	[0120.498] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.498] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26746c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0120.498] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.498] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.499] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0120.499] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.499] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2674778*=0x1, dwFlags=0x0) returned 1
	[0120.499] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2674744, dwFlags=0x0) returned 1
	[0120.499] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2674788*, pdwDataLen=0x540efd4*=0x12f60, dwBufLen=0x12f60 | out: pbData=0x2674788*, pdwDataLen=0x540efd4*=0x12f60) returned 1
	[0120.499] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26876f4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26876f4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.499] CryptDestroyKey (hKey=0x82b540) returned 1
	[0120.499] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.499] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.499] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.499] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.502] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.502] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2687ba8 | out: lpFileInformation=0x2687ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0)) returned 1
	[0120.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.502] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.502] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.503] GetFileType (hFile=0x5dc) returned 0x1
	[0120.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.503] GetFileType (hFile=0x5dc) returned 0x1
	[0120.503] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb3a0
	[0120.503] ReadFile (in: hFile=0x5dc, lpBuffer=0x2687d68, nNumberOfBytesToRead=0xb3a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2687d68*, lpNumberOfBytesRead=0x540efcc*=0xb3a0, lpOverlapped=0x0) returned 1
	[0120.520] CloseHandle (hObject=0x5dc) returned 1
	[0120.520] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.521] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.521] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26931a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0120.521] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.521] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.521] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0120.521] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.521] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x269325c*=0x1, dwFlags=0x0) returned 1
	[0120.521] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2693228, dwFlags=0x0) returned 1
	[0120.521] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269326c*, pdwDataLen=0x540efd4*=0xb3b0, dwBufLen=0xb3b0 | out: pbData=0x269326c*, pdwDataLen=0x540efd4*=0xb3b0) returned 1
	[0120.521] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269e628*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x269e628*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.521] CryptDestroyKey (hKey=0x82b000) returned 1
	[0120.521] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.522] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.522] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.522] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.531] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.531] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x269eadc | out: lpFileInformation=0x269eadc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60)) returned 1
	[0120.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.531] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.531] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.531] GetFileType (hFile=0x5dc) returned 0x1
	[0120.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.532] GetFileType (hFile=0x5dc) returned 0x1
	[0120.532] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12b60
	[0120.532] ReadFile (in: hFile=0x5dc, lpBuffer=0x269ec9c, nNumberOfBytesToRead=0x12b60, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x269ec9c*, lpNumberOfBytesRead=0x540efcc*=0x12b60, lpOverlapped=0x0) returned 1
	[0120.534] CloseHandle (hObject=0x5dc) returned 1
	[0120.534] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0120.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.534] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b1898, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0120.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.535] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0120.535] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.535] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26b1950*=0x1, dwFlags=0x0) returned 1
	[0120.535] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x26b191c, dwFlags=0x0) returned 1
	[0120.535] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b1960*, pdwDataLen=0x540efd4*=0x12b70, dwBufLen=0x12b70 | out: pbData=0x26b1960*, pdwDataLen=0x540efd4*=0x12b70) returned 1
	[0120.535] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c44dc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c44dc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.535] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0120.535] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.535] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.535] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.535] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.538] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.538] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26c4990 | out: lpFileInformation=0x26c4990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0)) returned 1
	[0120.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.538] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.538] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.538] GetFileType (hFile=0x5dc) returned 0x1
	[0120.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.539] GetFileType (hFile=0x5dc) returned 0x1
	[0120.539] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb1a0
	[0120.539] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c4b50, nNumberOfBytesToRead=0xb1a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c4b50*, lpNumberOfBytesRead=0x540efcc*=0xb1a0, lpOverlapped=0x0) returned 1
	[0120.540] CloseHandle (hObject=0x5dc) returned 1
	[0120.541] CryptDestroyKey (hKey=0x82b340) returned 1
	[0120.541] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.541] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26cfd8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0120.541] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.541] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.541] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0120.541] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.541] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26cfe44*=0x1, dwFlags=0x0) returned 1
	[0120.541] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26cfe10, dwFlags=0x0) returned 1
	[0120.541] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26cfe54*, pdwDataLen=0x540efd4*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x26cfe54*, pdwDataLen=0x540efd4*=0xb1b0) returned 1
	[0120.541] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26db010*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26db010*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.541] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0120.541] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.542] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.542] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.542] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.544] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.544] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26db4c4 | out: lpFileInformation=0x26db4c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60)) returned 1
	[0120.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.544] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.545] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.545] GetFileType (hFile=0x5dc) returned 0x1
	[0120.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.545] GetFileType (hFile=0x5dc) returned 0x1
	[0120.545] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12b60
	[0120.545] ReadFile (in: hFile=0x5dc, lpBuffer=0x26db684, nNumberOfBytesToRead=0x12b60, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26db684*, lpNumberOfBytesRead=0x540efcc*=0x12b60, lpOverlapped=0x0) returned 1
	[0120.547] CloseHandle (hObject=0x5dc) returned 1
	[0120.547] CryptDestroyKey (hKey=0x82b040) returned 1
	[0120.547] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.548] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ee280, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0120.548] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.548] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.548] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0120.548] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.548] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26ee338*=0x1, dwFlags=0x0) returned 1
	[0120.548] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26ee304, dwFlags=0x0) returned 1
	[0120.548] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ee348*, pdwDataLen=0x540efd4*=0x12b70, dwBufLen=0x12b70 | out: pbData=0x26ee348*, pdwDataLen=0x540efd4*=0x12b70) returned 1
	[0120.548] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2700ec4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2700ec4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.548] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.548] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.549] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.549] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.549] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.551] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.551] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2701378 | out: lpFileInformation=0x2701378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0)) returned 1
	[0120.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.552] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.552] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.552] GetFileType (hFile=0x5dc) returned 0x1
	[0120.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.552] GetFileType (hFile=0x5dc) returned 0x1
	[0120.552] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb3a0
	[0120.553] ReadFile (in: hFile=0x5dc, lpBuffer=0x2701538, nNumberOfBytesToRead=0xb3a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2701538*, lpNumberOfBytesRead=0x540efcc*=0xb3a0, lpOverlapped=0x0) returned 1
	[0120.567] CloseHandle (hObject=0x5dc) returned 1
	[0120.567] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.568] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.568] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270c974, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0120.568] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.568] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.568] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0120.568] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.568] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x270ca2c*=0x1, dwFlags=0x0) returned 1
	[0120.568] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x270c9f8, dwFlags=0x0) returned 1
	[0120.569] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270ca3c*, pdwDataLen=0x540efd4*=0xb3b0, dwBufLen=0xb3b0 | out: pbData=0x270ca3c*, pdwDataLen=0x540efd4*=0xb3b0) returned 1
	[0120.569] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2717df8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2717df8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.569] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.569] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.569] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.569] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.569] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.571] GetFullPathNameW (in: lpFileName="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x20
	[0120.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.571] GetFileAttributesExW (in: lpFileName="C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27182ac | out: lpFileInformation=0x27182ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160)) returned 1
	[0120.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.572] GetFullPathNameW (in: lpFileName="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x20
	[0120.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.572] CreateFileW (lpFileName="C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.572] GetFileType (hFile=0x5dc) returned 0x1
	[0120.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.572] GetFileType (hFile=0x5dc) returned 0x1
	[0120.573] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12160
	[0120.573] ReadFile (in: hFile=0x5dc, lpBuffer=0x271847c, nNumberOfBytesToRead=0x12160, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271847c*, lpNumberOfBytesRead=0x540efcc*=0x12160, lpOverlapped=0x0) returned 1
	[0120.575] CloseHandle (hObject=0x5dc) returned 1
	[0120.575] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.575] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272a678, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0120.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.575] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0120.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.575] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x272a730*=0x1, dwFlags=0x0) returned 1
	[0120.575] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x272a6fc, dwFlags=0x0) returned 1
	[0120.576] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272a740*, pdwDataLen=0x540efd4*=0x12170, dwBufLen=0x12170 | out: pbData=0x272a740*, pdwDataLen=0x540efd4*=0x12170) returned 1
	[0120.576] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273c8bc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x273c8bc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.576] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0120.576] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.576] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.576] GetFullPathNameW (in: lpFileName="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x20
	[0120.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.576] CreateFileW (lpFileName="C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.578] GetFullPathNameW (in: lpFileName="C:\\Boot\\qps-ploc\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\qps-ploc\\memtest.exe.mui", lpFilePart=0x0) returned 0x20
	[0120.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.578] GetFileAttributesExW (in: lpFileName="C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x273cd8c | out: lpFileInformation=0x273cd8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398)) returned 1
	[0120.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.579] GetFullPathNameW (in: lpFileName="C:\\Boot\\qps-ploc\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\qps-ploc\\memtest.exe.mui", lpFilePart=0x0) returned 0x20
	[0120.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.579] CreateFileW (lpFileName="C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.579] GetFileType (hFile=0x5dc) returned 0x1
	[0120.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.579] GetFileType (hFile=0x5dc) returned 0x1
	[0120.579] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xd398
	[0120.579] ReadFile (in: hFile=0x5dc, lpBuffer=0x273cf5c, nNumberOfBytesToRead=0xd398, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x273cf5c*, lpNumberOfBytesRead=0x540efcc*=0xd398, lpOverlapped=0x0) returned 1
	[0120.581] CloseHandle (hObject=0x5dc) returned 1
	[0120.581] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.581] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.581] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274a390, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0120.581] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.581] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.582] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0120.582] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.582] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x274a448*=0x1, dwFlags=0x0) returned 1
	[0120.582] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x274a414, dwFlags=0x0) returned 1
	[0120.582] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274a458*, pdwDataLen=0x540efd4*=0xd3a0, dwBufLen=0xd3a0 | out: pbData=0x274a458*, pdwDataLen=0x540efd4*=0xd3a0) returned 1
	[0120.582] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2757804*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2757804*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.582] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.582] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.582] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.582] GetFullPathNameW (in: lpFileName="C:\\Boot\\qps-ploc\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\qps-ploc\\memtest.exe.mui", lpFilePart=0x0) returned 0x20
	[0120.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.582] CreateFileW (lpFileName="C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.588] GetFullPathNameW (in: lpFileName="C:\\Boot\\Resources\\bootres.dll", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Resources\\bootres.dll", lpFilePart=0x0) returned 0x1d
	[0120.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.588] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), fInfoLevelId=0x0, lpFileInformation=0x2757cd4 | out: lpFileInformation=0x2757cd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0)) returned 1
	[0120.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.588] GetFullPathNameW (in: lpFileName="C:\\Boot\\Resources\\bootres.dll", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Resources\\bootres.dll", lpFilePart=0x0) returned 0x1d
	[0120.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.589] CreateFileW (lpFileName="C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.589] GetFileType (hFile=0x5dc) returned 0x1
	[0120.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.589] GetFileType (hFile=0x5dc) returned 0x1
	[0120.589] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x169a0
	[0120.589] ReadFile (in: hFile=0x5dc, lpBuffer=0x68c3ba8, nNumberOfBytesToRead=0x169a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x68c3ba8*, lpNumberOfBytesRead=0x540efcc*=0x169a0, lpOverlapped=0x0) returned 1
	[0120.592] CloseHandle (hObject=0x5dc) returned 1
	[0120.592] CryptDestroyKey (hKey=0x82b040) returned 1
	[0120.592] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.592] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2757f14, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0120.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.593] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0120.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.593] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2757fcc*=0x1, dwFlags=0x0) returned 1
	[0120.593] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2757f98, dwFlags=0x0) returned 1
	[0120.594] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68da568*, pdwDataLen=0x540efd4*=0x169b0, dwBufLen=0x169b0 | out: pbData=0x68da568*, pdwDataLen=0x540efd4*=0x169b0) returned 1
	[0120.594] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2757fdc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2757fdc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.594] CryptDestroyKey (hKey=0x82b280) returned 1
	[0120.594] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.594] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.594] GetFullPathNameW (in: lpFileName="C:\\Boot\\Resources\\bootres.dll", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Resources\\bootres.dll", lpFilePart=0x0) returned 0x1d
	[0120.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.595] CreateFileW (lpFileName="C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.596] GetFullPathNameW (in: lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ro-RO\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.597] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2758488 | out: lpFileInformation=0x2758488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960)) returned 1
	[0120.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.597] GetFullPathNameW (in: lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ro-RO\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.597] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.597] GetFileType (hFile=0x5dc) returned 0x1
	[0120.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.597] GetFileType (hFile=0x5dc) returned 0x1
	[0120.597] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12960
	[0120.597] ReadFile (in: hFile=0x5dc, lpBuffer=0x2758648, nNumberOfBytesToRead=0x12960, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2758648*, lpNumberOfBytesRead=0x540efcc*=0x12960, lpOverlapped=0x0) returned 1
	[0120.641] CloseHandle (hObject=0x5dc) returned 1
	[0120.641] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0120.641] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.641] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276b044, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0120.641] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.641] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.641] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0120.641] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.641] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x276b0fc*=0x1, dwFlags=0x0) returned 1
	[0120.641] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x276b0c8, dwFlags=0x0) returned 1
	[0120.641] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276b10c*, pdwDataLen=0x540efd4*=0x12970, dwBufLen=0x12970 | out: pbData=0x276b10c*, pdwDataLen=0x540efd4*=0x12970) returned 1
	[0120.642] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277da88*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x277da88*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.642] CryptDestroyKey (hKey=0x82b480) returned 1
	[0120.642] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.642] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.642] GetFullPathNameW (in: lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ro-RO\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.642] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.644] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.644] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x277df3c | out: lpFileInformation=0x277df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60)) returned 1
	[0120.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.645] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.645] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.645] GetFileType (hFile=0x5dc) returned 0x1
	[0120.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.645] GetFileType (hFile=0x5dc) returned 0x1
	[0120.645] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12d60
	[0120.645] ReadFile (in: hFile=0x5dc, lpBuffer=0x277e0fc, nNumberOfBytesToRead=0x12d60, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x277e0fc*, lpNumberOfBytesRead=0x540efcc*=0x12d60, lpOverlapped=0x0) returned 1
	[0120.651] CloseHandle (hObject=0x5dc) returned 1
	[0120.651] CryptDestroyKey (hKey=0x82b540) returned 1
	[0120.651] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.652] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2790ef8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0120.652] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.652] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.652] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0120.652] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.652] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2790fb0*=0x1, dwFlags=0x0) returned 1
	[0120.652] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2790f7c, dwFlags=0x0) returned 1
	[0120.652] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2790fc0*, pdwDataLen=0x540efd4*=0x12d70, dwBufLen=0x12d70 | out: pbData=0x2790fc0*, pdwDataLen=0x540efd4*=0x12d70) returned 1
	[0120.652] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a3d3c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a3d3c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.652] CryptDestroyKey (hKey=0x82b540) returned 1
	[0120.652] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.653] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.653] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.653] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.655] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.655] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27a41f0 | out: lpFileInformation=0x27a41f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0)) returned 1
	[0120.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.655] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.656] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.656] GetFileType (hFile=0x5dc) returned 0x1
	[0120.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.656] GetFileType (hFile=0x5dc) returned 0x1
	[0120.656] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xafa0
	[0120.656] ReadFile (in: hFile=0x5dc, lpBuffer=0x27a43b0, nNumberOfBytesToRead=0xafa0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a43b0*, lpNumberOfBytesRead=0x540efcc*=0xafa0, lpOverlapped=0x0) returned 1
	[0120.658] CloseHandle (hObject=0x5dc) returned 1
	[0120.658] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0120.658] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.658] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27af3ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0120.658] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.658] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.658] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0120.658] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.658] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27af4a4*=0x1, dwFlags=0x0) returned 1
	[0120.658] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27af470, dwFlags=0x0) returned 1
	[0120.659] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27af4b4*, pdwDataLen=0x540efd4*=0xafb0, dwBufLen=0xafb0 | out: pbData=0x27af4b4*, pdwDataLen=0x540efd4*=0xafb0) returned 1
	[0120.659] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ba470*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27ba470*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.659] CryptDestroyKey (hKey=0x82b100) returned 1
	[0120.659] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.659] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.659] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.659] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.661] GetFullPathNameW (in: lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sk-SK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.661] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27ba924 | out: lpFileInformation=0x27ba924*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58)) returned 1
	[0120.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.662] GetFullPathNameW (in: lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sk-SK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.662] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.662] GetFileType (hFile=0x5dc) returned 0x1
	[0120.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.663] GetFileType (hFile=0x5dc) returned 0x1
	[0120.663] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12d58
	[0120.663] ReadFile (in: hFile=0x5dc, lpBuffer=0x27baae4, nNumberOfBytesToRead=0x12d58, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27baae4*, lpNumberOfBytesRead=0x540efcc*=0x12d58, lpOverlapped=0x0) returned 1
	[0120.665] CloseHandle (hObject=0x5dc) returned 1
	[0120.665] CryptDestroyKey (hKey=0x82b340) returned 1
	[0120.665] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.665] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27cd8d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0120.665] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.665] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.665] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0120.665] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.666] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27cd990*=0x1, dwFlags=0x0) returned 1
	[0120.666] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27cd95c, dwFlags=0x0) returned 1
	[0120.666] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27cd9a0*, pdwDataLen=0x540efd4*=0x12d60, dwBufLen=0x12d60 | out: pbData=0x27cd9a0*, pdwDataLen=0x540efd4*=0x12d60) returned 1
	[0120.666] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e070c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27e070c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.666] CryptDestroyKey (hKey=0x82b340) returned 1
	[0120.666] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.666] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.666] GetFullPathNameW (in: lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sk-SK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.666] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.668] GetFullPathNameW (in: lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sl-SI\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.669] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27e0bc0 | out: lpFileInformation=0x27e0bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60)) returned 1
	[0120.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.669] GetFullPathNameW (in: lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sl-SI\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.669] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.669] GetFileType (hFile=0x5dc) returned 0x1
	[0120.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.669] GetFileType (hFile=0x5dc) returned 0x1
	[0120.669] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12b60
	[0120.669] ReadFile (in: hFile=0x5dc, lpBuffer=0x27e0d80, nNumberOfBytesToRead=0x12b60, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27e0d80*, lpNumberOfBytesRead=0x540efcc*=0x12b60, lpOverlapped=0x0) returned 1
	[0120.672] CloseHandle (hObject=0x5dc) returned 1
	[0120.672] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0120.672] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.672] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f397c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0120.672] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.672] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.672] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0120.672] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.672] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x27f3a34*=0x1, dwFlags=0x0) returned 1
	[0120.672] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x27f3a00, dwFlags=0x0) returned 1
	[0120.673] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f3a44*, pdwDataLen=0x540efd4*=0x12b70, dwBufLen=0x12b70 | out: pbData=0x27f3a44*, pdwDataLen=0x540efd4*=0x12b70) returned 1
	[0120.673] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28065c0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x28065c0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.673] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0120.673] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.673] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.673] GetFullPathNameW (in: lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sl-SI\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.673] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.675] GetFullPathNameW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x22
	[0120.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.675] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2806a74 | out: lpFileInformation=0x2806a74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60)) returned 1
	[0120.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.675] GetFullPathNameW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x22
	[0120.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.676] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.676] GetFileType (hFile=0x5dc) returned 0x1
	[0120.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.676] GetFileType (hFile=0x5dc) returned 0x1
	[0120.676] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12d60
	[0120.676] ReadFile (in: hFile=0x5dc, lpBuffer=0x2806c4c, nNumberOfBytesToRead=0x12d60, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2806c4c*, lpNumberOfBytesRead=0x540efcc*=0x12d60, lpOverlapped=0x0) returned 1
	[0120.705] CloseHandle (hObject=0x5dc) returned 1
	[0120.705] CryptDestroyKey (hKey=0x82b280) returned 1
	[0120.705] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.705] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2819a48, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0120.705] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.705] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.705] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0120.705] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.705] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2819b00*=0x1, dwFlags=0x0) returned 1
	[0120.705] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2819acc, dwFlags=0x0) returned 1
	[0120.708] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262bd74*, pdwDataLen=0x540efd4*=0x12d70, dwBufLen=0x12d70 | out: pbData=0x262bd74*, pdwDataLen=0x540efd4*=0x12d70) returned 1
	[0120.709] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263eaf0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x263eaf0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.709] CryptDestroyKey (hKey=0x82b300) returned 1
	[0120.709] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.709] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.709] GetFullPathNameW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x22
	[0120.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.709] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.711] GetFullPathNameW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", lpFilePart=0x0) returned 0x22
	[0120.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.711] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x263efd0 | out: lpFileInformation=0x263efd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58)) returned 1
	[0120.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.712] GetFullPathNameW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", lpFilePart=0x0) returned 0x22
	[0120.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.712] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.712] GetFileType (hFile=0x5dc) returned 0x1
	[0120.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.712] GetFileType (hFile=0x5dc) returned 0x1
	[0120.712] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xaf58
	[0120.712] ReadFile (in: hFile=0x5dc, lpBuffer=0x263f1a8, nNumberOfBytesToRead=0xaf58, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x263f1a8*, lpNumberOfBytesRead=0x540efcc*=0xaf58, lpOverlapped=0x0) returned 1
	[0120.724] CloseHandle (hObject=0x5dc) returned 1
	[0120.725] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.725] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.725] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264a19c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0120.725] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.725] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.725] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0120.725] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.725] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x264a254*=0x1, dwFlags=0x0) returned 1
	[0120.725] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x264a220, dwFlags=0x0) returned 1
	[0120.725] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264a264*, pdwDataLen=0x540efd4*=0xaf60, dwBufLen=0xaf60 | out: pbData=0x264a264*, pdwDataLen=0x540efd4*=0xaf60) returned 1
	[0120.725] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26551d0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26551d0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.725] CryptDestroyKey (hKey=0x82b280) returned 1
	[0120.726] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.726] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.726] GetFullPathNameW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", lpFilePart=0x0) returned 0x22
	[0120.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.726] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.728] GetFullPathNameW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x22
	[0120.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.728] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26556b0 | out: lpFileInformation=0x26556b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60)) returned 1
	[0120.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.728] GetFullPathNameW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x22
	[0120.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.728] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.729] GetFileType (hFile=0x5dc) returned 0x1
	[0120.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.729] GetFileType (hFile=0x5dc) returned 0x1
	[0120.729] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12d60
	[0120.729] ReadFile (in: hFile=0x5dc, lpBuffer=0x2655888, nNumberOfBytesToRead=0x12d60, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2655888*, lpNumberOfBytesRead=0x540efcc*=0x12d60, lpOverlapped=0x0) returned 1
	[0120.731] CloseHandle (hObject=0x5dc) returned 1
	[0120.731] CryptDestroyKey (hKey=0x82b300) returned 1
	[0120.731] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.731] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2668684, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0120.731] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.732] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.732] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0120.732] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.732] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x266873c*=0x1, dwFlags=0x0) returned 1
	[0120.732] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2668708, dwFlags=0x0) returned 1
	[0120.732] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266874c*, pdwDataLen=0x540efd4*=0x12d70, dwBufLen=0x12d70 | out: pbData=0x266874c*, pdwDataLen=0x540efd4*=0x12d70) returned 1
	[0120.732] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267b4c8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x267b4c8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.732] CryptDestroyKey (hKey=0x82b300) returned 1
	[0120.732] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.732] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.732] GetFullPathNameW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x22
	[0120.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.733] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.735] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.735] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x267b9a8 | out: lpFileInformation=0x267b9a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960)) returned 1
	[0120.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.735] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.735] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.735] GetFileType (hFile=0x5dc) returned 0x1
	[0120.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.736] GetFileType (hFile=0x5dc) returned 0x1
	[0120.736] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12960
	[0120.736] ReadFile (in: hFile=0x5dc, lpBuffer=0x267bb68, nNumberOfBytesToRead=0x12960, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x267bb68*, lpNumberOfBytesRead=0x540efcc*=0x12960, lpOverlapped=0x0) returned 1
	[0120.737] CloseHandle (hObject=0x5dc) returned 1
	[0120.738] CryptDestroyKey (hKey=0x82b480) returned 1
	[0120.738] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.738] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268e564, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0120.738] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.738] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.738] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0120.738] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.738] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x268e61c*=0x1, dwFlags=0x0) returned 1
	[0120.738] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x268e5e8, dwFlags=0x0) returned 1
	[0120.738] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268e62c*, pdwDataLen=0x540efd4*=0x12970, dwBufLen=0x12970 | out: pbData=0x268e62c*, pdwDataLen=0x540efd4*=0x12970) returned 1
	[0120.739] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a0fa8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a0fa8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.739] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0120.739] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.739] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.739] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.739] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.741] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.742] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26a145c | out: lpFileInformation=0x26a145c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98)) returned 1
	[0120.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.742] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.742] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.743] GetFileType (hFile=0x5dc) returned 0x1
	[0120.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.743] GetFileType (hFile=0x5dc) returned 0x1
	[0120.743] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xaf98
	[0120.743] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a161c, nNumberOfBytesToRead=0xaf98, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a161c*, lpNumberOfBytesRead=0x540efcc*=0xaf98, lpOverlapped=0x0) returned 1
	[0120.745] CloseHandle (hObject=0x5dc) returned 1
	[0120.745] CryptDestroyKey (hKey=0x82b380) returned 1
	[0120.745] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.745] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ac650, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0120.745] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.745] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.745] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0120.745] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.746] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26ac708*=0x1, dwFlags=0x0) returned 1
	[0120.746] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26ac6d4, dwFlags=0x0) returned 1
	[0120.746] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ac718*, pdwDataLen=0x540efd4*=0xafa0, dwBufLen=0xafa0 | out: pbData=0x26ac718*, pdwDataLen=0x540efd4*=0xafa0) returned 1
	[0120.746] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b76c4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b76c4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.746] CryptDestroyKey (hKey=0x82b300) returned 1
	[0120.746] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.746] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.746] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.746] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.748] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.748] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26b7b78 | out: lpFileInformation=0x26b7b78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558)) returned 1
	[0120.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.748] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.748] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.749] GetFileType (hFile=0x5dc) returned 0x1
	[0120.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.749] GetFileType (hFile=0x5dc) returned 0x1
	[0120.749] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12558
	[0120.749] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b7d38, nNumberOfBytesToRead=0x12558, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26b7d38*, lpNumberOfBytesRead=0x540efcc*=0x12558, lpOverlapped=0x0) returned 1
	[0120.755] CloseHandle (hObject=0x5dc) returned 1
	[0120.755] CryptDestroyKey (hKey=0x82b340) returned 1
	[0120.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.756] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ca32c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0120.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.756] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0120.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.756] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26ca3e4*=0x1, dwFlags=0x0) returned 1
	[0120.756] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26ca3b0, dwFlags=0x0) returned 1
	[0120.756] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ca3f4*, pdwDataLen=0x540efd4*=0x12560, dwBufLen=0x12560 | out: pbData=0x26ca3f4*, pdwDataLen=0x540efd4*=0x12560) returned 1
	[0120.756] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dc960*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26dc960*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.756] CryptDestroyKey (hKey=0x82b340) returned 1
	[0120.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.756] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.756] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.759] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.759] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26dce14 | out: lpFileInformation=0x26dce14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0)) returned 1
	[0120.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.759] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.759] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.760] GetFileType (hFile=0x5dc) returned 0x1
	[0120.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.760] GetFileType (hFile=0x5dc) returned 0x1
	[0120.760] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb1a0
	[0120.760] ReadFile (in: hFile=0x5dc, lpBuffer=0x26dcfd4, nNumberOfBytesToRead=0xb1a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26dcfd4*, lpNumberOfBytesRead=0x540efcc*=0xb1a0, lpOverlapped=0x0) returned 1
	[0120.762] CloseHandle (hObject=0x5dc) returned 1
	[0120.762] CryptDestroyKey (hKey=0x82b100) returned 1
	[0120.762] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.762] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e8210, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0120.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.762] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0120.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.762] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26e82c8*=0x1, dwFlags=0x0) returned 1
	[0120.762] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26e8294, dwFlags=0x0) returned 1
	[0120.763] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e82d8*, pdwDataLen=0x540efd4*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x26e82d8*, pdwDataLen=0x540efd4*=0xb1b0) returned 1
	[0120.763] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f3494*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f3494*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.763] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0120.763] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.763] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.763] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.763] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.765] GetFullPathNameW (in: lpFileName="C:\\Boot\\uk-UA\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\uk-UA\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.765] GetFileAttributesExW (in: lpFileName="C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26f3948 | out: lpFileInformation=0x26f3948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60)) returned 1
	[0120.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.766] GetFullPathNameW (in: lpFileName="C:\\Boot\\uk-UA\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\uk-UA\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.766] CreateFileW (lpFileName="C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.766] GetFileType (hFile=0x5dc) returned 0x1
	[0120.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.766] GetFileType (hFile=0x5dc) returned 0x1
	[0120.766] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12d60
	[0120.766] ReadFile (in: hFile=0x5dc, lpBuffer=0x26f3b08, nNumberOfBytesToRead=0x12d60, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f3b08*, lpNumberOfBytesRead=0x540efcc*=0x12d60, lpOverlapped=0x0) returned 1
	[0120.769] CloseHandle (hObject=0x5dc) returned 1
	[0120.769] CryptDestroyKey (hKey=0x82b540) returned 1
	[0120.769] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.769] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2706904, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0120.769] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.769] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.769] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0120.769] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.769] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27069bc*=0x1, dwFlags=0x0) returned 1
	[0120.770] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2706988, dwFlags=0x0) returned 1
	[0120.770] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27069cc*, pdwDataLen=0x540efd4*=0x12d70, dwBufLen=0x12d70 | out: pbData=0x27069cc*, pdwDataLen=0x540efd4*=0x12d70) returned 1
	[0120.770] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2719748*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2719748*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.770] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0120.770] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.770] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.770] GetFullPathNameW (in: lpFileName="C:\\Boot\\uk-UA\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\uk-UA\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.770] CreateFileW (lpFileName="C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.772] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.773] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2719bfc | out: lpFileInformation=0x2719bfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960)) returned 1
	[0120.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.773] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.773] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.773] GetFileType (hFile=0x5dc) returned 0x1
	[0120.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.774] GetFileType (hFile=0x5dc) returned 0x1
	[0120.774] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xf960
	[0120.774] ReadFile (in: hFile=0x5dc, lpBuffer=0x2719dbc, nNumberOfBytesToRead=0xf960, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2719dbc*, lpNumberOfBytesRead=0x540efcc*=0xf960, lpOverlapped=0x0) returned 1
	[0120.787] CloseHandle (hObject=0x5dc) returned 1
	[0120.787] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.787] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.788] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27297b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0120.788] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.788] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.788] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0120.788] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.788] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2729870*=0x1, dwFlags=0x0) returned 1
	[0120.788] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x272983c, dwFlags=0x0) returned 1
	[0120.788] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2729880*, pdwDataLen=0x540efd4*=0xf970, dwBufLen=0xf970 | out: pbData=0x2729880*, pdwDataLen=0x540efd4*=0xf970) returned 1
	[0120.788] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27391fc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27391fc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.788] CryptDestroyKey (hKey=0x82b000) returned 1
	[0120.788] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.789] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.789] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.789] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.791] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.791] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27396b0 | out: lpFileInformation=0x27396b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0)) returned 1
	[0120.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.791] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.792] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.792] GetFileType (hFile=0x5dc) returned 0x1
	[0120.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.792] GetFileType (hFile=0x5dc) returned 0x1
	[0120.792] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xa5a0
	[0120.792] ReadFile (in: hFile=0x5dc, lpBuffer=0x2739870, nNumberOfBytesToRead=0xa5a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2739870*, lpNumberOfBytesRead=0x540efcc*=0xa5a0, lpOverlapped=0x0) returned 1
	[0120.794] CloseHandle (hObject=0x5dc) returned 1
	[0120.794] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0120.794] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.794] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2743eac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0120.794] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.794] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.794] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0120.794] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.794] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2743f64*=0x1, dwFlags=0x0) returned 1
	[0120.794] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2743f30, dwFlags=0x0) returned 1
	[0120.794] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2743f74*, pdwDataLen=0x540efd4*=0xa5b0, dwBufLen=0xa5b0 | out: pbData=0x2743f74*, pdwDataLen=0x540efd4*=0xa5b0) returned 1
	[0120.795] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274e530*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x274e530*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.795] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0120.795] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.795] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.795] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.795] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.797] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.797] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x274e9e4 | out: lpFileInformation=0x274e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958)) returned 1
	[0120.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.797] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.798] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.798] GetFileType (hFile=0x5dc) returned 0x1
	[0120.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.798] GetFileType (hFile=0x5dc) returned 0x1
	[0120.798] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xf958
	[0120.798] ReadFile (in: hFile=0x5dc, lpBuffer=0x274eba4, nNumberOfBytesToRead=0xf958, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x274eba4*, lpNumberOfBytesRead=0x540efcc*=0xf958, lpOverlapped=0x0) returned 1
	[0120.800] CloseHandle (hObject=0x5dc) returned 1
	[0120.800] CryptDestroyKey (hKey=0x82b540) returned 1
	[0120.800] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.800] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275e598, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0120.800] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.801] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0120.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.801] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x275e650*=0x1, dwFlags=0x0) returned 1
	[0120.801] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x275e61c, dwFlags=0x0) returned 1
	[0120.801] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275e660*, pdwDataLen=0x540efd4*=0xf960, dwBufLen=0xf960 | out: pbData=0x275e660*, pdwDataLen=0x540efd4*=0xf960) returned 1
	[0120.801] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276dfcc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x276dfcc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.801] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.801] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.801] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.804] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.804] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x276e480 | out: lpFileInformation=0x276e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558)) returned 1
	[0120.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.804] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.805] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.805] GetFileType (hFile=0x5dc) returned 0x1
	[0120.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.805] GetFileType (hFile=0x5dc) returned 0x1
	[0120.805] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xa558
	[0120.805] ReadFile (in: hFile=0x5dc, lpBuffer=0x276e640, nNumberOfBytesToRead=0xa558, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x276e640*, lpNumberOfBytesRead=0x540efcc*=0xa558, lpOverlapped=0x0) returned 1
	[0120.807] CloseHandle (hObject=0x5dc) returned 1
	[0120.807] CryptDestroyKey (hKey=0x82b440) returned 1
	[0120.807] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.807] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2778c34, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0120.807] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.807] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.807] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0120.807] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.807] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2778cec*=0x1, dwFlags=0x0) returned 1
	[0120.807] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2778cb8, dwFlags=0x0) returned 1
	[0120.808] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2778cfc*, pdwDataLen=0x540efd4*=0xa560, dwBufLen=0xa560 | out: pbData=0x2778cfc*, pdwDataLen=0x540efd4*=0xa560) returned 1
	[0120.808] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2783268*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2783268*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.808] CryptDestroyKey (hKey=0x82b280) returned 1
	[0120.808] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.808] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.808] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.808] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.810] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.810] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x278371c | out: lpFileInformation=0x278371c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960)) returned 1
	[0120.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.811] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.811] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.811] GetFileType (hFile=0x5dc) returned 0x1
	[0120.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.811] GetFileType (hFile=0x5dc) returned 0x1
	[0120.811] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xf960
	[0120.811] ReadFile (in: hFile=0x5dc, lpBuffer=0x27838dc, nNumberOfBytesToRead=0xf960, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27838dc*, lpNumberOfBytesRead=0x540efcc*=0xf960, lpOverlapped=0x0) returned 1
	[0120.813] CloseHandle (hObject=0x5dc) returned 1
	[0120.813] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0120.813] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.814] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27932d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0120.814] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.814] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.814] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0120.814] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.814] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2793390*=0x1, dwFlags=0x0) returned 1
	[0120.814] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x279335c, dwFlags=0x0) returned 1
	[0120.814] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27933a0*, pdwDataLen=0x540efd4*=0xf970, dwBufLen=0xf970 | out: pbData=0x27933a0*, pdwDataLen=0x540efd4*=0xf970) returned 1
	[0120.814] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a2d1c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a2d1c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.814] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0120.814] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.814] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.815] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.815] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.817] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.817] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27a31d0 | out: lpFileInformation=0x27a31d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598)) returned 1
	[0120.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.817] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.817] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.818] GetFileType (hFile=0x5dc) returned 0x1
	[0120.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.818] GetFileType (hFile=0x5dc) returned 0x1
	[0120.818] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xa598
	[0120.818] ReadFile (in: hFile=0x5dc, lpBuffer=0x27a3390, nNumberOfBytesToRead=0xa598, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a3390*, lpNumberOfBytesRead=0x540efcc*=0xa598, lpOverlapped=0x0) returned 1
	[0120.820] CloseHandle (hObject=0x5dc) returned 1
	[0120.820] CryptDestroyKey (hKey=0x82b280) returned 1
	[0120.820] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.820] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ad9c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0120.820] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.820] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.821] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0120.821] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.821] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27ada7c*=0x1, dwFlags=0x0) returned 1
	[0120.821] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27ada48, dwFlags=0x0) returned 1
	[0120.821] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ada8c*, pdwDataLen=0x540efd4*=0xa5a0, dwBufLen=0xa5a0 | out: pbData=0x27ada8c*, pdwDataLen=0x540efd4*=0xa5a0) returned 1
	[0120.821] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b8038*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b8038*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.821] CryptDestroyKey (hKey=0x82b300) returned 1
	[0120.821] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.821] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.821] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0120.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.821] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.823] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", lpFilePart=0x0) returned 0x7d
	[0120.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.824] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), fInfoLevelId=0x0, lpFileInformation=0x27b84ec | out: lpFileInformation=0x27b84ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x430)) returned 1
	[0120.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.825] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", lpFilePart=0x0) returned 0x7d
	[0120.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.825] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.825] GetFileType (hFile=0x5dc) returned 0x1
	[0120.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.825] GetFileType (hFile=0x5dc) returned 0x1
	[0120.825] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x430
	[0120.825] ReadFile (in: hFile=0x5dc, lpBuffer=0x27b8d78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b8d78*, lpNumberOfBytesRead=0x540efcc*=0x430, lpOverlapped=0x0) returned 1
	[0120.827] CloseHandle (hObject=0x5dc) returned 1
	[0120.827] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0120.827] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.827] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b9e14, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0120.827] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.827] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.827] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0120.827] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.827] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27b9ecc*=0x1, dwFlags=0x0) returned 1
	[0120.828] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27b9e98, dwFlags=0x0) returned 1
	[0120.828] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b9edc*, pdwDataLen=0x540efd4*=0x440, dwBufLen=0x440 | out: pbData=0x27b9edc*, pdwDataLen=0x540efd4*=0x440) returned 1
	[0120.828] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ba328*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27ba328*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.828] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0120.828] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.828] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.828] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", lpFilePart=0x0) returned 0x7d
	[0120.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.828] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.830] GetFileType (hFile=0x5dc) returned 0x1
	[0120.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0120.830] GetFileType (hFile=0x5dc) returned 0x1
	[0120.830] WriteFile (in: hFile=0x5dc, lpBuffer=0x27ba55c*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27ba55c*, lpNumberOfBytesWritten=0x540ef94*=0x440, lpOverlapped=0x0) returned 1
	[0120.831] CloseHandle (hObject=0x5dc) returned 1
	[0120.831] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", lpFilePart=0x0) returned 0x7d
	[0120.831] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xac
	[0120.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0120.832] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x8258f42f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x440)) returned 1
	[0120.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0120.832] MoveFileW (lpExistingFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), lpNewFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0120.833] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", lpFilePart=0x0) returned 0x79
	[0120.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.833] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), fInfoLevelId=0x0, lpFileInformation=0x27bba70 | out: lpFileInformation=0x27bba70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbfefc00, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42c)) returned 1
	[0120.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.835] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", lpFilePart=0x0) returned 0x79
	[0120.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.835] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.835] GetFileType (hFile=0x5dc) returned 0x1
	[0120.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.835] GetFileType (hFile=0x5dc) returned 0x1
	[0120.835] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x42c
	[0120.835] ReadFile (in: hFile=0x5dc, lpBuffer=0x27bc2d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27bc2d8*, lpNumberOfBytesRead=0x540efcc*=0x42c, lpOverlapped=0x0) returned 1
	[0120.841] CloseHandle (hObject=0x5dc) returned 1
	[0120.841] CryptDestroyKey (hKey=0x82b400) returned 1
	[0120.841] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.841] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27bd374, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0120.841] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.841] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.841] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0120.841] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.841] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27bd42c*=0x1, dwFlags=0x0) returned 1
	[0120.841] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x27bd3f8, dwFlags=0x0) returned 1
	[0120.842] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27bd43c*, pdwDataLen=0x540efd4*=0x430, dwBufLen=0x430 | out: pbData=0x27bd43c*, pdwDataLen=0x540efd4*=0x430) returned 1
	[0120.842] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27bd878*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27bd878*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.842] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0120.842] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.842] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.842] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", lpFilePart=0x0) returned 0x79
	[0120.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.842] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.846] GetFileType (hFile=0x5dc) returned 0x1
	[0120.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0120.846] GetFileType (hFile=0x5dc) returned 0x1
	[0120.846] WriteFile (in: hFile=0x5dc, lpBuffer=0x27bda9c*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27bda9c*, lpNumberOfBytesWritten=0x540ef94*=0x430, lpOverlapped=0x0) returned 1
	[0120.849] CloseHandle (hObject=0x5dc) returned 1
	[0120.849] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", lpFilePart=0x0) returned 0x79
	[0120.849] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa8
	[0120.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0120.850] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x825b561b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x430)) returned 1
	[0120.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0120.850] MoveFileW (lpExistingFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), lpNewFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0120.851] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", lpFilePart=0x0) returned 0x7c
	[0120.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.851] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), fInfoLevelId=0x0, lpFileInformation=0x27bef90 | out: lpFileInformation=0x27bef90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42f)) returned 1
	[0120.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.852] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", lpFilePart=0x0) returned 0x7c
	[0120.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.852] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.852] GetFileType (hFile=0x5dc) returned 0x1
	[0120.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.852] GetFileType (hFile=0x5dc) returned 0x1
	[0120.852] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x42f
	[0120.852] ReadFile (in: hFile=0x5dc, lpBuffer=0x27bf814, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27bf814*, lpNumberOfBytesRead=0x540efcc*=0x42f, lpOverlapped=0x0) returned 1
	[0120.858] CloseHandle (hObject=0x5dc) returned 1
	[0120.858] CryptDestroyKey (hKey=0x82b200) returned 1
	[0120.858] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.858] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c08b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0120.858] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.858] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.858] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0120.858] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.858] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27c0968*=0x1, dwFlags=0x0) returned 1
	[0120.858] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27c0934, dwFlags=0x0) returned 1
	[0120.858] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c0978*, pdwDataLen=0x540efd4*=0x430, dwBufLen=0x430 | out: pbData=0x27c0978*, pdwDataLen=0x540efd4*=0x430) returned 1
	[0120.859] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c0db4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c0db4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.859] CryptDestroyKey (hKey=0x82b380) returned 1
	[0120.859] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.859] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.859] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", lpFilePart=0x0) returned 0x7c
	[0120.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.859] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.860] GetFileType (hFile=0x5dc) returned 0x1
	[0120.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0120.860] GetFileType (hFile=0x5dc) returned 0x1
	[0120.861] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c0fe4*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27c0fe4*, lpNumberOfBytesWritten=0x540ef94*=0x430, lpOverlapped=0x0) returned 1
	[0120.862] CloseHandle (hObject=0x5dc) returned 1
	[0120.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", lpFilePart=0x0) returned 0x7c
	[0120.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xab
	[0120.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0120.862] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x825db85d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x430)) returned 1
	[0120.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0120.862] MoveFileW (lpExistingFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), lpNewFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0120.863] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", lpFilePart=0x0) returned 0x5d
	[0120.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.863] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), fInfoLevelId=0x0, lpFileInformation=0x27c24ec | out: lpFileInformation=0x27c24ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5)) returned 1
	[0120.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.864] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", lpFilePart=0x0) returned 0x5d
	[0120.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.864] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.864] GetFileType (hFile=0x5dc) returned 0x1
	[0120.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.864] GetFileType (hFile=0x5dc) returned 0x1
	[0120.864] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3e5
	[0120.865] ReadFile (in: hFile=0x5dc, lpBuffer=0x27c2c30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c2c30*, lpNumberOfBytesRead=0x540efcc*=0x3e5, lpOverlapped=0x0) returned 1
	[0120.879] CloseHandle (hObject=0x5dc) returned 1
	[0120.879] CryptDestroyKey (hKey=0x82b100) returned 1
	[0120.880] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.880] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c3ccc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b000) returned 1
	[0120.880] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.880] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.880] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0120.880] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.880] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27c3d84*=0x1, dwFlags=0x0) returned 1
	[0120.880] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27c3d50, dwFlags=0x0) returned 1
	[0120.880] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c3d94*, pdwDataLen=0x540efd4*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x27c3d94*, pdwDataLen=0x540efd4*=0x3f0) returned 1
	[0120.880] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c4190*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c4190*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.881] CryptDestroyKey (hKey=0x82b280) returned 1
	[0120.881] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.881] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", lpFilePart=0x0) returned 0x5d
	[0120.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.881] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.882] GetFileType (hFile=0x5dc) returned 0x1
	[0120.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0120.882] GetFileType (hFile=0x5dc) returned 0x1
	[0120.882] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c4344*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27c4344*, lpNumberOfBytesWritten=0x540ef94*=0x3f0, lpOverlapped=0x0) returned 1
	[0120.883] CloseHandle (hObject=0x5dc) returned 1
	[0120.884] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", lpFilePart=0x0) returned 0x5d
	[0120.884] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0120.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0120.884] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x82627d85, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1
	[0120.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0120.884] MoveFileW (lpExistingFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), lpNewFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0120.885] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT", lpFilePart=0x0) returned 0x1b
	[0120.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.885] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), fInfoLevelId=0x0, lpFileInformation=0x27c5758 | out: lpFileInformation=0x27c5758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x7a4c27fa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7a4c27fa, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x40000)) returned 1
	[0120.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.887] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT", lpFilePart=0x0) returned 0x1b
	[0120.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.887] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.888] GetFileType (hFile=0x5dc) returned 0x1
	[0120.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.888] GetFileType (hFile=0x5dc) returned 0x1
	[0120.888] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x40000
	[0120.889] ReadFile (in: hFile=0x5dc, lpBuffer=0x68f0f38, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x68f0f38*, lpNumberOfBytesRead=0x540efcc*=0x40000, lpOverlapped=0x0) returned 1
	[0120.903] CloseHandle (hObject=0x5dc) returned 1
	[0120.903] CryptDestroyKey (hKey=0x82b000) returned 1
	[0120.903] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.903] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c5990, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0120.903] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.903] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.903] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0120.903] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.903] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27c5a48*=0x1, dwFlags=0x0) returned 1
	[0120.903] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27c5a14, dwFlags=0x0) returned 1
	[0120.907] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6930f58*, pdwDataLen=0x540efd4*=0x40010, dwBufLen=0x40010 | out: pbData=0x6930f58*, pdwDataLen=0x540efd4*=0x40010) returned 1
	[0120.908] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c5a58*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c5a58*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.908] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0120.908] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.908] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.908] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT", lpFilePart=0x0) returned 0x1b
	[0120.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.908] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.914] GetFileType (hFile=0x5dc) returned 0x1
	[0120.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0120.915] GetFileType (hFile=0x5dc) returned 0x1
	[0120.915] WriteFile (in: hFile=0x5dc, lpBuffer=0x6930f58*, nNumberOfBytesToWrite=0x40010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x6930f58*, lpNumberOfBytesWritten=0x540efc0*=0x40010, lpOverlapped=0x0) returned 1
	[0120.921] CloseHandle (hObject=0x5dc) returned 1
	[0120.921] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT", lpFilePart=0x0) returned 0x1b
	[0120.922] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x4a
	[0120.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0120.922] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x7a4c27fa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x826741af, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x40010)) returned 1
	[0120.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0120.922] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\default\\ntuser.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0120.927] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT.LOG1", lpFilePart=0x0) returned 0x20
	[0120.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.927] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), fInfoLevelId=0x0, lpFileInformation=0x27c5d30 | out: lpFileInformation=0x27c5d30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1
	[0120.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.932] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT.LOG1", lpFilePart=0x0) returned 0x20
	[0120.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.932] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.932] GetFileType (hFile=0x5dc) returned 0x1
	[0120.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.932] GetFileType (hFile=0x5dc) returned 0x1
	[0120.932] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x8000
	[0120.932] ReadFile (in: hFile=0x5dc, lpBuffer=0x27c5f00, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c5f00*, lpNumberOfBytesRead=0x540efcc*=0x8000, lpOverlapped=0x0) returned 1
	[0120.939] CloseHandle (hObject=0x5dc) returned 1
	[0120.939] CryptDestroyKey (hKey=0x82b300) returned 1
	[0120.939] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.940] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27cdf9c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0120.940] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.940] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.940] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0120.940] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.940] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27ce054*=0x1, dwFlags=0x0) returned 1
	[0120.940] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27ce020, dwFlags=0x0) returned 1
	[0120.940] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ce064*, pdwDataLen=0x540efd4*=0x8010, dwBufLen=0x8010 | out: pbData=0x27ce064*, pdwDataLen=0x540efd4*=0x8010) returned 1
	[0120.940] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d6080*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27d6080*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.940] CryptDestroyKey (hKey=0x82b280) returned 1
	[0120.940] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.940] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.941] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT.LOG1", lpFilePart=0x0) returned 0x20
	[0120.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.941] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.943] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT.LOG2", lpFilePart=0x0) returned 0x20
	[0120.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.943] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2"), fInfoLevelId=0x0, lpFileInformation=0x27d6550 | out: lpFileInformation=0x27d6550*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x5000)) returned 1
	[0120.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.944] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT.LOG2", lpFilePart=0x0) returned 0x20
	[0120.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.944] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.944] GetFileType (hFile=0x5dc) returned 0x1
	[0120.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.945] GetFileType (hFile=0x5dc) returned 0x1
	[0120.945] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x5000
	[0120.945] ReadFile (in: hFile=0x5dc, lpBuffer=0x27d6720, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27d6720*, lpNumberOfBytesRead=0x540efcc*=0x5000, lpOverlapped=0x0) returned 1
	[0120.952] CloseHandle (hObject=0x5dc) returned 1
	[0120.952] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0120.952] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.952] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27db7bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0120.952] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.952] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.953] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0120.953] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.953] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x27db874*=0x1, dwFlags=0x0) returned 1
	[0120.953] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x27db840, dwFlags=0x0) returned 1
	[0120.953] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27db884*, pdwDataLen=0x540efd4*=0x5010, dwBufLen=0x5010 | out: pbData=0x27db884*, pdwDataLen=0x540efd4*=0x5010) returned 1
	[0120.953] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e08a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27e08a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.953] CryptDestroyKey (hKey=0x82b200) returned 1
	[0120.953] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.953] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.953] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT.LOG2", lpFilePart=0x0) returned 0x20
	[0120.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.953] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.955] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", lpFilePart=0x0) returned 0x48
	[0120.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.956] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf"), fInfoLevelId=0x0, lpFileInformation=0x27e0d70 | out: lpFileInformation=0x27e0d70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7dab84ff, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855f639a, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0120.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.956] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", lpFilePart=0x0) returned 0x48
	[0120.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.956] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.956] GetFileType (hFile=0x5dc) returned 0x1
	[0120.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.957] GetFileType (hFile=0x5dc) returned 0x1
	[0120.957] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10000
	[0120.957] ReadFile (in: hFile=0x5dc, lpBuffer=0x27e1080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27e1080*, lpNumberOfBytesRead=0x540efcc*=0x10000, lpOverlapped=0x0) returned 1
	[0120.972] CloseHandle (hObject=0x5dc) returned 1
	[0120.972] CryptDestroyKey (hKey=0x82b280) returned 1
	[0120.972] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.972] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f111c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0120.972] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.972] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.972] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0120.973] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.973] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27f11d4*=0x1, dwFlags=0x0) returned 1
	[0120.973] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27f11a0, dwFlags=0x0) returned 1
	[0120.973] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f11e4*, pdwDataLen=0x540efd4*=0x10010, dwBufLen=0x10010 | out: pbData=0x27f11e4*, pdwDataLen=0x540efd4*=0x10010) returned 1
	[0120.973] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2801200*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2801200*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0120.973] CryptDestroyKey (hKey=0x82b540) returned 1
	[0120.973] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.976] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.976] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", lpFilePart=0x0) returned 0x48
	[0120.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0120.976] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0120.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0120.978] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", lpFilePart=0x0) returned 0x6d
	[0120.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0120.979] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms"), fInfoLevelId=0x0, lpFileInformation=0x2801860 | out: lpFileInformation=0x2801860*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ddd9675, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1
	[0120.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0120.980] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", lpFilePart=0x0) returned 0x6d
	[0120.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0120.980] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0120.980] GetFileType (hFile=0x5dc) returned 0x1
	[0120.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0120.980] GetFileType (hFile=0x5dc) returned 0x1
	[0120.981] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x80000
	[0120.982] ReadFile (in: hFile=0x5dc, lpBuffer=0x6970f88, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x6970f88*, lpNumberOfBytesRead=0x540efcc*=0x80000, lpOverlapped=0x0) returned 1
	[0120.995] CloseHandle (hObject=0x5dc) returned 1
	[0120.995] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0120.995] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0120.995] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2801d28, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0120.995] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.996] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.996] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0120.996] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0120.996] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2801de0*=0x1, dwFlags=0x0) returned 1
	[0120.996] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2801dac, dwFlags=0x0) returned 1
	[0121.003] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69f0fa8*, pdwDataLen=0x540efd4*=0x80010, dwBufLen=0x80010 | out: pbData=0x69f0fa8*, pdwDataLen=0x540efd4*=0x80010) returned 1
	[0121.004] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2801df0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2801df0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0121.004] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0121.004] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.004] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.004] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", lpFilePart=0x0) returned 0x6d
	[0121.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0121.004] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0121.038] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", lpFilePart=0x0) returned 0x6d
	[0121.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.038] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms"), fInfoLevelId=0x0, lpFileInformation=0x28025c0 | out: lpFileInformation=0x28025c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de71fdf, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0x855d0141, ftLastAccessTime.dwHighDateTime=0x1d2fa07, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1
	[0121.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.043] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", lpFilePart=0x0) returned 0x6d
	[0121.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.043] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.043] GetFileType (hFile=0x5dc) returned 0x1
	[0121.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0121.043] GetFileType (hFile=0x5dc) returned 0x1
	[0121.043] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x80000
	[0121.045] ReadFile (in: hFile=0x5dc, lpBuffer=0x6a70fd8, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x6a70fd8*, lpNumberOfBytesRead=0x540efcc*=0x80000, lpOverlapped=0x0) returned 1
	[0121.055] CloseHandle (hObject=0x5dc) returned 1
	[0121.055] CryptDestroyKey (hKey=0x82b080) returned 1
	[0121.055] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.055] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2802a88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0121.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.056] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.056] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0121.056] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.056] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2802b40*=0x1, dwFlags=0x0) returned 1
	[0121.056] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2802b0c, dwFlags=0x0) returned 1
	[0121.063] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6af0ff8*, pdwDataLen=0x540efd4*=0x80010, dwBufLen=0x80010 | out: pbData=0x6af0ff8*, pdwDataLen=0x540efd4*=0x80010) returned 1
	[0121.064] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2802b50*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2802b50*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0121.064] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0121.064] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.064] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.064] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", lpFilePart=0x0) returned 0x6d
	[0121.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0121.064] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0121.066] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpFilePart=0x0) returned 0x48
	[0121.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.066] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), fInfoLevelId=0x0, lpFileInformation=0x2803320 | out: lpFileInformation=0x2803320*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0121.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.067] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpFilePart=0x0) returned 0x48
	[0121.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.068] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.068] GetFileType (hFile=0x5dc) returned 0x1
	[0121.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0121.068] GetFileType (hFile=0x5dc) returned 0x1
	[0121.068] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10000
	[0121.068] ReadFile (in: hFile=0x5dc, lpBuffer=0x2803630, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2803630*, lpNumberOfBytesRead=0x540efcc*=0x10000, lpOverlapped=0x0) returned 1
	[0121.076] CloseHandle (hObject=0x5dc) returned 1
	[0121.076] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0121.076] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.076] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28136cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0121.077] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.077] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.077] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0121.077] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.077] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2813784*=0x1, dwFlags=0x0) returned 1
	[0121.077] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2813750, dwFlags=0x0) returned 1
	[0121.077] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2813794*, pdwDataLen=0x540efd4*=0x10010, dwBufLen=0x10010 | out: pbData=0x2813794*, pdwDataLen=0x540efd4*=0x10010) returned 1
	[0121.077] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28237b0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x28237b0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0121.077] CryptDestroyKey (hKey=0x82b200) returned 1
	[0121.077] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.077] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.077] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpFilePart=0x0) returned 0x48
	[0121.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0121.078] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0121.080] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpFilePart=0x0) returned 0x6d
	[0121.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.080] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), fInfoLevelId=0x0, lpFileInformation=0x2823e10 | out: lpFileInformation=0x2823e10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1
	[0121.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.081] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpFilePart=0x0) returned 0x6d
	[0121.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.081] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.081] GetFileType (hFile=0x5dc) returned 0x1
	[0121.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0121.081] GetFileType (hFile=0x5dc) returned 0x1
	[0121.081] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x80000
	[0121.083] ReadFile (in: hFile=0x5dc, lpBuffer=0x6b71028, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x6b71028*, lpNumberOfBytesRead=0x540efcc*=0x80000, lpOverlapped=0x0) returned 1
	[0121.095] CloseHandle (hObject=0x5dc) returned 1
	[0121.095] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0121.095] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.095] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28242d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0121.095] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.095] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.095] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0121.095] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.095] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2824390*=0x1, dwFlags=0x0) returned 1
	[0121.095] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x282435c, dwFlags=0x0) returned 1
	[0121.102] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6bf1048*, pdwDataLen=0x540efd4*=0x80010, dwBufLen=0x80010 | out: pbData=0x6bf1048*, pdwDataLen=0x540efd4*=0x80010) returned 1
	[0121.103] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28243a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x28243a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0121.103] CryptDestroyKey (hKey=0x82b480) returned 1
	[0121.103] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.103] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.103] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpFilePart=0x0) returned 0x6d
	[0121.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0121.103] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0121.105] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpFilePart=0x0) returned 0x6d
	[0121.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.106] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), fInfoLevelId=0x0, lpFileInformation=0x2824b70 | out: lpFileInformation=0x2824b70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b716935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b716935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1
	[0121.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.107] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpFilePart=0x0) returned 0x6d
	[0121.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.107] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.107] GetFileType (hFile=0x5dc) returned 0x1
	[0121.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0121.107] GetFileType (hFile=0x5dc) returned 0x1
	[0121.107] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x80000
	[0121.109] ReadFile (in: hFile=0x5dc, lpBuffer=0x6c71078, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x6c71078*, lpNumberOfBytesRead=0x540efcc*=0x80000, lpOverlapped=0x0) returned 1
	[0121.177] CloseHandle (hObject=0x5dc) returned 1
	[0121.177] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0121.177] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.178] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2825038, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0121.178] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.178] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.178] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0121.178] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.178] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x28250f0*=0x1, dwFlags=0x0) returned 1
	[0121.178] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x28250bc, dwFlags=0x0) returned 1
	[0121.185] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6cf1098*, pdwDataLen=0x540efd4*=0x80010, dwBufLen=0x80010 | out: pbData=0x6cf1098*, pdwDataLen=0x540efd4*=0x80010) returned 1
	[0121.186] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2825100*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2825100*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0121.186] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0121.186] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.186] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.186] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpFilePart=0x0) returned 0x6d
	[0121.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0121.187] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0121.189] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\NTUSER.DAT", lpFilePart=0x0) returned 0x1a
	[0121.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.189] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT" (normalized: "c:\\users\\fd1hvy\\ntuser.dat"), fInfoLevelId=0x0, lpFileInformation=0x28258d0 | out: lpFileInformation=0x28258d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x300000)) returned 1
	[0121.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.189] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\NTUSER.DAT", lpFilePart=0x0) returned 0x1a
	[0121.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT" (normalized: "c:\\users\\fd1hvy\\ntuser.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.191] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", lpFilePart=0x0) returned 0x1f
	[0121.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.191] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1"), fInfoLevelId=0x0, lpFileInformation=0x2825e98 | out: lpFileInformation=0x2825e98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0121.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.191] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", lpFilePart=0x0) returned 0x1f
	[0121.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.192] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.193] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", lpFilePart=0x0) returned 0x1f
	[0121.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.199] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2"), fInfoLevelId=0x0, lpFileInformation=0x282649c | out: lpFileInformation=0x282649c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0121.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.200] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", lpFilePart=0x0) returned 0x1f
	[0121.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.200] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpFilePart=0x0) returned 0x47
	[0121.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.202] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), fInfoLevelId=0x0, lpFileInformation=0x2826aa0 | out: lpFileInformation=0x2826aa0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0121.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpFilePart=0x0) returned 0x47
	[0121.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.204] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpFilePart=0x0) returned 0x6c
	[0121.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), fInfoLevelId=0x0, lpFileInformation=0x28272d4 | out: lpFileInformation=0x28272d4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1
	[0121.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.204] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpFilePart=0x0) returned 0x6c
	[0121.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.204] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.206] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpFilePart=0x0) returned 0x6c
	[0121.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.206] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), fInfoLevelId=0x0, lpFileInformation=0x2827eb4 | out: lpFileInformation=0x2827eb4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1
	[0121.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.207] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpFilePart=0x0) returned 0x6c
	[0121.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.207] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.208] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\ntuser.ini", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\ntuser.ini", lpFilePart=0x0) returned 0x1a
	[0121.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.209] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), fInfoLevelId=0x0, lpFileInformation=0x2828c5c | out: lpFileInformation=0x2828c5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14)) returned 1
	[0121.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.210] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\ntuser.ini", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\ntuser.ini", lpFilePart=0x0) returned 0x1a
	[0121.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.210] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.210] GetFileType (hFile=0x5dc) returned 0x1
	[0121.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0121.210] GetFileType (hFile=0x5dc) returned 0x1
	[0121.210] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x14
	[0121.210] ReadFile (in: hFile=0x5dc, lpBuffer=0x2828e24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2828e24*, lpNumberOfBytesRead=0x540efcc*=0x14, lpOverlapped=0x0) returned 1
	[0121.211] CloseHandle (hObject=0x5dc) returned 1
	[0121.211] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0121.211] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.211] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2829ec0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0121.211] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.212] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.212] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0121.212] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.212] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2829f78*=0x1, dwFlags=0x0) returned 1
	[0121.212] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2829f44, dwFlags=0x0) returned 1
	[0121.212] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2829f88*, pdwDataLen=0x540efd4*=0x20, dwBufLen=0x20 | out: pbData=0x2829f88*, pdwDataLen=0x540efd4*=0x20) returned 1
	[0121.212] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2829fb4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2829fb4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0121.212] CryptDestroyKey (hKey=0x82b200) returned 1
	[0121.212] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.212] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\ntuser.ini", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\ntuser.ini", lpFilePart=0x0) returned 0x1a
	[0121.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0121.212] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0121.214] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\desktop.ini", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\desktop.ini", lpFilePart=0x0) returned 0x1b
	[0121.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.214] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x282a54c | out: lpFileInformation=0x282a54c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae)) returned 1
	[0121.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.215] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\desktop.ini", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\desktop.ini", lpFilePart=0x0) returned 0x1b
	[0121.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.215] CreateFileW (lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.215] GetFileType (hFile=0x5dc) returned 0x1
	[0121.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0121.215] GetFileType (hFile=0x5dc) returned 0x1
	[0121.215] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xae
	[0121.215] ReadFile (in: hFile=0x5dc, lpBuffer=0x282a7b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x282a7b0*, lpNumberOfBytesRead=0x540efcc*=0xae, lpOverlapped=0x0) returned 1
	[0121.216] CloseHandle (hObject=0x5dc) returned 1
	[0121.216] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0121.216] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.216] CryptImportKey (in: hProv=0x7f93c0, pbData=0x282b84c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0121.216] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.216] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.216] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0121.216] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.216] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x282b904*=0x1, dwFlags=0x0) returned 1
	[0121.216] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x282b8d0, dwFlags=0x0) returned 1
	[0121.216] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x282b914*, pdwDataLen=0x540efd4*=0xb0, dwBufLen=0xb0 | out: pbData=0x282b914*, pdwDataLen=0x540efd4*=0xb0) returned 1
	[0121.217] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x282b9d0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x282b9d0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0121.217] CryptDestroyKey (hKey=0x82b280) returned 1
	[0121.217] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.217] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.217] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\desktop.ini", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\desktop.ini", lpFilePart=0x0) returned 0x1b
	[0121.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0121.217] CreateFileW (lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0121.260] GetFullPathNameW (in: lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", lpFilePart=0x0) returned 0x27
	[0121.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.260] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x262cff8 | out: lpFileInformation=0x262cff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0)) returned 1
	[0121.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.260] GetFullPathNameW (in: lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", lpFilePart=0x0) returned 0x27
	[0121.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.261] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.261] GetFileType (hFile=0x5dc) returned 0x1
	[0121.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0121.261] GetFileType (hFile=0x5dc) returned 0x1
	[0121.261] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2fa0
	[0121.261] ReadFile (in: hFile=0x5dc, lpBuffer=0x262d1e0, nNumberOfBytesToRead=0x2fa0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x262d1e0*, lpNumberOfBytesRead=0x540efcc*=0x2fa0, lpOverlapped=0x0) returned 1
	[0121.272] CloseHandle (hObject=0x5dc) returned 1
	[0121.272] CryptDestroyKey (hKey=0x82b340) returned 1
	[0121.272] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.272] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263021c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0121.272] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.272] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.272] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0121.272] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.272] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x26302d4*=0x1, dwFlags=0x0) returned 1
	[0121.272] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x26302a0, dwFlags=0x0) returned 1
	[0121.272] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26302e4*, pdwDataLen=0x540efd4*=0x2fb0, dwBufLen=0x2fb0 | out: pbData=0x26302e4*, pdwDataLen=0x540efd4*=0x2fb0) returned 1
	[0121.273] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26332a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26332a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0121.273] CryptDestroyKey (hKey=0x82b040) returned 1
	[0121.273] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.273] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.273] GetFullPathNameW (in: lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", lpFilePart=0x0) returned 0x27
	[0121.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0121.273] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0121.275] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", lpFilePart=0x0) returned 0x3a
	[0121.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.275] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml"), fInfoLevelId=0x0, lpFileInformation=0x26337a4 | out: lpFileInformation=0x26337a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6)) returned 1
	[0121.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.275] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", lpFilePart=0x0) returned 0x3a
	[0121.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.275] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.276] GetFileType (hFile=0x5dc) returned 0x1
	[0121.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0121.276] GetFileType (hFile=0x5dc) returned 0x1
	[0121.276] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x7b6
	[0121.276] ReadFile (in: hFile=0x5dc, lpBuffer=0x26341c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26341c0*, lpNumberOfBytesRead=0x540efcc*=0x7b6, lpOverlapped=0x0) returned 1
	[0121.277] CloseHandle (hObject=0x5dc) returned 1
	[0121.277] CryptDestroyKey (hKey=0x82b400) returned 1
	[0121.277] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.277] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263525c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0121.278] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.278] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.278] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0121.278] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.278] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2635314*=0x1, dwFlags=0x0) returned 1
	[0121.278] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26352e0, dwFlags=0x0) returned 1
	[0121.278] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2635324*, pdwDataLen=0x540efd4*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x2635324*, pdwDataLen=0x540efd4*=0x7c0) returned 1
	[0121.278] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2635af0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2635af0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0121.278] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0121.278] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.278] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.278] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", lpFilePart=0x0) returned 0x3a
	[0121.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0121.278] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.279] GetFileType (hFile=0x5dc) returned 0x1
	[0121.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0121.280] GetFileType (hFile=0x5dc) returned 0x1
	[0121.280] WriteFile (in: hFile=0x5dc, lpBuffer=0x2635c28*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2635c28*, lpNumberOfBytesWritten=0x540ef94*=0x7c0, lpOverlapped=0x0) returned 1
	[0121.281] CloseHandle (hObject=0x5dc) returned 1
	[0121.281] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", lpFilePart=0x0) returned 0x3a
	[0121.281] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0121.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0121.281] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x829e167e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7c0)) returned 1
	[0121.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0121.281] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.282] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", lpFilePart=0x0) returned 0x3a
	[0121.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.282] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml"), fInfoLevelId=0x0, lpFileInformation=0x2636f20 | out: lpFileInformation=0x2636f20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4)) returned 1
	[0121.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.282] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", lpFilePart=0x0) returned 0x3a
	[0121.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.283] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.283] GetFileType (hFile=0x5dc) returned 0x1
	[0121.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0121.283] GetFileType (hFile=0x5dc) returned 0x1
	[0121.283] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x7b4
	[0121.283] ReadFile (in: hFile=0x5dc, lpBuffer=0x2637938, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2637938*, lpNumberOfBytesRead=0x540efcc*=0x7b4, lpOverlapped=0x0) returned 1
	[0121.322] CloseHandle (hObject=0x5dc) returned 1
	[0121.322] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0121.322] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.322] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26389d4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b000) returned 1
	[0121.322] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.322] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.322] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0121.322] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.322] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2638a8c*=0x1, dwFlags=0x0) returned 1
	[0121.323] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2638a58, dwFlags=0x0) returned 1
	[0121.323] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2638a9c*, pdwDataLen=0x540efd4*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x2638a9c*, pdwDataLen=0x540efd4*=0x7c0) returned 1
	[0121.323] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2639268*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2639268*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0121.323] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0121.323] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.323] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.323] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", lpFilePart=0x0) returned 0x3a
	[0121.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0121.323] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.324] GetFileType (hFile=0x5dc) returned 0x1
	[0121.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0121.324] GetFileType (hFile=0x5dc) returned 0x1
	[0121.324] WriteFile (in: hFile=0x5dc, lpBuffer=0x26393a0*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26393a0*, lpNumberOfBytesWritten=0x540ef94*=0x7c0, lpOverlapped=0x0) returned 1
	[0121.325] CloseHandle (hObject=0x5dc) returned 1
	[0121.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", lpFilePart=0x0) returned 0x3a
	[0121.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0121.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0121.326] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x82a53f7d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7c0)) returned 1
	[0121.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0121.326] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.327] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", lpFilePart=0x0) returned 0x3a
	[0121.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.327] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml"), fInfoLevelId=0x0, lpFileInformation=0x263a698 | out: lpFileInformation=0x263a698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566)) returned 1
	[0121.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.327] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", lpFilePart=0x0) returned 0x3a
	[0121.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.328] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.328] GetFileType (hFile=0x5dc) returned 0x1
	[0121.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0121.328] GetFileType (hFile=0x5dc) returned 0x1
	[0121.328] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x566
	[0121.328] ReadFile (in: hFile=0x5dc, lpBuffer=0x263ae64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x263ae64*, lpNumberOfBytesRead=0x540efcc*=0x566, lpOverlapped=0x0) returned 1
	[0121.348] CloseHandle (hObject=0x5dc) returned 1
	[0121.348] CryptDestroyKey (hKey=0x82b000) returned 1
	[0121.348] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.348] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263bf00, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0121.348] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.348] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.348] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0121.348] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.348] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x263bfb8*=0x1, dwFlags=0x0) returned 1
	[0121.348] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x263bf84, dwFlags=0x0) returned 1
	[0121.348] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263bfc8*, pdwDataLen=0x540efd4*=0x570, dwBufLen=0x570 | out: pbData=0x263bfc8*, pdwDataLen=0x540efd4*=0x570) returned 1
	[0121.348] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263c544*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x263c544*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0121.348] CryptDestroyKey (hKey=0x82b480) returned 1
	[0121.348] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.349] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.349] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", lpFilePart=0x0) returned 0x3a
	[0121.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0121.349] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.351] GetFileType (hFile=0x5dc) returned 0x1
	[0121.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0121.351] GetFileType (hFile=0x5dc) returned 0x1
	[0121.351] WriteFile (in: hFile=0x5dc, lpBuffer=0x263c67c*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x263c67c*, lpNumberOfBytesWritten=0x540ef94*=0x570, lpOverlapped=0x0) returned 1
	[0121.352] CloseHandle (hObject=0x5dc) returned 1
	[0121.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", lpFilePart=0x0) returned 0x3a
	[0121.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0121.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0121.352] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x82aa03d3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x570)) returned 1
	[0121.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0121.353] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.353] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs", lpFilePart=0x0) returned 0x3a
	[0121.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.353] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_costdeferred.rbs"), fInfoLevelId=0x0, lpFileInformation=0x263d974 | out: lpFileInformation=0x263d974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666)) returned 1
	[0121.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.354] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs", lpFilePart=0x0) returned 0x3a
	[0121.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.354] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_costdeferred.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.356] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Normal.rbs", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Normal.rbs", lpFilePart=0x0) returned 0x34
	[0121.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.356] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Normal.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_normal.rbs"), fInfoLevelId=0x0, lpFileInformation=0x263e118 | out: lpFileInformation=0x263e118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b5e567a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b5e567a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x1000000)) returned 1
	[0121.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.356] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Normal.rbs", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Normal.rbs", lpFilePart=0x0) returned 0x34
	[0121.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.356] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Normal.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_normal.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.358] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs", lpFilePart=0x0) returned 0x3c
	[0121.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.358] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_normalcritical.rbs"), fInfoLevelId=0x0, lpFileInformation=0x263e8f8 | out: lpFileInformation=0x263e8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666)) returned 1
	[0121.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.359] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs", lpFilePart=0x0) returned 0x3c
	[0121.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.359] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_normalcritical.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.361] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Realtime.rbs", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Realtime.rbs", lpFilePart=0x0) returned 0x36
	[0121.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.361] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Realtime.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_realtime.rbs"), fInfoLevelId=0x0, lpFileInformation=0x263efe4 | out: lpFileInformation=0x263efe4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x333333)) returned 1
	[0121.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.361] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Realtime.rbs", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Realtime.rbs", lpFilePart=0x0) returned 0x36
	[0121.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.361] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Realtime.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_realtime.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.363] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\osver.txt", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\osver.txt", lpFilePart=0x0) returned 0x2c
	[0121.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.363] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\osver.txt"), fInfoLevelId=0x0, lpFileInformation=0x263f67c | out: lpFileInformation=0x263f67c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa)) returned 1
	[0121.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.364] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\osver.txt", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\osver.txt", lpFilePart=0x0) returned 0x2c
	[0121.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.367] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\osver.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat", lpFilePart=0x0) returned 0x2c
	[0121.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.373] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\programdata\\microsoft\\diagnosis\\parse.dat"), fInfoLevelId=0x0, lpFileInformation=0x263fc88 | out: lpFileInformation=0x263fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0121.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat", lpFilePart=0x0) returned 0x2c
	[0121.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.374] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\programdata\\microsoft\\diagnosis\\parse.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.376] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat", lpFilePart=0x0) returned 0x3b
	[0121.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.376] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\programdata\\microsoft\\diagnosis\\vortexschemarequests.dat"), fInfoLevelId=0x0, lpFileInformation=0x2640294 | out: lpFileInformation=0x2640294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0121.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.377] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat", lpFilePart=0x0) returned 0x3b
	[0121.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.377] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\programdata\\microsoft\\diagnosis\\vortexschemarequests.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0121.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", lpFilePart=0x0) returned 0x26
	[0121.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.379] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), fInfoLevelId=0x0, lpFileInformation=0x2640970 | out: lpFileInformation=0x2640970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c)) returned 1
	[0121.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0121.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", lpFilePart=0x0) returned 0x26
	[0121.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0121.379] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.379] GetFileType (hFile=0x5dc) returned 0x1
	[0121.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0121.379] GetFileType (hFile=0x5dc) returned 0x1
	[0121.379] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3a7c
	[0121.379] ReadFile (in: hFile=0x5dc, lpBuffer=0x2640b48, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2640b48*, lpNumberOfBytesRead=0x540efcc*=0x3a7c, lpOverlapped=0x0) returned 1
	[0121.392] CloseHandle (hObject=0x5dc) returned 1
	[0121.392] CryptDestroyKey (hKey=0x82b100) returned 1
	[0121.392] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.392] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2644660, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0121.392] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.392] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.392] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0121.392] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.392] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2644718*=0x1, dwFlags=0x0) returned 1
	[0121.392] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26446e4, dwFlags=0x0) returned 1
	[0121.393] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2644728*, pdwDataLen=0x540efd4*=0x3a80, dwBufLen=0x3a80 | out: pbData=0x2644728*, pdwDataLen=0x540efd4*=0x3a80) returned 1
	[0121.393] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26481b4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26481b4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0121.393] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0121.393] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.393] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.393] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", lpFilePart=0x0) returned 0x26
	[0121.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0121.393] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.395] GetFileType (hFile=0x5dc) returned 0x1
	[0121.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0121.395] GetFileType (hFile=0x5dc) returned 0x1
	[0121.395] WriteFile (in: hFile=0x5dc, lpBuffer=0x2644728*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2644728*, lpNumberOfBytesWritten=0x540efc0*=0x3a80, lpOverlapped=0x0) returned 1
	[0121.397] CloseHandle (hObject=0x5dc) returned 1
	[0121.398] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", lpFilePart=0x0) returned 0x26
	[0121.398] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Active.GRL id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0121.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0121.398] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x82b15a7e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3a80)) returned 1
	[0121.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0121.398] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), lpNewFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.401] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL", lpFilePart=0x0) returned 0x27
	[0121.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0121.401] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), fInfoLevelId=0x0, lpFileInformation=0x26484f8 | out: lpFileInformation=0x26484f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c)) returned 1
	[0121.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0122.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.400] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.400] GetFileType (hFile=0x5dc) returned 0x1
	[0122.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.400] GetFileType (hFile=0x5dc) returned 0x1
	[0122.400] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x27e
	[0122.400] ReadFile (in: hFile=0x5dc, lpBuffer=0x26af6e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26af6e4*, lpNumberOfBytesRead=0x540efcc*=0x27e, lpOverlapped=0x0) returned 1
	[0122.401] CloseHandle (hObject=0x5dc) returned 1
	[0122.402] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0122.402] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.402] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b0780, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0122.402] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.402] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.402] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0122.402] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.402] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26b0838*=0x1, dwFlags=0x0) returned 1
	[0122.402] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26b0804, dwFlags=0x0) returned 1
	[0122.402] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b0848*, pdwDataLen=0x540efd4*=0x280, dwBufLen=0x280 | out: pbData=0x26b0848*, pdwDataLen=0x540efd4*=0x280) returned 1
	[0122.402] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b0ad4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b0ad4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.402] CryptDestroyKey (hKey=0x82b300) returned 1
	[0122.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.403] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0122.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.403] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.404] GetFileType (hFile=0x5dc) returned 0x1
	[0122.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.404] GetFileType (hFile=0x5dc) returned 0x1
	[0122.404] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b0c14*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26b0c14*, lpNumberOfBytesWritten=0x540ef94*=0x280, lpOverlapped=0x0) returned 1
	[0122.406] CloseHandle (hObject=0x5dc) returned 1
	[0122.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0122.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7c
	[0122.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.406] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x834b1c16, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0122.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.406] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", lpFilePart=0x0) returned 0x54
	[0122.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.432] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), fInfoLevelId=0x0, lpFileInformation=0x26b1fa8 | out: lpFileInformation=0x26b1fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080)) returned 1
	[0122.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.433] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", lpFilePart=0x0) returned 0x54
	[0122.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.433] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.433] GetFileType (hFile=0x5dc) returned 0x1
	[0122.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.433] GetFileType (hFile=0x5dc) returned 0x1
	[0122.433] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x71080
	[0122.435] ReadFile (in: hFile=0x5dc, lpBuffer=0x7509fe8, nNumberOfBytesToRead=0x71080, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x7509fe8*, lpNumberOfBytesRead=0x540efcc*=0x71080, lpOverlapped=0x0) returned 1
	[0122.445] CloseHandle (hObject=0x5dc) returned 1
	[0122.445] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0122.445] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.445] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b22e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0122.445] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.445] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.445] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0122.445] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.446] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26b2398*=0x1, dwFlags=0x0) returned 1
	[0122.446] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26b2364, dwFlags=0x0) returned 1
	[0122.452] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x757b088*, pdwDataLen=0x540efd4*=0x71090, dwBufLen=0x71090 | out: pbData=0x757b088*, pdwDataLen=0x540efd4*=0x71090) returned 1
	[0122.453] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b23a8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b23a8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.453] CryptDestroyKey (hKey=0x82b280) returned 1
	[0122.453] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.453] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.453] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", lpFilePart=0x0) returned 0x54
	[0122.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.453] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.458] GetFileType (hFile=0x5dc) returned 0x1
	[0122.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.458] GetFileType (hFile=0x5dc) returned 0x1
	[0122.458] WriteFile (in: hFile=0x5dc, lpBuffer=0x757b088*, nNumberOfBytesToWrite=0x71090, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x757b088*, lpNumberOfBytesWritten=0x540efc0*=0x71090, lpOverlapped=0x0) returned 1
	[0122.492] CloseHandle (hObject=0x5dc) returned 1
	[0122.496] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", lpFilePart=0x0) returned 0x54
	[0122.496] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x83
	[0122.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.496] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x835707a2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x71090)) returned 1
	[0122.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.496] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.497] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0122.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.497] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x26b28c4 | out: lpFileInformation=0x26b28c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3714fdce, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee)) returned 1
	[0122.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.499] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0122.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.499] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.499] GetFileType (hFile=0x5dc) returned 0x1
	[0122.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.500] GetFileType (hFile=0x5dc) returned 0x1
	[0122.500] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2ee
	[0122.500] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b2e28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26b2e28*, lpNumberOfBytesRead=0x540efcc*=0x2ee, lpOverlapped=0x0) returned 1
	[0122.509] CloseHandle (hObject=0x5dc) returned 1
	[0122.510] CryptDestroyKey (hKey=0x82b380) returned 1
	[0122.510] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.510] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b3ec4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0122.510] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.510] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.510] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0122.510] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.510] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26b3f7c*=0x1, dwFlags=0x0) returned 1
	[0122.510] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26b3f48, dwFlags=0x0) returned 1
	[0122.510] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b3f8c*, pdwDataLen=0x540efd4*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x26b3f8c*, pdwDataLen=0x540efd4*=0x2f0) returned 1
	[0122.510] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b4288*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b4288*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.510] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0122.511] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.511] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0122.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.511] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.512] GetFileType (hFile=0x5dc) returned 0x1
	[0122.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.512] GetFileType (hFile=0x5dc) returned 0x1
	[0122.512] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b43c8*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26b43c8*, lpNumberOfBytesWritten=0x540ef94*=0x2f0, lpOverlapped=0x0) returned 1
	[0122.513] CloseHandle (hObject=0x5dc) returned 1
	[0122.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0122.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7c
	[0122.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.514] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x835969f5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0122.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.514] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.517] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", lpFilePart=0x0) returned 0x55
	[0122.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.517] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), fInfoLevelId=0x0, lpFileInformation=0x26b575c | out: lpFileInformation=0x26b575c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30)) returned 1
	[0122.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.520] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", lpFilePart=0x0) returned 0x55
	[0122.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.520] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.520] GetFileType (hFile=0x5dc) returned 0x1
	[0122.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.520] GetFileType (hFile=0x5dc) returned 0x1
	[0122.520] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xbee30
	[0122.522] ReadFile (in: hFile=0x5dc, lpBuffer=0x75ec138, nNumberOfBytesToRead=0xbee30, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x75ec138*, lpNumberOfBytesRead=0x540efcc*=0xbee30, lpOverlapped=0x0) returned 1
	[0122.570] CloseHandle (hObject=0x5dc) returned 1
	[0122.570] CryptDestroyKey (hKey=0x82b080) returned 1
	[0122.570] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.571] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b5a94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0122.571] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.571] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.571] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0122.571] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.571] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26b5b4c*=0x1, dwFlags=0x0) returned 1
	[0122.572] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26b5b18, dwFlags=0x0) returned 1
	[0122.586] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x76aaf88*, pdwDataLen=0x540efd4*=0xbee40, dwBufLen=0xbee40 | out: pbData=0x76aaf88*, pdwDataLen=0x540efd4*=0xbee40) returned 1
	[0122.586] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b5b5c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b5b5c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.586] CryptDestroyKey (hKey=0x82b200) returned 1
	[0122.586] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.587] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.587] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", lpFilePart=0x0) returned 0x55
	[0122.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.587] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.595] GetFileType (hFile=0x5dc) returned 0x1
	[0122.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.595] GetFileType (hFile=0x5dc) returned 0x1
	[0122.595] WriteFile (in: hFile=0x5dc, lpBuffer=0x76aaf88*, nNumberOfBytesToWrite=0xbee40, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x76aaf88*, lpNumberOfBytesWritten=0x540efc0*=0xbee40, lpOverlapped=0x0) returned 1
	[0122.631] CloseHandle (hObject=0x5dc) returned 1
	[0122.631] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", lpFilePart=0x0) returned 0x55
	[0122.631] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x84
	[0122.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.631] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x836c7cd4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xbee40)) returned 1
	[0122.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.632] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.633] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", lpFilePart=0x0) returned 0x38
	[0122.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.633] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26b6084 | out: lpFileInformation=0x26b6084*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9086d4, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdc9086d4, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xdc9086d4, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a)) returned 1
	[0122.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.634] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", lpFilePart=0x0) returned 0x38
	[0122.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.634] CreateFileW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.634] GetFileType (hFile=0x5dc) returned 0x1
	[0122.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.634] GetFileType (hFile=0x5dc) returned 0x1
	[0122.635] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1a
	[0122.635] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b62ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26b62ec*, lpNumberOfBytesRead=0x540efcc*=0x1a, lpOverlapped=0x0) returned 1
	[0122.636] CloseHandle (hObject=0x5dc) returned 1
	[0122.636] CryptDestroyKey (hKey=0x82b080) returned 1
	[0122.636] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.636] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b7388, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0122.636] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.636] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.636] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0122.636] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.637] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x26b7440*=0x1, dwFlags=0x0) returned 1
	[0122.637] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x26b740c, dwFlags=0x0) returned 1
	[0122.637] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b7450*, pdwDataLen=0x540efd4*=0x20, dwBufLen=0x20 | out: pbData=0x26b7450*, pdwDataLen=0x540efd4*=0x20) returned 1
	[0122.637] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b747c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b747c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.637] CryptDestroyKey (hKey=0x82b000) returned 1
	[0122.637] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.637] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.637] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", lpFilePart=0x0) returned 0x38
	[0122.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.637] CreateFileW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.639] GetFileType (hFile=0x5dc) returned 0x1
	[0122.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.639] GetFileType (hFile=0x5dc) returned 0x1
	[0122.639] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b75a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26b75a8*, lpNumberOfBytesWritten=0x540ef94*=0x20, lpOverlapped=0x0) returned 1
	[0122.640] CloseHandle (hObject=0x5dc) returned 1
	[0122.640] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", lpFilePart=0x0) returned 0x38
	[0122.641] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0122.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.641] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9086d4, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdc9086d4, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x836edefc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x20)) returned 1
	[0122.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.641] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml"), lpNewFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.642] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", lpFilePart=0x0) returned 0x59
	[0122.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.642] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), fInfoLevelId=0x0, lpFileInformation=0x26b8890 | out: lpFileInformation=0x26b8890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66857b30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x668a40e9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xcb3)) returned 1
	[0122.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.643] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", lpFilePart=0x0) returned 0x59
	[0122.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.643] CreateFileW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.643] GetFileType (hFile=0x5dc) returned 0x1
	[0122.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.643] GetFileType (hFile=0x5dc) returned 0x1
	[0122.643] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xcb3
	[0122.643] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b9890, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26b9890*, lpNumberOfBytesRead=0x540efcc*=0xcb3, lpOverlapped=0x0) returned 1
	[0122.644] CloseHandle (hObject=0x5dc) returned 1
	[0122.644] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0122.644] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.644] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ba92c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0122.645] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.645] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.645] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0122.645] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.645] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26ba9e4*=0x1, dwFlags=0x0) returned 1
	[0122.645] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26ba9b0, dwFlags=0x0) returned 1
	[0122.645] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ba9f4*, pdwDataLen=0x540efd4*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x26ba9f4*, pdwDataLen=0x540efd4*=0xcc0) returned 1
	[0122.645] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bb6c0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26bb6c0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.645] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0122.645] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.645] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.645] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", lpFilePart=0x0) returned 0x59
	[0122.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.645] CreateFileW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.647] GetFileType (hFile=0x5dc) returned 0x1
	[0122.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.647] GetFileType (hFile=0x5dc) returned 0x1
	[0122.647] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bb86c*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26bb86c*, lpNumberOfBytesWritten=0x540ef94*=0xcc0, lpOverlapped=0x0) returned 1
	[0122.648] CloseHandle (hObject=0x5dc) returned 1
	[0122.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", lpFilePart=0x0) returned 0x59
	[0122.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x88
	[0122.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.648] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66857b30, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x836edefc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xcc0)) returned 1
	[0122.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.649] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), lpNewFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl", lpFilePart=0x0) returned 0x34
	[0122.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.650] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.001.etl"), fInfoLevelId=0x0, lpFileInformation=0x26bcc60 | out: lpFileInformation=0x26bcc60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x58d51fd9, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x597705f5, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.651] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl", lpFilePart=0x0) returned 0x34
	[0122.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.651] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.001.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.651] GetFileType (hFile=0x5dc) returned 0x1
	[0122.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.651] GetFileType (hFile=0x5dc) returned 0x1
	[0122.651] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.651] ReadFile (in: hFile=0x5dc, lpBuffer=0x26bcea0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26bcea0*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.669] CloseHandle (hObject=0x5dc) returned 1
	[0122.669] CryptDestroyKey (hKey=0x82b540) returned 1
	[0122.669] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.669] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bef3c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0122.669] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.669] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.669] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0122.669] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.670] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26beff4*=0x1, dwFlags=0x0) returned 1
	[0122.670] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26befc0, dwFlags=0x0) returned 1
	[0122.670] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bf004*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26bf004*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.670] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c1020*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c1020*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.670] CryptDestroyKey (hKey=0x82b480) returned 1
	[0122.670] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.670] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.670] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl", lpFilePart=0x0) returned 0x34
	[0122.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.670] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.001.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.672] GetFileType (hFile=0x5dc) returned 0x1
	[0122.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.672] GetFileType (hFile=0x5dc) returned 0x1
	[0122.672] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bf004*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26bf004*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.673] CloseHandle (hObject=0x5dc) returned 1
	[0122.674] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl", lpFilePart=0x0) returned 0x34
	[0122.674] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x63
	[0122.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.674] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.001.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x58d51fd9, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x8373a35f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.674] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.001.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.001.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl", lpFilePart=0x0) returned 0x34
	[0122.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.675] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.002.etl"), fInfoLevelId=0x0, lpFileInformation=0x26c1408 | out: lpFileInformation=0x26c1408*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7cf76e0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x852e502, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl", lpFilePart=0x0) returned 0x34
	[0122.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.676] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.002.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.676] GetFileType (hFile=0x5dc) returned 0x1
	[0122.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.676] GetFileType (hFile=0x5dc) returned 0x1
	[0122.676] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.676] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c1648, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c1648*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.678] CloseHandle (hObject=0x5dc) returned 1
	[0122.678] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0122.678] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.678] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c36e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0122.678] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.678] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.678] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0122.678] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.679] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26c379c*=0x1, dwFlags=0x0) returned 1
	[0122.679] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26c3768, dwFlags=0x0) returned 1
	[0122.679] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c37ac*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26c37ac*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.679] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c57c8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c57c8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.679] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0122.679] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.679] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl", lpFilePart=0x0) returned 0x34
	[0122.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.679] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.002.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.680] GetFileType (hFile=0x5dc) returned 0x1
	[0122.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.680] GetFileType (hFile=0x5dc) returned 0x1
	[0122.680] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c37ac*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26c37ac*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.681] CloseHandle (hObject=0x5dc) returned 1
	[0122.682] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl", lpFilePart=0x0) returned 0x34
	[0122.682] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x63
	[0122.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.682] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.002.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7cf76e0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x8373a35f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.682] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.002.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.002.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.683] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl", lpFilePart=0x0) returned 0x3a
	[0122.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.683] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.001.etl"), fInfoLevelId=0x0, lpFileInformation=0x26c5bb0 | out: lpFileInformation=0x26c5bb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2d822f20, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2efd472c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.683] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl", lpFilePart=0x0) returned 0x3a
	[0122.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.683] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.001.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.683] GetFileType (hFile=0x5dc) returned 0x1
	[0122.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.683] GetFileType (hFile=0x5dc) returned 0x1
	[0122.683] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.684] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c5e20, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c5e20*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.694] CloseHandle (hObject=0x5dc) returned 1
	[0122.694] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0122.694] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.694] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c7ebc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0122.694] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.694] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.694] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0122.694] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.694] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x26c7f74*=0x1, dwFlags=0x0) returned 1
	[0122.694] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26c7f40, dwFlags=0x0) returned 1
	[0122.694] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c7f84*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26c7f84*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.695] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c9fa0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c9fa0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.695] CryptDestroyKey (hKey=0x82b400) returned 1
	[0122.695] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.695] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.695] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl", lpFilePart=0x0) returned 0x3a
	[0122.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.695] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.001.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.696] GetFileType (hFile=0x5dc) returned 0x1
	[0122.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.696] GetFileType (hFile=0x5dc) returned 0x1
	[0122.696] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c7f84*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26c7f84*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.698] CloseHandle (hObject=0x5dc) returned 1
	[0122.698] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl", lpFilePart=0x0) returned 0x3a
	[0122.698] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.698] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.001.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2d822f20, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x837605d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.698] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.001.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.001.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.699] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl", lpFilePart=0x0) returned 0x3a
	[0122.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.699] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.002.etl"), fInfoLevelId=0x0, lpFileInformation=0x26ca3d0 | out: lpFileInformation=0x26ca3d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfe554d51, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0xfe782447, ftLastWriteTime.dwHighDateTime=0x1d3375a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.700] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl", lpFilePart=0x0) returned 0x3a
	[0122.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.701] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.002.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.701] GetFileType (hFile=0x5dc) returned 0x1
	[0122.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.701] GetFileType (hFile=0x5dc) returned 0x1
	[0122.701] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.701] ReadFile (in: hFile=0x5dc, lpBuffer=0x26ca640, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ca640*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.708] CloseHandle (hObject=0x5dc) returned 1
	[0122.708] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0122.708] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.708] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26cc6dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0122.708] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.708] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.708] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0122.708] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.708] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26cc794*=0x1, dwFlags=0x0) returned 1
	[0122.708] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x26cc760, dwFlags=0x0) returned 1
	[0122.709] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26cc7a4*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26cc7a4*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.709] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ce7c0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26ce7c0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.709] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0122.709] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.709] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.709] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl", lpFilePart=0x0) returned 0x3a
	[0122.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.709] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.002.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.710] GetFileType (hFile=0x5dc) returned 0x1
	[0122.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.711] GetFileType (hFile=0x5dc) returned 0x1
	[0122.711] WriteFile (in: hFile=0x5dc, lpBuffer=0x26cc7a4*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26cc7a4*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.712] CloseHandle (hObject=0x5dc) returned 1
	[0122.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl", lpFilePart=0x0) returned 0x3a
	[0122.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.712] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.002.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfe554d51, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0x83786870, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.713] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.002.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.002.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl", lpFilePart=0x0) returned 0x3a
	[0122.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.715] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.003.etl"), fInfoLevelId=0x0, lpFileInformation=0x26cebf0 | out: lpFileInformation=0x26cebf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfdf01be1, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfdfc06a7, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.715] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl", lpFilePart=0x0) returned 0x3a
	[0122.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.715] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.003.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.716] GetFileType (hFile=0x5dc) returned 0x1
	[0122.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.716] GetFileType (hFile=0x5dc) returned 0x1
	[0122.716] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.716] ReadFile (in: hFile=0x5dc, lpBuffer=0x26cee60, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26cee60*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.718] CloseHandle (hObject=0x5dc) returned 1
	[0122.718] CryptDestroyKey (hKey=0x82b200) returned 1
	[0122.718] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.718] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d0efc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0122.718] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.718] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.718] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0122.718] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.718] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26d0fb4*=0x1, dwFlags=0x0) returned 1
	[0122.718] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26d0f80, dwFlags=0x0) returned 1
	[0122.719] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d0fc4*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26d0fc4*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.719] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d2fe0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26d2fe0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.719] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0122.719] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.719] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl", lpFilePart=0x0) returned 0x3a
	[0122.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.719] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.003.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.720] GetFileType (hFile=0x5dc) returned 0x1
	[0122.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.721] GetFileType (hFile=0x5dc) returned 0x1
	[0122.721] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d0fc4*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26d0fc4*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.722] CloseHandle (hObject=0x5dc) returned 1
	[0122.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl", lpFilePart=0x0) returned 0x3a
	[0122.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.722] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.003.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfdf01be1, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0x837acac1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.723] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.003.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.003.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.723] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl", lpFilePart=0x0) returned 0x3a
	[0122.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.724] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.004.etl"), fInfoLevelId=0x0, lpFileInformation=0x26d3410 | out: lpFileInformation=0x26d3410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x588b3c6a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x59ae67c8, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl", lpFilePart=0x0) returned 0x3a
	[0122.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.724] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.004.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.724] GetFileType (hFile=0x5dc) returned 0x1
	[0122.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.725] GetFileType (hFile=0x5dc) returned 0x1
	[0122.725] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.725] ReadFile (in: hFile=0x5dc, lpBuffer=0x26d3680, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d3680*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.729] CloseHandle (hObject=0x5dc) returned 1
	[0122.729] CryptDestroyKey (hKey=0x82b380) returned 1
	[0122.729] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.730] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d571c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0122.730] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.730] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.730] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0122.730] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.730] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x26d57d4*=0x1, dwFlags=0x0) returned 1
	[0122.730] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x26d57a0, dwFlags=0x0) returned 1
	[0122.730] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d57e4*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26d57e4*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.730] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d7800*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26d7800*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.730] CryptDestroyKey (hKey=0x82b040) returned 1
	[0122.730] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.730] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.730] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl", lpFilePart=0x0) returned 0x3a
	[0122.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.731] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.004.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.732] GetFileType (hFile=0x5dc) returned 0x1
	[0122.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.732] GetFileType (hFile=0x5dc) returned 0x1
	[0122.732] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d57e4*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26d57e4*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.734] CloseHandle (hObject=0x5dc) returned 1
	[0122.734] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl", lpFilePart=0x0) returned 0x3a
	[0122.734] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.734] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.004.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x588b3c6a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x837d2cd1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.734] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.004.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.004.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.735] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl", lpFilePart=0x0) returned 0x3a
	[0122.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.735] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.005.etl"), fInfoLevelId=0x0, lpFileInformation=0x26d7c30 | out: lpFileInformation=0x26d7c30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xb4b94410, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0xb50917ed, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.740] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl", lpFilePart=0x0) returned 0x3a
	[0122.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.740] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.005.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.741] GetFileType (hFile=0x5dc) returned 0x1
	[0122.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.741] GetFileType (hFile=0x5dc) returned 0x1
	[0122.741] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.741] ReadFile (in: hFile=0x5dc, lpBuffer=0x26d7ea0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d7ea0*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.757] CloseHandle (hObject=0x5dc) returned 1
	[0122.757] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0122.757] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.757] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d9f3c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0122.757] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.758] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0122.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.758] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x26d9ff4*=0x1, dwFlags=0x0) returned 1
	[0122.758] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26d9fc0, dwFlags=0x0) returned 1
	[0122.758] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26da004*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26da004*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.758] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dc020*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26dc020*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.758] CryptDestroyKey (hKey=0x82b400) returned 1
	[0122.758] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.758] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.758] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl", lpFilePart=0x0) returned 0x3a
	[0122.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.758] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.005.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.760] GetFileType (hFile=0x5dc) returned 0x1
	[0122.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.760] GetFileType (hFile=0x5dc) returned 0x1
	[0122.760] WriteFile (in: hFile=0x5dc, lpBuffer=0x26da004*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26da004*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.761] CloseHandle (hObject=0x5dc) returned 1
	[0122.761] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl", lpFilePart=0x0) returned 0x3a
	[0122.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.762] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.005.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xb4b94410, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x837f8f99, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.762] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.005.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.005.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.763] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl", lpFilePart=0x0) returned 0x3a
	[0122.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.763] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.006.etl"), fInfoLevelId=0x0, lpFileInformation=0x26dc450 | out: lpFileInformation=0x26dc450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x86d6bb14, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x8728eea2, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl", lpFilePart=0x0) returned 0x3a
	[0122.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.764] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.006.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.764] GetFileType (hFile=0x5dc) returned 0x1
	[0122.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.764] GetFileType (hFile=0x5dc) returned 0x1
	[0122.764] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.764] ReadFile (in: hFile=0x5dc, lpBuffer=0x26dc6c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26dc6c0*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.766] CloseHandle (hObject=0x5dc) returned 1
	[0122.766] CryptDestroyKey (hKey=0x82b540) returned 1
	[0122.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.766] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26de75c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0122.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.766] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0122.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.767] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26de814*=0x1, dwFlags=0x0) returned 1
	[0122.767] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26de7e0, dwFlags=0x0) returned 1
	[0122.767] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26de824*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26de824*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.767] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e0840*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e0840*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.767] CryptDestroyKey (hKey=0x82b200) returned 1
	[0122.767] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.767] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.767] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl", lpFilePart=0x0) returned 0x3a
	[0122.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.767] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.006.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.769] GetFileType (hFile=0x5dc) returned 0x1
	[0122.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.769] GetFileType (hFile=0x5dc) returned 0x1
	[0122.769] WriteFile (in: hFile=0x5dc, lpBuffer=0x26de824*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26de824*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.770] CloseHandle (hObject=0x5dc) returned 1
	[0122.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl", lpFilePart=0x0) returned 0x3a
	[0122.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.770] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.006.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x86d6bb14, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x8381f1c0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.771] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.006.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.006.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.772] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl", lpFilePart=0x0) returned 0x3a
	[0122.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.772] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.007.etl"), fInfoLevelId=0x0, lpFileInformation=0x26e0c70 | out: lpFileInformation=0x26e0c70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe7f77c60, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xebc8ba4e, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.773] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl", lpFilePart=0x0) returned 0x3a
	[0122.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.773] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.007.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.774] GetFileType (hFile=0x5dc) returned 0x1
	[0122.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.774] GetFileType (hFile=0x5dc) returned 0x1
	[0122.774] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.774] ReadFile (in: hFile=0x5dc, lpBuffer=0x26e0ee0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e0ee0*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.782] CloseHandle (hObject=0x5dc) returned 1
	[0122.782] CryptDestroyKey (hKey=0x82b280) returned 1
	[0122.782] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.782] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e2f7c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0122.782] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.782] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.782] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0122.782] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.782] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x26e3034*=0x1, dwFlags=0x0) returned 1
	[0122.782] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x26e3000, dwFlags=0x0) returned 1
	[0122.782] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e3044*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26e3044*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.783] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e5060*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e5060*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.783] CryptDestroyKey (hKey=0x82b080) returned 1
	[0122.783] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.783] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.783] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl", lpFilePart=0x0) returned 0x3a
	[0122.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.783] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.007.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.784] GetFileType (hFile=0x5dc) returned 0x1
	[0122.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.784] GetFileType (hFile=0x5dc) returned 0x1
	[0122.784] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e3044*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26e3044*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.786] CloseHandle (hObject=0x5dc) returned 1
	[0122.786] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl", lpFilePart=0x0) returned 0x3a
	[0122.786] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.786] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.007.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe7f77c60, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x83845434, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.786] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.007.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.007.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.787] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl", lpFilePart=0x0) returned 0x3a
	[0122.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.787] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.008.etl"), fInfoLevelId=0x0, lpFileInformation=0x26e5490 | out: lpFileInformation=0x26e5490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe1017621, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe10d621a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.788] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl", lpFilePart=0x0) returned 0x3a
	[0122.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.788] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.008.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.788] GetFileType (hFile=0x5dc) returned 0x1
	[0122.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.788] GetFileType (hFile=0x5dc) returned 0x1
	[0122.788] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.788] ReadFile (in: hFile=0x5dc, lpBuffer=0x26e5700, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e5700*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.795] CloseHandle (hObject=0x5dc) returned 1
	[0122.795] CryptDestroyKey (hKey=0x82b100) returned 1
	[0122.795] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.795] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e779c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0122.795] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.795] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.795] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0122.796] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.796] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26e7854*=0x1, dwFlags=0x0) returned 1
	[0122.796] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26e7820, dwFlags=0x0) returned 1
	[0122.796] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e7864*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26e7864*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.796] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e9880*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e9880*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.796] CryptDestroyKey (hKey=0x82b200) returned 1
	[0122.796] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.796] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.796] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl", lpFilePart=0x0) returned 0x3a
	[0122.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.796] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.008.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.798] GetFileType (hFile=0x5dc) returned 0x1
	[0122.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.798] GetFileType (hFile=0x5dc) returned 0x1
	[0122.798] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e7864*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26e7864*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.799] CloseHandle (hObject=0x5dc) returned 1
	[0122.799] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl", lpFilePart=0x0) returned 0x3a
	[0122.799] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.800] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.008.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe1017621, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8386b676, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.800] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.008.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.008.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl", lpFilePart=0x0) returned 0x3a
	[0122.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.802] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.009.etl"), fInfoLevelId=0x0, lpFileInformation=0x26e9cb0 | out: lpFileInformation=0x26e9cb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2fb7ebe4, ftLastAccessTime.dwHighDateTime=0x1d327d1, ftLastWriteTime.dwLowDateTime=0x2fc89ca0, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl", lpFilePart=0x0) returned 0x3a
	[0122.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.802] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.009.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.803] GetFileType (hFile=0x5dc) returned 0x1
	[0122.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.803] GetFileType (hFile=0x5dc) returned 0x1
	[0122.803] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.803] ReadFile (in: hFile=0x5dc, lpBuffer=0x26e9f20, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e9f20*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.837] CloseHandle (hObject=0x5dc) returned 1
	[0122.837] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0122.837] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.837] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ebfbc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0122.837] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.837] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.837] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0122.838] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.838] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26ec074*=0x1, dwFlags=0x0) returned 1
	[0122.838] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26ec040, dwFlags=0x0) returned 1
	[0122.838] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ec084*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26ec084*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.838] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ee0a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26ee0a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.838] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0122.838] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.838] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.838] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl", lpFilePart=0x0) returned 0x3a
	[0122.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.838] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.009.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.840] GetFileType (hFile=0x5dc) returned 0x1
	[0122.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.840] GetFileType (hFile=0x5dc) returned 0x1
	[0122.840] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ec084*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26ec084*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.841] CloseHandle (hObject=0x5dc) returned 1
	[0122.841] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl", lpFilePart=0x0) returned 0x3a
	[0122.841] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.841] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.009.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2fb7ebe4, ftLastAccessTime.dwHighDateTime=0x1d327d1, ftLastWriteTime.dwLowDateTime=0x838b7b17, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.842] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.009.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.009.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.843] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl", lpFilePart=0x0) returned 0x3a
	[0122.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.843] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.010.etl"), fInfoLevelId=0x0, lpFileInformation=0x26ee4d0 | out: lpFileInformation=0x26ee4d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xd855139b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd87b395e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.844] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl", lpFilePart=0x0) returned 0x3a
	[0122.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.844] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.010.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.844] GetFileType (hFile=0x5dc) returned 0x1
	[0122.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.844] GetFileType (hFile=0x5dc) returned 0x1
	[0122.844] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.844] ReadFile (in: hFile=0x5dc, lpBuffer=0x26ee740, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ee740*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.853] CloseHandle (hObject=0x5dc) returned 1
	[0122.853] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0122.853] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.853] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f07dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0122.853] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.853] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.853] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0122.853] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.853] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26f0894*=0x1, dwFlags=0x0) returned 1
	[0122.853] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26f0860, dwFlags=0x0) returned 1
	[0122.853] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f08a4*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26f08a4*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.853] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f28c0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f28c0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.853] CryptDestroyKey (hKey=0x82b340) returned 1
	[0122.854] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.854] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.854] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl", lpFilePart=0x0) returned 0x3a
	[0122.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.854] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.010.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.855] GetFileType (hFile=0x5dc) returned 0x1
	[0122.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.855] GetFileType (hFile=0x5dc) returned 0x1
	[0122.855] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f08a4*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26f08a4*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.856] CloseHandle (hObject=0x5dc) returned 1
	[0122.857] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl", lpFilePart=0x0) returned 0x3a
	[0122.857] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.857] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.010.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xd855139b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x838dde2c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.857] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.010.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.010.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.858] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl", lpFilePart=0x0) returned 0x3a
	[0122.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.858] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.011.etl"), fInfoLevelId=0x0, lpFileInformation=0x26f2cf0 | out: lpFileInformation=0x26f2cf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x1ff683d6, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x20000d39, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.859] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl", lpFilePart=0x0) returned 0x3a
	[0122.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.859] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.011.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.859] GetFileType (hFile=0x5dc) returned 0x1
	[0122.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.859] GetFileType (hFile=0x5dc) returned 0x1
	[0122.859] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.859] ReadFile (in: hFile=0x5dc, lpBuffer=0x26f2f60, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f2f60*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.869] CloseHandle (hObject=0x5dc) returned 1
	[0122.869] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0122.869] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.869] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f4ffc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0122.869] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.869] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.869] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0122.869] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.869] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x26f50b4*=0x1, dwFlags=0x0) returned 1
	[0122.869] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26f5080, dwFlags=0x0) returned 1
	[0122.869] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f50c4*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26f50c4*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.870] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f70e0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f70e0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.870] CryptDestroyKey (hKey=0x82b400) returned 1
	[0122.870] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.870] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.870] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl", lpFilePart=0x0) returned 0x3a
	[0122.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.870] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.011.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.871] GetFileType (hFile=0x5dc) returned 0x1
	[0122.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.871] GetFileType (hFile=0x5dc) returned 0x1
	[0122.871] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f50c4*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26f50c4*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.872] CloseHandle (hObject=0x5dc) returned 1
	[0122.873] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl", lpFilePart=0x0) returned 0x3a
	[0122.873] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.873] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.011.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x1ff683d6, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x83903f9a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.873] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.011.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.011.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.875] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl", lpFilePart=0x0) returned 0x3a
	[0122.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.875] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.012.etl"), fInfoLevelId=0x0, lpFileInformation=0x26f7510 | out: lpFileInformation=0x26f7510*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x46e2de3d, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x46eecb64, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.876] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl", lpFilePart=0x0) returned 0x3a
	[0122.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.876] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.012.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.876] GetFileType (hFile=0x5dc) returned 0x1
	[0122.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.876] GetFileType (hFile=0x5dc) returned 0x1
	[0122.876] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.877] ReadFile (in: hFile=0x5dc, lpBuffer=0x26f7780, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f7780*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.889] CloseHandle (hObject=0x5dc) returned 1
	[0122.889] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0122.889] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.889] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f981c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0122.889] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.889] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.889] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0122.889] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.889] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26f98d4*=0x1, dwFlags=0x0) returned 1
	[0122.889] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26f98a0, dwFlags=0x0) returned 1
	[0122.889] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f98e4*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26f98e4*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.890] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fb900*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26fb900*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.890] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0122.890] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.890] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.890] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl", lpFilePart=0x0) returned 0x3a
	[0122.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.890] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.012.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.891] GetFileType (hFile=0x5dc) returned 0x1
	[0122.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.891] GetFileType (hFile=0x5dc) returned 0x1
	[0122.891] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f98e4*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26f98e4*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.893] CloseHandle (hObject=0x5dc) returned 1
	[0122.893] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl", lpFilePart=0x0) returned 0x3a
	[0122.893] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.893] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.012.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x46e2de3d, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x83950577, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.893] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.012.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.012.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.894] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl", lpFilePart=0x0) returned 0x3a
	[0122.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.894] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.013.etl"), fInfoLevelId=0x0, lpFileInformation=0x26fbd30 | out: lpFileInformation=0x26fbd30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x235d058f, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x23917bad, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.894] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl", lpFilePart=0x0) returned 0x3a
	[0122.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.895] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.013.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.895] GetFileType (hFile=0x5dc) returned 0x1
	[0122.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.895] GetFileType (hFile=0x5dc) returned 0x1
	[0122.895] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.895] ReadFile (in: hFile=0x5dc, lpBuffer=0x26fbfa0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26fbfa0*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.915] CloseHandle (hObject=0x5dc) returned 1
	[0122.915] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0122.915] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.915] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fe03c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0122.915] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.915] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.915] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0122.915] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.915] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26fe0f4*=0x1, dwFlags=0x0) returned 1
	[0122.915] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26fe0c0, dwFlags=0x0) returned 1
	[0122.915] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fe104*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26fe104*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.915] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2700120*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2700120*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.915] CryptDestroyKey (hKey=0x82b540) returned 1
	[0122.915] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.915] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl", lpFilePart=0x0) returned 0x3a
	[0122.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.916] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.013.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.917] GetFileType (hFile=0x5dc) returned 0x1
	[0122.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.917] GetFileType (hFile=0x5dc) returned 0x1
	[0122.917] WriteFile (in: hFile=0x5dc, lpBuffer=0x26fe104*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26fe104*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.918] CloseHandle (hObject=0x5dc) returned 1
	[0122.918] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl", lpFilePart=0x0) returned 0x3a
	[0122.919] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.919] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.013.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x235d058f, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x8397677c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.919] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.013.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.013.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.920] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl", lpFilePart=0x0) returned 0x3a
	[0122.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.920] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.014.etl"), fInfoLevelId=0x0, lpFileInformation=0x2700550 | out: lpFileInformation=0x2700550*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x8f69453d, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0x8f779518, ftLastWriteTime.dwHighDateTime=0x1d327b9, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.920] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl", lpFilePart=0x0) returned 0x3a
	[0122.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.921] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.014.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.921] GetFileType (hFile=0x5dc) returned 0x1
	[0122.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.921] GetFileType (hFile=0x5dc) returned 0x1
	[0122.921] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.921] ReadFile (in: hFile=0x5dc, lpBuffer=0x27007c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27007c0*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.923] CloseHandle (hObject=0x5dc) returned 1
	[0122.923] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0122.923] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.923] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270285c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0122.923] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.923] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.923] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0122.923] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.923] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2702914*=0x1, dwFlags=0x0) returned 1
	[0122.923] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27028e0, dwFlags=0x0) returned 1
	[0122.924] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2702924*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x2702924*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.924] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2704940*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2704940*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.924] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0122.924] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.924] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.924] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl", lpFilePart=0x0) returned 0x3a
	[0122.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.924] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.014.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.925] GetFileType (hFile=0x5dc) returned 0x1
	[0122.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.925] GetFileType (hFile=0x5dc) returned 0x1
	[0122.925] WriteFile (in: hFile=0x5dc, lpBuffer=0x2702924*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2702924*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.927] CloseHandle (hObject=0x5dc) returned 1
	[0122.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl", lpFilePart=0x0) returned 0x3a
	[0122.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.927] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.014.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x8f69453d, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0x8399c93e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.927] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.014.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.014.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.928] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl", lpFilePart=0x0) returned 0x3a
	[0122.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.928] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.015.etl"), fInfoLevelId=0x0, lpFileInformation=0x2704d70 | out: lpFileInformation=0x2704d70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7fb3688d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7fc1b6b8, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl", lpFilePart=0x0) returned 0x3a
	[0122.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.929] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.015.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.930] GetFileType (hFile=0x5dc) returned 0x1
	[0122.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.930] GetFileType (hFile=0x5dc) returned 0x1
	[0122.930] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.930] ReadFile (in: hFile=0x5dc, lpBuffer=0x2704fe0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2704fe0*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.941] CloseHandle (hObject=0x5dc) returned 1
	[0122.941] CryptDestroyKey (hKey=0x82b480) returned 1
	[0122.941] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.941] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270707c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0122.942] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.942] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.942] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0122.942] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.942] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2707134*=0x1, dwFlags=0x0) returned 1
	[0122.942] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2707100, dwFlags=0x0) returned 1
	[0122.942] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2707144*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x2707144*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.942] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2709160*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2709160*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.942] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0122.942] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.942] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.942] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl", lpFilePart=0x0) returned 0x3a
	[0122.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.943] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.015.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.944] GetFileType (hFile=0x5dc) returned 0x1
	[0122.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.944] GetFileType (hFile=0x5dc) returned 0x1
	[0122.944] WriteFile (in: hFile=0x5dc, lpBuffer=0x2707144*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2707144*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.945] CloseHandle (hObject=0x5dc) returned 1
	[0122.945] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl", lpFilePart=0x0) returned 0x3a
	[0122.945] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.946] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.015.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7fb3688d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x839c2bf2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.946] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.015.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.015.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.947] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl", lpFilePart=0x0) returned 0x3a
	[0122.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.947] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.016.etl"), fInfoLevelId=0x0, lpFileInformation=0x2709590 | out: lpFileInformation=0x2709590*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb502d29, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb5c1a4e, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.948] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl", lpFilePart=0x0) returned 0x3a
	[0122.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.948] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.016.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.948] GetFileType (hFile=0x5dc) returned 0x1
	[0122.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.948] GetFileType (hFile=0x5dc) returned 0x1
	[0122.948] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.948] ReadFile (in: hFile=0x5dc, lpBuffer=0x2709800, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2709800*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.955] CloseHandle (hObject=0x5dc) returned 1
	[0122.955] CryptDestroyKey (hKey=0x82b280) returned 1
	[0122.955] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.955] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270b89c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0122.955] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.955] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.955] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0122.955] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.955] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x270b954*=0x1, dwFlags=0x0) returned 1
	[0122.955] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x270b920, dwFlags=0x0) returned 1
	[0122.955] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270b964*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x270b964*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.955] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270d980*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x270d980*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.956] CryptDestroyKey (hKey=0x82b300) returned 1
	[0122.956] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.956] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.956] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl", lpFilePart=0x0) returned 0x3a
	[0122.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.956] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.016.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.957] GetFileType (hFile=0x5dc) returned 0x1
	[0122.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.957] GetFileType (hFile=0x5dc) returned 0x1
	[0122.958] WriteFile (in: hFile=0x5dc, lpBuffer=0x270b964*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x270b964*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.959] CloseHandle (hObject=0x5dc) returned 1
	[0122.959] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl", lpFilePart=0x0) returned 0x3a
	[0122.959] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.959] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.016.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb502d29, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x839ed36d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.959] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.016.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.016.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.960] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl", lpFilePart=0x0) returned 0x3a
	[0122.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.960] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.017.etl"), fInfoLevelId=0x0, lpFileInformation=0x270ddb0 | out: lpFileInformation=0x270ddb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7b53cfc, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x8be7d51, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1
	[0122.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.961] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl", lpFilePart=0x0) returned 0x3a
	[0122.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.961] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.017.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.962] GetFileType (hFile=0x5dc) returned 0x1
	[0122.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.962] GetFileType (hFile=0x5dc) returned 0x1
	[0122.962] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3000
	[0122.962] ReadFile (in: hFile=0x5dc, lpBuffer=0x270e020, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x270e020*, lpNumberOfBytesRead=0x540efcc*=0x3000, lpOverlapped=0x0) returned 1
	[0122.970] CloseHandle (hObject=0x5dc) returned 1
	[0122.970] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0122.970] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.970] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27110bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0122.970] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.970] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.970] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0122.970] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.970] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2711174*=0x1, dwFlags=0x0) returned 1
	[0122.971] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2711140, dwFlags=0x0) returned 1
	[0122.971] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2711184*, pdwDataLen=0x540efd4*=0x3010, dwBufLen=0x3010 | out: pbData=0x2711184*, pdwDataLen=0x540efd4*=0x3010) returned 1
	[0122.971] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27141a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27141a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.971] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0122.971] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.971] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.971] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl", lpFilePart=0x0) returned 0x3a
	[0122.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.971] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.017.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.972] GetFileType (hFile=0x5dc) returned 0x1
	[0122.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.973] GetFileType (hFile=0x5dc) returned 0x1
	[0122.973] WriteFile (in: hFile=0x5dc, lpBuffer=0x2711184*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2711184*, lpNumberOfBytesWritten=0x540efc0*=0x3010, lpOverlapped=0x0) returned 1
	[0122.974] CloseHandle (hObject=0x5dc) returned 1
	[0122.974] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl", lpFilePart=0x0) returned 0x3a
	[0122.974] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0122.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.974] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.017.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7b53cfc, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x83a0f019, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1
	[0122.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.975] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.017.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.017.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", lpFilePart=0x0) returned 0x40
	[0122.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.975] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.001.etl"), fInfoLevelId=0x0, lpFileInformation=0x27145d0 | out: lpFileInformation=0x27145d0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x56ec7d41, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x56ec7d41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.977] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", lpFilePart=0x0) returned 0x40
	[0122.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.977] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.001.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0122.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0122.979] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", lpFilePart=0x0) returned 0x40
	[0122.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0122.979] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.002.etl"), fInfoLevelId=0x0, lpFileInformation=0x2714d74 | out: lpFileInformation=0x2714d74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xde371631, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x2bb800e, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0122.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0122.980] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", lpFilePart=0x0) returned 0x40
	[0122.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0122.980] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.002.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.980] GetFileType (hFile=0x5dc) returned 0x1
	[0122.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0122.980] GetFileType (hFile=0x5dc) returned 0x1
	[0122.980] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0122.980] ReadFile (in: hFile=0x5dc, lpBuffer=0x2715014, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2715014*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0122.982] CloseHandle (hObject=0x5dc) returned 1
	[0122.982] CryptDestroyKey (hKey=0x82b300) returned 1
	[0122.982] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.982] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27170b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0122.982] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.982] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.982] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0122.982] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.982] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x2717168*=0x1, dwFlags=0x0) returned 1
	[0122.982] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x2717134, dwFlags=0x0) returned 1
	[0122.983] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2717178*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x2717178*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0122.983] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2719194*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2719194*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0122.983] CryptDestroyKey (hKey=0x82b340) returned 1
	[0122.983] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.983] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.983] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", lpFilePart=0x0) returned 0x40
	[0122.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0122.995] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.002.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.997] GetFileType (hFile=0x5dc) returned 0x1
	[0122.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0122.997] GetFileType (hFile=0x5dc) returned 0x1
	[0122.997] WriteFile (in: hFile=0x5dc, lpBuffer=0x2717178*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2717178*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0122.998] CloseHandle (hObject=0x5dc) returned 1
	[0122.998] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", lpFilePart=0x0) returned 0x40
	[0122.998] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0122.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0122.999] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.002.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xde371631, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x83a3539b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0122.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0122.999] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.002.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.002.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", lpFilePart=0x0) returned 0x40
	[0123.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0123.000] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.003.etl"), fInfoLevelId=0x0, lpFileInformation=0x271960c | out: lpFileInformation=0x271960c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2a522d7b, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x4e6dab1f, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0123.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", lpFilePart=0x0) returned 0x40
	[0123.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0123.001] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.003.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.001] GetFileType (hFile=0x5dc) returned 0x1
	[0123.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0123.001] GetFileType (hFile=0x5dc) returned 0x1
	[0123.001] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0123.002] ReadFile (in: hFile=0x5dc, lpBuffer=0x27198ac, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27198ac*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.006] CloseHandle (hObject=0x5dc) returned 1
	[0123.006] CryptDestroyKey (hKey=0x82b280) returned 1
	[0123.006] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.007] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271b948, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0123.007] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.007] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.007] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0123.007] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.007] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x271ba00*=0x1, dwFlags=0x0) returned 1
	[0123.007] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x271b9cc, dwFlags=0x0) returned 1
	[0123.007] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271ba10*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x271ba10*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0123.007] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271da2c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271da2c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0123.007] CryptDestroyKey (hKey=0x82b080) returned 1
	[0123.007] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.007] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.007] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", lpFilePart=0x0) returned 0x40
	[0123.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0123.007] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.003.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.009] GetFileType (hFile=0x5dc) returned 0x1
	[0123.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0123.009] GetFileType (hFile=0x5dc) returned 0x1
	[0123.009] WriteFile (in: hFile=0x5dc, lpBuffer=0x271ba10*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x271ba10*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.010] CloseHandle (hObject=0x5dc) returned 1
	[0123.010] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", lpFilePart=0x0) returned 0x40
	[0123.010] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0123.010] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.003.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2a522d7b, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x83a5b569, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0123.011] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.003.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.003.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.011] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", lpFilePart=0x0) returned 0x40
	[0123.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0123.011] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.004.etl"), fInfoLevelId=0x0, lpFileInformation=0x271dea4 | out: lpFileInformation=0x271dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2cbb43aa, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x5454d5b0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1
	[0123.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0123.012] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", lpFilePart=0x0) returned 0x40
	[0123.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0123.012] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.004.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.013] GetFileType (hFile=0x5dc) returned 0x1
	[0123.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0123.013] GetFileType (hFile=0x5dc) returned 0x1
	[0123.013] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3000
	[0123.013] ReadFile (in: hFile=0x5dc, lpBuffer=0x271e144, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271e144*, lpNumberOfBytesRead=0x540efcc*=0x3000, lpOverlapped=0x0) returned 1
	[0123.017] CloseHandle (hObject=0x5dc) returned 1
	[0123.017] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0123.017] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.017] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27211e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0123.017] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.017] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.017] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0123.017] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.017] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2721298*=0x1, dwFlags=0x0) returned 1
	[0123.018] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2721264, dwFlags=0x0) returned 1
	[0123.018] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27212a8*, pdwDataLen=0x540efd4*=0x3010, dwBufLen=0x3010 | out: pbData=0x27212a8*, pdwDataLen=0x540efd4*=0x3010) returned 1
	[0123.018] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27242c4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27242c4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0123.018] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0123.018] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.018] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.018] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", lpFilePart=0x0) returned 0x40
	[0123.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0123.018] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.004.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.019] GetFileType (hFile=0x5dc) returned 0x1
	[0123.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0123.019] GetFileType (hFile=0x5dc) returned 0x1
	[0123.019] WriteFile (in: hFile=0x5dc, lpBuffer=0x27212a8*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27212a8*, lpNumberOfBytesWritten=0x540efc0*=0x3010, lpOverlapped=0x0) returned 1
	[0123.021] CloseHandle (hObject=0x5dc) returned 1
	[0123.021] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", lpFilePart=0x0) returned 0x40
	[0123.021] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0123.021] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.004.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2cbb43aa, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x83a85b47, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1
	[0123.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0123.021] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.004.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.004.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.022] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", lpFilePart=0x0) returned 0x40
	[0123.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0123.022] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.005.etl"), fInfoLevelId=0x0, lpFileInformation=0x272473c | out: lpFileInformation=0x272473c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x60de6047, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x60de6047, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0123.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0123.431] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.500] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.649] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.652] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.654] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.718] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.763] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.775] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.778] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.779] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.796] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.820] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.826] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.832] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.836] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.839] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.850] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.853] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.854] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.912] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.916] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.940] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.950] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.957] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.965] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.973] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.975] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.988] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.989] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.353] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.493] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.517] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.607] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.611] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.627] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.645] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.654] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.662] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.666] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.687] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.698] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.699] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.699] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.700] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.700] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.796] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.859] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.359] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.405] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.586] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.750] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.865] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.924] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.925] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.318] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.470] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.518] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.627] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.728] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.774] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.827] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.090] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.297] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.393] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.415] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.430] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.481] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.515] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.615] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.639] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.796] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.870] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.920] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.950] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.953] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0128.007] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0128.069] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0128.096] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0128.156] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0128.323] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x85
	[0128.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.323] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.323] GetFileType (hFile=0x5dc) returned 0x1
	[0128.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0128.323] GetFileType (hFile=0x5dc) returned 0x1
	[0128.323] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xafddc
	[0128.325] ReadFile (in: hFile=0x5dc, lpBuffer=0x7cc4a40, nNumberOfBytesToRead=0xafddc, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x7cc4a40*, lpNumberOfBytesRead=0x540efcc*=0xafddc, lpOverlapped=0x0) returned 1
	[0128.352] CloseHandle (hObject=0x5dc) returned 1
	[0128.352] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0128.352] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.352] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277a414, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0128.352] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.353] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.353] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0128.353] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.353] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x277a4cc*=0x1, dwFlags=0x0) returned 1
	[0128.353] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x277a498, dwFlags=0x0) returned 1
	[0128.361] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7d74838*, pdwDataLen=0x540efd4*=0xafde0, dwBufLen=0xafde0 | out: pbData=0x7d74838*, pdwDataLen=0x540efd4*=0xafde0) returned 1
	[0128.362] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277a4dc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x277a4dc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0128.362] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0128.362] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.362] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.362] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x85
	[0128.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0128.362] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.370] GetFileType (hFile=0x5dc) returned 0x1
	[0128.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0128.370] GetFileType (hFile=0x5dc) returned 0x1
	[0128.370] WriteFile (in: hFile=0x5dc, lpBuffer=0x7d74838*, nNumberOfBytesToWrite=0xafde0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x7d74838*, lpNumberOfBytesWritten=0x540efc0*=0xafde0, lpOverlapped=0x0) returned 1
	[0128.445] CloseHandle (hObject=0x5dc) returned 1
	[0128.446] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x85
	[0128.446] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb4
	[0128.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0128.446] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e3ac2a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xafde0)) returned 1
	[0128.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0128.446] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.447] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x85
	[0128.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0128.447] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x277ac38 | out: lpFileInformation=0x277ac38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4)) returned 1
	[0128.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0128.448] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x85
	[0128.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.448] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.448] GetFileType (hFile=0x5dc) returned 0x1
	[0128.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0128.448] GetFileType (hFile=0x5dc) returned 0x1
	[0128.448] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x195a4
	[0128.449] ReadFile (in: hFile=0x5dc, lpBuffer=0x7e24638, nNumberOfBytesToRead=0x195a4, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x7e24638*, lpNumberOfBytesRead=0x540efcc*=0x195a4, lpOverlapped=0x0) returned 1
	[0128.475] CloseHandle (hObject=0x5dc) returned 1
	[0128.475] CryptDestroyKey (hKey=0x82b040) returned 1
	[0128.475] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.475] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277b0d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0128.475] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.475] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.475] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0128.475] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.475] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x277b190*=0x1, dwFlags=0x0) returned 1
	[0128.475] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x277b15c, dwFlags=0x0) returned 1
	[0128.477] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7e3dbf8*, pdwDataLen=0x540efd4*=0x195b0, dwBufLen=0x195b0 | out: pbData=0x7e3dbf8*, pdwDataLen=0x540efd4*=0x195b0) returned 1
	[0128.477] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277b1a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x277b1a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0128.477] CryptDestroyKey (hKey=0x82b440) returned 1
	[0128.477] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.477] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.477] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x85
	[0128.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0128.477] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.479] GetFileType (hFile=0x5dc) returned 0x1
	[0128.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0128.479] GetFileType (hFile=0x5dc) returned 0x1
	[0128.480] WriteFile (in: hFile=0x5dc, lpBuffer=0x7e3dbf8*, nNumberOfBytesToWrite=0x195b0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x7e3dbf8*, lpNumberOfBytesWritten=0x540efc0*=0x195b0, lpOverlapped=0x0) returned 1
	[0128.482] CloseHandle (hObject=0x5dc) returned 1
	[0128.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x85
	[0128.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb4
	[0128.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0128.483] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e87092, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x195b0)) returned 1
	[0128.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0128.483] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.484] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75
	[0128.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0128.484] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x277b8fc | out: lpFileInformation=0x277b8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e)) returned 1
	[0128.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0128.488] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75
	[0128.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.488] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.488] GetFileType (hFile=0x5dc) returned 0x1
	[0128.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0128.488] GetFileType (hFile=0x5dc) returned 0x1
	[0128.488] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x689e
	[0128.488] ReadFile (in: hFile=0x5dc, lpBuffer=0x277bc8c, nNumberOfBytesToRead=0x689e, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x277bc8c*, lpNumberOfBytesRead=0x540efcc*=0x689e, lpOverlapped=0x0) returned 1
	[0128.520] CloseHandle (hObject=0x5dc) returned 1
	[0128.520] CryptDestroyKey (hKey=0x82b280) returned 1
	[0128.520] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.520] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27825c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0128.520] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.520] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.520] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0128.520] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.520] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2782680*=0x1, dwFlags=0x0) returned 1
	[0128.520] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x278264c, dwFlags=0x0) returned 1
	[0128.520] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2782690*, pdwDataLen=0x540efd4*=0x68a0, dwBufLen=0x68a0 | out: pbData=0x2782690*, pdwDataLen=0x540efd4*=0x68a0) returned 1
	[0128.520] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2788f3c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2788f3c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0128.520] CryptDestroyKey (hKey=0x82b280) returned 1
	[0128.520] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.520] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75
	[0128.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0128.521] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.522] GetFileType (hFile=0x5dc) returned 0x1
	[0128.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0128.522] GetFileType (hFile=0x5dc) returned 0x1
	[0128.522] WriteFile (in: hFile=0x5dc, lpBuffer=0x2782690*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2782690*, lpNumberOfBytesWritten=0x540efc0*=0x68a0, lpOverlapped=0x0) returned 1
	[0128.524] CloseHandle (hObject=0x5dc) returned 1
	[0128.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75
	[0128.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa4
	[0128.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0128.524] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86ef98ba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x68a0)) returned 1
	[0128.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0128.525] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.526] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0128.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0128.526] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x27895d8 | out: lpFileInformation=0x27895d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446)) returned 1
	[0128.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0128.530] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0128.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.531] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.531] GetFileType (hFile=0x5dc) returned 0x1
	[0128.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0128.531] GetFileType (hFile=0x5dc) returned 0x1
	[0128.531] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x7446
	[0128.531] ReadFile (in: hFile=0x5dc, lpBuffer=0x27899b8, nNumberOfBytesToRead=0x7446, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27899b8*, lpNumberOfBytesRead=0x540efcc*=0x7446, lpOverlapped=0x0) returned 1
	[0128.604] CloseHandle (hObject=0x5dc) returned 1
	[0128.604] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0128.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.604] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2790e9c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0128.605] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.605] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.605] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0128.605] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.605] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2790f54*=0x1, dwFlags=0x0) returned 1
	[0128.605] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2790f20, dwFlags=0x0) returned 1
	[0128.605] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2790f64*, pdwDataLen=0x540efd4*=0x7450, dwBufLen=0x7450 | out: pbData=0x2790f64*, pdwDataLen=0x540efd4*=0x7450) returned 1
	[0128.605] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27983c0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27983c0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0128.605] CryptDestroyKey (hKey=0x82b540) returned 1
	[0128.605] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.605] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0128.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0128.606] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.607] GetFileType (hFile=0x5dc) returned 0x1
	[0128.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0128.607] GetFileType (hFile=0x5dc) returned 0x1
	[0128.607] WriteFile (in: hFile=0x5dc, lpBuffer=0x2790f64*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2790f64*, lpNumberOfBytesWritten=0x540efc0*=0x7450, lpOverlapped=0x0) returned 1
	[0128.609] CloseHandle (hObject=0x5dc) returned 1
	[0128.609] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0128.609] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xae
	[0128.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0128.610] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x86fb8373, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7450)) returned 1
	[0128.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0128.614] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.615] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0128.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0128.615] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2798ad4 | out: lpFileInformation=0x2798ad4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e)) returned 1
	[0128.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0128.615] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0128.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.616] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.616] GetFileType (hFile=0x5dc) returned 0x1
	[0128.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0128.616] GetFileType (hFile=0x5dc) returned 0x1
	[0128.616] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x809e
	[0128.616] ReadFile (in: hFile=0x5dc, lpBuffer=0x2798e4c, nNumberOfBytesToRead=0x809e, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2798e4c*, lpNumberOfBytesRead=0x540efcc*=0x809e, lpOverlapped=0x0) returned 1
	[0128.638] CloseHandle (hObject=0x5dc) returned 1
	[0128.638] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0128.638] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.638] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a0f88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0128.638] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.638] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.639] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0128.639] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.639] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27a1040*=0x1, dwFlags=0x0) returned 1
	[0128.639] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27a100c, dwFlags=0x0) returned 1
	[0128.639] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a1050*, pdwDataLen=0x540efd4*=0x80a0, dwBufLen=0x80a0 | out: pbData=0x27a1050*, pdwDataLen=0x540efd4*=0x80a0) returned 1
	[0128.639] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a90fc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a90fc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0128.639] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0128.639] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.639] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0128.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0128.639] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.645] GetFileType (hFile=0x5dc) returned 0x1
	[0128.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0128.646] GetFileType (hFile=0x5dc) returned 0x1
	[0128.646] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a1050*, nNumberOfBytesToWrite=0x80a0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27a1050*, lpNumberOfBytesWritten=0x540efc0*=0x80a0, lpOverlapped=0x0) returned 1
	[0128.647] CloseHandle (hObject=0x5dc) returned 1
	[0128.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0128.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa1
	[0128.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0128.648] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x8702ab74, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x80a0)) returned 1
	[0128.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0128.648] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.649] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75
	[0128.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0128.650] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x27a9770 | out: lpFileInformation=0x27a9770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae)) returned 1
	[0128.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0128.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75
	[0128.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.650] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.650] GetFileType (hFile=0x5dc) returned 0x1
	[0128.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0128.651] GetFileType (hFile=0x5dc) returned 0x1
	[0128.651] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x63ae
	[0128.651] ReadFile (in: hFile=0x5dc, lpBuffer=0x27a9b00, nNumberOfBytesToRead=0x63ae, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a9b00*, lpNumberOfBytesRead=0x540efcc*=0x63ae, lpOverlapped=0x0) returned 1
	[0128.661] CloseHandle (hObject=0x5dc) returned 1
	[0128.661] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0128.661] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.661] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27aff4c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0128.661] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.661] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.661] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0128.661] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.662] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27b0004*=0x1, dwFlags=0x0) returned 1
	[0128.662] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x27affd0, dwFlags=0x0) returned 1
	[0128.662] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b0014*, pdwDataLen=0x540efd4*=0x63b0, dwBufLen=0x63b0 | out: pbData=0x27b0014*, pdwDataLen=0x540efd4*=0x63b0) returned 1
	[0128.662] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b63d0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b63d0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0128.662] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0128.662] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.662] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.662] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75
	[0128.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0128.662] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.664] GetFileType (hFile=0x5dc) returned 0x1
	[0128.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0128.664] GetFileType (hFile=0x5dc) returned 0x1
	[0128.664] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b0014*, nNumberOfBytesToWrite=0x63b0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27b0014*, lpNumberOfBytesWritten=0x540efc0*=0x63b0, lpOverlapped=0x0) returned 1
	[0128.666] CloseHandle (hObject=0x5dc) returned 1
	[0128.666] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75
	[0128.666] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa4
	[0128.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0128.666] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x870543ac, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x63b0)) returned 1
	[0128.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0128.666] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", lpFilePart=0x0) returned 0x75
	[0128.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0128.668] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), fInfoLevelId=0x0, lpFileInformation=0x27b6a6c | out: lpFileInformation=0x27b6a6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee)) returned 1
	[0128.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0128.668] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", lpFilePart=0x0) returned 0x75
	[0128.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.669] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.669] GetFileType (hFile=0x5dc) returned 0x1
	[0128.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0128.669] GetFileType (hFile=0x5dc) returned 0x1
	[0128.669] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x5fee
	[0128.669] ReadFile (in: hFile=0x5dc, lpBuffer=0x27b6dfc, nNumberOfBytesToRead=0x5fee, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b6dfc*, lpNumberOfBytesRead=0x540efcc*=0x5fee, lpOverlapped=0x0) returned 1
	[0128.770] CloseHandle (hObject=0x5dc) returned 1
	[0128.770] CryptDestroyKey (hKey=0x82b200) returned 1
	[0128.771] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.771] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27bce88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0128.771] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.771] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.771] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0128.771] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.771] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27bcf40*=0x1, dwFlags=0x0) returned 1
	[0128.771] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27bcf0c, dwFlags=0x0) returned 1
	[0128.771] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27bcf50*, pdwDataLen=0x540efd4*=0x5ff0, dwBufLen=0x5ff0 | out: pbData=0x27bcf50*, pdwDataLen=0x540efd4*=0x5ff0) returned 1
	[0128.771] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c2f4c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c2f4c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0128.771] CryptDestroyKey (hKey=0x82b380) returned 1
	[0128.772] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.772] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.772] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", lpFilePart=0x0) returned 0x75
	[0128.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0128.772] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.773] GetFileType (hFile=0x5dc) returned 0x1
	[0128.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0128.773] GetFileType (hFile=0x5dc) returned 0x1
	[0128.774] WriteFile (in: hFile=0x5dc, lpBuffer=0x27bcf50*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27bcf50*, lpNumberOfBytesWritten=0x540efc0*=0x5ff0, lpOverlapped=0x0) returned 1
	[0128.775] CloseHandle (hObject=0x5dc) returned 1
	[0128.775] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", lpFilePart=0x0) returned 0x75
	[0128.775] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa4
	[0128.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0128.776] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8715be00, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5ff0)) returned 1
	[0128.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0128.776] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.777] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpFilePart=0x0) returned 0x75
	[0128.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0128.777] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), fInfoLevelId=0x0, lpFileInformation=0x27c35e8 | out: lpFileInformation=0x27c35e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee)) returned 1
	[0128.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0128.777] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpFilePart=0x0) returned 0x75
	[0128.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.778] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.778] GetFileType (hFile=0x5dc) returned 0x1
	[0128.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0128.778] GetFileType (hFile=0x5dc) returned 0x1
	[0128.778] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x5fee
	[0128.778] ReadFile (in: hFile=0x5dc, lpBuffer=0x27c3978, nNumberOfBytesToRead=0x5fee, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c3978*, lpNumberOfBytesRead=0x540efcc*=0x5fee, lpOverlapped=0x0) returned 1
	[0128.799] CloseHandle (hObject=0x5dc) returned 1
	[0128.799] CryptDestroyKey (hKey=0x82b340) returned 1
	[0128.799] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.799] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c9a04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0128.799] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.799] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.799] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0128.799] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.800] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27c9abc*=0x1, dwFlags=0x0) returned 1
	[0128.800] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27c9a88, dwFlags=0x0) returned 1
	[0128.800] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c9acc*, pdwDataLen=0x540efd4*=0x5ff0, dwBufLen=0x5ff0 | out: pbData=0x27c9acc*, pdwDataLen=0x540efd4*=0x5ff0) returned 1
	[0128.800] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cfac8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27cfac8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0128.800] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0128.800] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.800] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.800] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpFilePart=0x0) returned 0x75
	[0128.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0128.800] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.802] GetFileType (hFile=0x5dc) returned 0x1
	[0128.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0128.802] GetFileType (hFile=0x5dc) returned 0x1
	[0128.802] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c9acc*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27c9acc*, lpNumberOfBytesWritten=0x540efc0*=0x5ff0, lpOverlapped=0x0) returned 1
	[0128.804] CloseHandle (hObject=0x5dc) returned 1
	[0128.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpFilePart=0x0) returned 0x75
	[0128.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa4
	[0128.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0128.804] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x871a82a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5ff0)) returned 1
	[0128.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0128.804] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.807] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0128.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0128.807] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x27d0164 | out: lpFileInformation=0x27d0164*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa)) returned 1
	[0128.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0128.807] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0128.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.808] ReadFile (in: hFile=0x5dc, lpBuffer=0x27d0cd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27d0cd4*, lpNumberOfBytesRead=0x540efcc*=0x7fa, lpOverlapped=0x0) returned 1
	[0128.816] CryptDestroyKey (hKey=0x82b280) returned 1
	[0128.816] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.816] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d1d70, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0128.816] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.816] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.816] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0128.816] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.816] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x27d1e28*=0x1, dwFlags=0x0) returned 1
	[0128.816] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x27d1df4, dwFlags=0x0) returned 1
	[0128.816] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d1e38*, pdwDataLen=0x540efd4*=0x800, dwBufLen=0x800 | out: pbData=0x27d1e38*, pdwDataLen=0x540efd4*=0x800) returned 1
	[0128.817] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d2644*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27d2644*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0128.817] CryptDestroyKey (hKey=0x82b040) returned 1
	[0128.817] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.817] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.817] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0128.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0128.817] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.819] GetFileType (hFile=0x5dc) returned 0x1
	[0128.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0128.819] GetFileType (hFile=0x5dc) returned 0x1
	[0128.819] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d2804*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27d2804*, lpNumberOfBytesWritten=0x540ef94*=0x800, lpOverlapped=0x0) returned 1
	[0128.820] CloseHandle (hObject=0x5dc) returned 1
	[0128.820] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0128.820] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9f
	[0128.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0128.821] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x871ce4f2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x800)) returned 1
	[0128.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0128.821] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.822] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83
	[0128.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0128.822] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x27d3cac | out: lpFileInformation=0x27d3cac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a)) returned 1
	[0128.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0128.823] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83
	[0128.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.823] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.823] GetFileType (hFile=0x5dc) returned 0x1
	[0128.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0128.823] GetFileType (hFile=0x5dc) returned 0x1
	[0128.823] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12e4a
	[0128.823] ReadFile (in: hFile=0x5dc, lpBuffer=0x27d40ac, nNumberOfBytesToRead=0x12e4a, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27d40ac*, lpNumberOfBytesRead=0x540efcc*=0x12e4a, lpOverlapped=0x0) returned 1
	[0128.839] CloseHandle (hObject=0x5dc) returned 1
	[0128.840] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0128.840] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.840] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e6f94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0128.840] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.840] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.840] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0128.840] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.840] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27e704c*=0x1, dwFlags=0x0) returned 1
	[0128.840] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27e7018, dwFlags=0x0) returned 1
	[0128.840] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e705c*, pdwDataLen=0x540efd4*=0x12e50, dwBufLen=0x12e50 | out: pbData=0x27e705c*, pdwDataLen=0x540efd4*=0x12e50) returned 1
	[0128.840] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f9eb8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f9eb8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0128.841] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0128.841] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.841] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.841] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83
	[0128.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0128.841] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.843] GetFileType (hFile=0x5dc) returned 0x1
	[0128.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0128.843] GetFileType (hFile=0x5dc) returned 0x1
	[0128.843] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e705c*, nNumberOfBytesToWrite=0x12e50, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27e705c*, lpNumberOfBytesWritten=0x540efc0*=0x12e50, lpOverlapped=0x0) returned 1
	[0128.872] CloseHandle (hObject=0x5dc) returned 1
	[0128.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83
	[0128.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb2
	[0128.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0128.873] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87240e1f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x12e50)) returned 1
	[0128.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0128.873] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.880] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0128.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0128.880] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x27fa5fc | out: lpFileInformation=0x27fa5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734)) returned 1
	[0128.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0128.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0128.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.881] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.881] GetFileType (hFile=0x5dc) returned 0x1
	[0128.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0128.881] GetFileType (hFile=0x5dc) returned 0x1
	[0128.881] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3734
	[0128.881] ReadFile (in: hFile=0x5dc, lpBuffer=0x27fa984, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27fa984*, lpNumberOfBytesRead=0x540efcc*=0x3734, lpOverlapped=0x0) returned 1
	[0128.883] CloseHandle (hObject=0x5dc) returned 1
	[0128.883] CryptDestroyKey (hKey=0x82b280) returned 1
	[0128.883] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.883] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fe154, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0128.883] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.883] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.884] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0128.884] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.884] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27fe20c*=0x1, dwFlags=0x0) returned 1
	[0128.884] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27fe1d8, dwFlags=0x0) returned 1
	[0128.884] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27fe21c*, pdwDataLen=0x540efd4*=0x3740, dwBufLen=0x3740 | out: pbData=0x27fe21c*, pdwDataLen=0x540efd4*=0x3740) returned 1
	[0128.884] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2801968*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2801968*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0128.884] CryptDestroyKey (hKey=0x82b280) returned 1
	[0128.884] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.884] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.884] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0128.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0128.884] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.885] GetFileType (hFile=0x5dc) returned 0x1
	[0128.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0128.886] GetFileType (hFile=0x5dc) returned 0x1
	[0128.886] WriteFile (in: hFile=0x5dc, lpBuffer=0x27fe21c*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27fe21c*, lpNumberOfBytesWritten=0x540efc0*=0x3740, lpOverlapped=0x0) returned 1
	[0128.887] CloseHandle (hObject=0x5dc) returned 1
	[0128.887] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0128.887] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa3
	[0128.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0128.887] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8726c004, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3740)) returned 1
	[0128.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0128.888] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.889] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0128.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0128.889] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2801ff4 | out: lpFileInformation=0x2801ff4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee)) returned 1
	[0128.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0128.890] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0128.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.890] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.890] GetFileType (hFile=0x5dc) returned 0x1
	[0128.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0128.890] GetFileType (hFile=0x5dc) returned 0x1
	[0128.890] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb27ee
	[0128.892] ReadFile (in: hFile=0x5dc, lpBuffer=0x7ea1018, nNumberOfBytesToRead=0xb27ee, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x7ea1018*, lpNumberOfBytesRead=0x540efcc*=0xb27ee, lpOverlapped=0x0) returned 1
	[0128.934] CloseHandle (hObject=0x5dc) returned 1
	[0128.934] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0128.934] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.935] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2802454, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0128.935] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.935] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.935] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0128.935] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.935] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x280250c*=0x1, dwFlags=0x0) returned 1
	[0128.935] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x28024d8, dwFlags=0x0) returned 1
	[0128.944] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7f53828*, pdwDataLen=0x540efd4*=0xb27f0, dwBufLen=0xb27f0 | out: pbData=0x7f53828*, pdwDataLen=0x540efd4*=0xb27f0) returned 1
	[0128.945] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x280251c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x280251c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0128.945] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0128.945] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.945] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.945] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0128.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0128.945] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.952] GetFileType (hFile=0x5dc) returned 0x1
	[0128.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0128.952] GetFileType (hFile=0x5dc) returned 0x1
	[0128.952] WriteFile (in: hFile=0x5dc, lpBuffer=0x7f53828*, nNumberOfBytesToWrite=0xb27f0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x7f53828*, lpNumberOfBytesWritten=0x540efc0*=0xb27f0, lpOverlapped=0x0) returned 1
	[0128.967] CloseHandle (hObject=0x5dc) returned 1
	[0128.967] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0128.967] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xac
	[0128.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0128.968] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87325a82, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xb27f0)) returned 1
	[0128.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0128.968] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.969] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0128.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0128.969] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2802c18 | out: lpFileInformation=0x2802c18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe)) returned 1
	[0128.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0128.971] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0128.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0128.971] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.972] GetFileType (hFile=0x5dc) returned 0x1
	[0128.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0128.972] GetFileType (hFile=0x5dc) returned 0x1
	[0128.972] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2aafe
	[0128.972] ReadFile (in: hFile=0x5dc, lpBuffer=0x7e571c8, nNumberOfBytesToRead=0x2aafe, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x7e571c8*, lpNumberOfBytesRead=0x540efcc*=0x2aafe, lpOverlapped=0x0) returned 1
	[0129.008] CloseHandle (hObject=0x5dc) returned 1
	[0129.009] CryptDestroyKey (hKey=0x82b080) returned 1
	[0129.009] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.009] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2803068, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0129.009] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.009] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.009] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0129.009] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.009] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2803120*=0x1, dwFlags=0x0) returned 1
	[0129.009] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x28030ec, dwFlags=0x0) returned 1
	[0129.012] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8006038*, pdwDataLen=0x540efd4*=0x2ab00, dwBufLen=0x2ab00 | out: pbData=0x8006038*, pdwDataLen=0x540efd4*=0x2ab00) returned 1
	[0129.012] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2803130*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2803130*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.012] CryptDestroyKey (hKey=0x82b200) returned 1
	[0129.012] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.012] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.012] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0129.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.012] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.015] GetFileType (hFile=0x5dc) returned 0x1
	[0129.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.015] GetFileType (hFile=0x5dc) returned 0x1
	[0129.015] WriteFile (in: hFile=0x5dc, lpBuffer=0x8006038*, nNumberOfBytesToWrite=0x2ab00, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x8006038*, lpNumberOfBytesWritten=0x540efc0*=0x2ab00, lpOverlapped=0x0) returned 1
	[0129.019] CloseHandle (hObject=0x5dc) returned 1
	[0129.020] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0129.020] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xaa
	[0129.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.020] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x873be39e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2ab00)) returned 1
	[0129.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.020] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.021] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0129.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.021] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2803814 | out: lpFileInformation=0x2803814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4)) returned 1
	[0129.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.022] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0129.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.022] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.022] GetFileType (hFile=0x5dc) returned 0x1
	[0129.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.023] GetFileType (hFile=0x5dc) returned 0x1
	[0129.023] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xf0cb4
	[0129.025] ReadFile (in: hFile=0x5dc, lpBuffer=0x8030b58, nNumberOfBytesToRead=0xf0cb4, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x8030b58*, lpNumberOfBytesRead=0x540efcc*=0xf0cb4, lpOverlapped=0x0) returned 1
	[0129.052] CloseHandle (hObject=0x5dc) returned 1
	[0129.052] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0129.052] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.052] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2803c0c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0129.052] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.052] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.052] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0129.052] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.052] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2803cc4*=0x1, dwFlags=0x0) returned 1
	[0129.052] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2803c90, dwFlags=0x0) returned 1
	[0129.063] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8121828*, pdwDataLen=0x540efd4*=0xf0cc0, dwBufLen=0xf0cc0 | out: pbData=0x8121828*, pdwDataLen=0x540efd4*=0xf0cc0) returned 1
	[0129.065] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2803cd4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2803cd4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.065] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0129.065] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.066] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0129.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.066] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.075] GetFileType (hFile=0x5dc) returned 0x1
	[0129.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.075] GetFileType (hFile=0x5dc) returned 0x1
	[0129.075] WriteFile (in: hFile=0x5dc, lpBuffer=0x8121828*, nNumberOfBytesToWrite=0xf0cc0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x8121828*, lpNumberOfBytesWritten=0x540efc0*=0xf0cc0, lpOverlapped=0x0) returned 1
	[0129.093] CloseHandle (hObject=0x5dc) returned 1
	[0129.093] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0129.093] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9f
	[0129.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.093] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x8745bb9d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xf0cc0)) returned 1
	[0129.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.093] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.094] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x79
	[0129.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.095] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2804330 | out: lpFileInformation=0x2804330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e)) returned 1
	[0129.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x79
	[0129.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.095] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.095] GetFileType (hFile=0x5dc) returned 0x1
	[0129.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.096] GetFileType (hFile=0x5dc) returned 0x1
	[0129.096] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1536e
	[0129.096] ReadFile (in: hFile=0x5dc, lpBuffer=0x7e81ce8, nNumberOfBytesToRead=0x1536e, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x7e81ce8*, lpNumberOfBytesRead=0x540efcc*=0x1536e, lpOverlapped=0x0) returned 1
	[0129.124] CloseHandle (hObject=0x5dc) returned 1
	[0129.125] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0129.125] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.125] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2804770, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0129.125] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.125] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.125] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0129.125] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.125] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2804828*=0x1, dwFlags=0x0) returned 1
	[0129.125] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x28047f4, dwFlags=0x0) returned 1
	[0129.127] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8212508*, pdwDataLen=0x540efd4*=0x15370, dwBufLen=0x15370 | out: pbData=0x8212508*, pdwDataLen=0x540efd4*=0x15370) returned 1
	[0129.127] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2804838*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2804838*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.127] CryptDestroyKey (hKey=0x82b200) returned 1
	[0129.127] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.127] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x79
	[0129.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.127] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.129] GetFileType (hFile=0x5dc) returned 0x1
	[0129.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.129] GetFileType (hFile=0x5dc) returned 0x1
	[0129.129] WriteFile (in: hFile=0x5dc, lpBuffer=0x8212508*, nNumberOfBytesToWrite=0x15370, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x8212508*, lpNumberOfBytesWritten=0x540efc0*=0x15370, lpOverlapped=0x0) returned 1
	[0129.131] CloseHandle (hObject=0x5dc) returned 1
	[0129.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x79
	[0129.132] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa8
	[0129.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.132] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x874c95ad, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x15370)) returned 1
	[0129.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.132] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.133] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6f
	[0129.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.133] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2804f04 | out: lpFileInformation=0x2804f04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe)) returned 1
	[0129.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.134] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6f
	[0129.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.134] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.134] GetFileType (hFile=0x5dc) returned 0x1
	[0129.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.134] GetFileType (hFile=0x5dc) returned 0x1
	[0129.134] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x130fe
	[0129.135] ReadFile (in: hFile=0x5dc, lpBuffer=0x2805264, nNumberOfBytesToRead=0x130fe, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2805264*, lpNumberOfBytesRead=0x540efcc*=0x130fe, lpOverlapped=0x0) returned 1
	[0129.152] CloseHandle (hObject=0x5dc) returned 1
	[0129.152] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0129.152] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.152] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2818400, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0129.152] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.152] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.152] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0129.152] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.152] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x28184b8*=0x1, dwFlags=0x0) returned 1
	[0129.152] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2818484, dwFlags=0x0) returned 1
	[0129.152] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28184c8*, pdwDataLen=0x540efd4*=0x13100, dwBufLen=0x13100 | out: pbData=0x28184c8*, pdwDataLen=0x540efd4*=0x13100) returned 1
	[0129.153] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x282b5d4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x282b5d4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.153] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0129.153] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.153] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.153] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6f
	[0129.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.153] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.155] GetFileType (hFile=0x5dc) returned 0x1
	[0129.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.155] GetFileType (hFile=0x5dc) returned 0x1
	[0129.155] WriteFile (in: hFile=0x5dc, lpBuffer=0x28184c8*, nNumberOfBytesToWrite=0x13100, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x28184c8*, lpNumberOfBytesWritten=0x540efc0*=0x13100, lpOverlapped=0x0) returned 1
	[0129.160] CloseHandle (hObject=0x5dc) returned 1
	[0129.160] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6f
	[0129.160] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9e
	[0129.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.160] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8751582c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13100)) returned 1
	[0129.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.161] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.161] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe", lpFilePart=0x0) returned 0x59
	[0129.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.162] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe"), fInfoLevelId=0x0, lpFileInformation=0x282bc28 | out: lpFileInformation=0x282bc28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470)) returned 1
	[0129.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.162] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe", lpFilePart=0x0) returned 0x59
	[0129.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.162] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.162] GetFileType (hFile=0x5dc) returned 0x1
	[0129.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.162] GetFileType (hFile=0x5dc) returned 0x1
	[0129.162] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x12c470
	[0129.165] ReadFile (in: hFile=0x5dc, lpBuffer=0x8227898, nNumberOfBytesToRead=0x12c470, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x8227898*, lpNumberOfBytesRead=0x540efcc*=0x12c470, lpOverlapped=0x0) returned 1
	[0129.279] CloseHandle (hObject=0x5dc) returned 1
	[0129.280] CryptDestroyKey (hKey=0x82b280) returned 1
	[0129.280] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.280] CryptImportKey (in: hProv=0x7f93c0, pbData=0x282bf68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0129.280] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.280] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.280] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0129.280] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.280] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x282c020*=0x1, dwFlags=0x0) returned 1
	[0129.280] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x282bfec, dwFlags=0x0) returned 1
	[0129.308] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8353d28*, pdwDataLen=0x540efd4*=0x12c480, dwBufLen=0x12c480 | out: pbData=0x8353d28*, pdwDataLen=0x540efd4*=0x12c480) returned 1
	[0129.309] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x282c030*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x282c030*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.309] CryptDestroyKey (hKey=0x82b100) returned 1
	[0129.310] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.310] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe", lpFilePart=0x0) returned 0x59
	[0129.312] WriteFile (in: hFile=0x5dc, lpBuffer=0x8353d28*, nNumberOfBytesToWrite=0x12c480, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x8353d28*, lpNumberOfBytesWritten=0x540efc0*=0x12c480, lpOverlapped=0x0) returned 1
	[0129.344] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.346] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpFilePart=0x0) returned 0x80
	[0129.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.347] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.347] GetFileType (hFile=0x5dc) returned 0x1
	[0129.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.347] GetFileType (hFile=0x5dc) returned 0x1
	[0129.347] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xce8
	[0129.347] ReadFile (in: hFile=0x5dc, lpBuffer=0x282d658, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x282d658*, lpNumberOfBytesRead=0x540efcc*=0xce8, lpOverlapped=0x0) returned 1
	[0129.349] CloseHandle (hObject=0x5dc) returned 1
	[0129.349] CryptDestroyKey (hKey=0x82b200) returned 1
	[0129.349] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.349] CryptImportKey (in: hProv=0x7f93c0, pbData=0x282e6f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0129.349] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.349] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.349] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0129.349] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.349] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x282e7ac*=0x1, dwFlags=0x0) returned 1
	[0129.349] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x282e778, dwFlags=0x0) returned 1
	[0129.349] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x282e7bc*, pdwDataLen=0x540efd4*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x282e7bc*, pdwDataLen=0x540efd4*=0xcf0) returned 1
	[0129.349] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x282f4b8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x282f4b8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.349] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0129.349] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.349] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.349] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpFilePart=0x0) returned 0x80
	[0129.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.350] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.351] GetFileType (hFile=0x5dc) returned 0x1
	[0129.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.351] GetFileType (hFile=0x5dc) returned 0x1
	[0129.351] WriteFile (in: hFile=0x5dc, lpBuffer=0x282f6b8*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x282f6b8*, lpNumberOfBytesWritten=0x540ef94*=0xcf0, lpOverlapped=0x0) returned 1
	[0129.352] CloseHandle (hObject=0x5dc) returned 1
	[0129.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpFilePart=0x0) returned 0x80
	[0129.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xaf
	[0129.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.352] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x876df6e7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xcf0)) returned 1
	[0129.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.353] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.354] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFilePart=0x0) returned 0x7d
	[0129.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.354] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), fInfoLevelId=0x0, lpFileInformation=0x2830be0 | out: lpFileInformation=0x2830be0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf40d9aa3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xca6)) returned 1
	[0129.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.354] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFilePart=0x0) returned 0x7d
	[0129.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.354] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.354] GetFileType (hFile=0x5dc) returned 0x1
	[0129.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.354] GetFileType (hFile=0x5dc) returned 0x1
	[0129.354] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xca6
	[0129.355] ReadFile (in: hFile=0x5dc, lpBuffer=0x2831c64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2831c64*, lpNumberOfBytesRead=0x540efcc*=0xca6, lpOverlapped=0x0) returned 1
	[0129.396] CloseHandle (hObject=0x5dc) returned 1
	[0129.396] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0129.396] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.397] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2832d00, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0129.397] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.397] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.397] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0129.397] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.397] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x2832db8*=0x1, dwFlags=0x0) returned 1
	[0129.397] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x2832d84, dwFlags=0x0) returned 1
	[0129.397] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2832dc8*, pdwDataLen=0x540efd4*=0xcb0, dwBufLen=0xcb0 | out: pbData=0x2832dc8*, pdwDataLen=0x540efd4*=0xcb0) returned 1
	[0129.397] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2833a84*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2833a84*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.397] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0129.397] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.397] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.397] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFilePart=0x0) returned 0x7d
	[0129.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.398] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.399] GetFileType (hFile=0x5dc) returned 0x1
	[0129.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.399] GetFileType (hFile=0x5dc) returned 0x1
	[0129.399] WriteFile (in: hFile=0x5dc, lpBuffer=0x2833c78*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2833c78*, lpNumberOfBytesWritten=0x540ef94*=0xcb0, lpOverlapped=0x0) returned 1
	[0129.400] CloseHandle (hObject=0x5dc) returned 1
	[0129.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFilePart=0x0) returned 0x7d
	[0129.401] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xac
	[0129.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.401] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x87751cfb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xcb0)) returned 1
	[0129.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.401] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.402] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", lpFilePart=0x0) returned 0x5e
	[0129.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.402] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), fInfoLevelId=0x0, lpFileInformation=0x283518c | out: lpFileInformation=0x283518c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b826)) returned 1
	[0129.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.403] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", lpFilePart=0x0) returned 0x5e
	[0129.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.403] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.403] GetFileType (hFile=0x5dc) returned 0x1
	[0129.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.403] GetFileType (hFile=0x5dc) returned 0x1
	[0129.403] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1b826
	[0129.404] ReadFile (in: hFile=0x5dc, lpBuffer=0x84801c8, nNumberOfBytesToRead=0x1b826, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x84801c8*, lpNumberOfBytesRead=0x540efcc*=0x1b826, lpOverlapped=0x0) returned 1
	[0129.427] CloseHandle (hObject=0x5dc) returned 1
	[0129.427] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0129.427] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.427] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28354f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0129.427] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.428] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.428] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0129.428] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.428] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x28355ac*=0x1, dwFlags=0x0) returned 1
	[0129.428] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2835578, dwFlags=0x0) returned 1
	[0129.429] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x849ba10*, pdwDataLen=0x540efd4*=0x1b830, dwBufLen=0x1b830 | out: pbData=0x849ba10*, pdwDataLen=0x540efd4*=0x1b830) returned 1
	[0129.430] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28355bc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x28355bc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.430] CryptDestroyKey (hKey=0x82b100) returned 1
	[0129.430] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.430] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.430] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", lpFilePart=0x0) returned 0x5e
	[0129.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.430] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.432] GetFileType (hFile=0x5dc) returned 0x1
	[0129.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.432] GetFileType (hFile=0x5dc) returned 0x1
	[0129.432] WriteFile (in: hFile=0x5dc, lpBuffer=0x849ba10*, nNumberOfBytesToWrite=0x1b830, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x849ba10*, lpNumberOfBytesWritten=0x540efc0*=0x1b830, lpOverlapped=0x0) returned 1
	[0129.435] CloseHandle (hObject=0x5dc) returned 1
	[0129.435] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", lpFilePart=0x0) returned 0x5e
	[0129.435] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8d
	[0129.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.436] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x8779e094, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1b830)) returned 1
	[0129.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.436] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.437] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", lpFilePart=0x0) returned 0x56
	[0129.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.437] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), fInfoLevelId=0x0, lpFileInformation=0x2835b40 | out: lpFileInformation=0x2835b40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd)) returned 1
	[0129.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.437] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", lpFilePart=0x0) returned 0x56
	[0129.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.437] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.437] GetFileType (hFile=0x5dc) returned 0x1
	[0129.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.438] GetFileType (hFile=0x5dc) returned 0x1
	[0129.438] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x9bddd
	[0129.444] ReadFile (in: hFile=0x5dc, lpBuffer=0x84b7260, nNumberOfBytesToRead=0x9bddd, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x84b7260*, lpNumberOfBytesRead=0x540efcc*=0x9bddd, lpOverlapped=0x0) returned 1
	[0129.480] CloseHandle (hObject=0x5dc) returned 1
	[0129.480] CryptDestroyKey (hKey=0x82b340) returned 1
	[0129.480] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.480] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2835e68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0129.480] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.480] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.480] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0129.480] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.480] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2835f20*=0x1, dwFlags=0x0) returned 1
	[0129.480] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2835eec, dwFlags=0x0) returned 1
	[0129.493] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8553060*, pdwDataLen=0x540efd4*=0x9bde0, dwBufLen=0x9bde0 | out: pbData=0x8553060*, pdwDataLen=0x540efd4*=0x9bde0) returned 1
	[0129.494] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2835f30*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2835f30*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.494] CryptDestroyKey (hKey=0x82b000) returned 1
	[0129.494] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.494] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.494] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", lpFilePart=0x0) returned 0x56
	[0129.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.494] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.500] GetFileType (hFile=0x5dc) returned 0x1
	[0129.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.500] GetFileType (hFile=0x5dc) returned 0x1
	[0129.503] WriteFile (in: hFile=0x5dc, lpBuffer=0x8553060*, nNumberOfBytesToWrite=0x9bde0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x8553060*, lpNumberOfBytesWritten=0x540efc0*=0x9bde0, lpOverlapped=0x0) returned 1
	[0129.514] CloseHandle (hObject=0x5dc) returned 1
	[0129.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", lpFilePart=0x0) returned 0x56
	[0129.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x85
	[0129.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.514] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x8785cc05, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9bde0)) returned 1
	[0129.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.515] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFilePart=0x0) returned 0x70
	[0129.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.516] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), fInfoLevelId=0x0, lpFileInformation=0x2836454 | out: lpFileInformation=0x2836454*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d)) returned 1
	[0129.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.517] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFilePart=0x0) returned 0x70
	[0129.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.535] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.535] GetFileType (hFile=0x5dc) returned 0x1
	[0129.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.535] GetFileType (hFile=0x5dc) returned 0x1
	[0129.535] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x61d
	[0129.535] ReadFile (in: hFile=0x5dc, lpBuffer=0x262d850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x262d850*, lpNumberOfBytesRead=0x540efcc*=0x61d, lpOverlapped=0x0) returned 1
	[0129.537] CloseHandle (hObject=0x5dc) returned 1
	[0129.537] CryptDestroyKey (hKey=0x82b300) returned 1
	[0129.537] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.537] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262e8ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0129.537] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.537] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.537] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0129.537] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.538] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x262e9a4*=0x1, dwFlags=0x0) returned 1
	[0129.538] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x262e970, dwFlags=0x0) returned 1
	[0129.538] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262e9b4*, pdwDataLen=0x540efd4*=0x620, dwBufLen=0x620 | out: pbData=0x262e9b4*, pdwDataLen=0x540efd4*=0x620) returned 1
	[0129.538] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262efe0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x262efe0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.538] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0129.538] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.538] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.538] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFilePart=0x0) returned 0x70
	[0129.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.538] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0129.540] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFilePart=0x0) returned 0x70
	[0129.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.540] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), fInfoLevelId=0x0, lpFileInformation=0x262f79c | out: lpFileInformation=0x262f79c*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d)) returned 1
	[0129.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.541] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFilePart=0x0) returned 0x70
	[0129.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.541] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.541] GetFileType (hFile=0x5dc) returned 0x1
	[0129.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.541] GetFileType (hFile=0x5dc) returned 0x1
	[0129.541] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x61d
	[0129.542] ReadFile (in: hFile=0x5dc, lpBuffer=0x26301b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26301b0*, lpNumberOfBytesRead=0x540efcc*=0x61d, lpOverlapped=0x0) returned 1
	[0129.542] CloseHandle (hObject=0x5dc) returned 1
	[0129.542] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0129.542] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.542] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263124c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0129.542] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.542] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.542] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0129.542] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.543] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2631304*=0x1, dwFlags=0x0) returned 1
	[0129.543] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26312d0, dwFlags=0x0) returned 1
	[0129.543] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2631314*, pdwDataLen=0x540efd4*=0x620, dwBufLen=0x620 | out: pbData=0x2631314*, pdwDataLen=0x540efd4*=0x620) returned 1
	[0129.543] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2631940*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2631940*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.543] CryptDestroyKey (hKey=0x82b300) returned 1
	[0129.543] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.543] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.543] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFilePart=0x0) returned 0x70
	[0129.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.543] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0129.545] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", lpFilePart=0x0) returned 0x55
	[0129.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.545] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox"), fInfoLevelId=0x0, lpFileInformation=0x26320fc | out: lpFileInformation=0x26320fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0)) returned 1
	[0129.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.562] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", lpFilePart=0x0) returned 0x55
	[0129.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.562] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.562] GetFileType (hFile=0x5dc) returned 0x1
	[0129.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.562] GetFileType (hFile=0x5dc) returned 0x1
	[0129.562] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x9d0
	[0129.563] ReadFile (in: hFile=0x5dc, lpBuffer=0x2632db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2632db8*, lpNumberOfBytesRead=0x540efcc*=0x9d0, lpOverlapped=0x0) returned 1
	[0129.574] CloseHandle (hObject=0x5dc) returned 1
	[0129.574] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0129.574] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.574] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2633e54, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0129.574] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.574] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.574] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0129.574] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.574] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2633f0c*=0x1, dwFlags=0x0) returned 1
	[0129.574] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2633ed8, dwFlags=0x0) returned 1
	[0129.575] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2633f1c*, pdwDataLen=0x540efd4*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x2633f1c*, pdwDataLen=0x540efd4*=0x9e0) returned 1
	[0129.575] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2634908*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2634908*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.575] CryptDestroyKey (hKey=0x82b480) returned 1
	[0129.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.575] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", lpFilePart=0x0) returned 0x55
	[0129.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.575] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.577] GetFileType (hFile=0x5dc) returned 0x1
	[0129.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.577] GetFileType (hFile=0x5dc) returned 0x1
	[0129.577] WriteFile (in: hFile=0x5dc, lpBuffer=0x2634a84*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2634a84*, lpNumberOfBytesWritten=0x540ef94*=0x9e0, lpOverlapped=0x0) returned 1
	[0129.578] CloseHandle (hObject=0x5dc) returned 1
	[0129.578] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", lpFilePart=0x0) returned 0x55
	[0129.578] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x84
	[0129.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.578] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x878f5596, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9e0)) returned 1
	[0129.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.579] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox"), lpNewFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.580] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json", lpFilePart=0x0) returned 0x57
	[0129.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.580] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), fInfoLevelId=0x0, lpFileInformation=0x2635e58 | out: lpFileInformation=0x2635e58*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x69d9f6fd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x69d9f6fd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69e5dfd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x623b)) returned 1
	[0129.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.580] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json", lpFilePart=0x0) returned 0x57
	[0129.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.580] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.585] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", lpFilePart=0x0) returned 0x5a
	[0129.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.587] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk"), fInfoLevelId=0x0, lpFileInformation=0x263666c | out: lpFileInformation=0x263666c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44f)) returned 1
	[0129.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", lpFilePart=0x0) returned 0x5a
	[0129.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.588] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.588] GetFileType (hFile=0x5dc) returned 0x1
	[0129.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.588] GetFileType (hFile=0x5dc) returned 0x1
	[0129.588] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x44f
	[0129.589] ReadFile (in: hFile=0x5dc, lpBuffer=0x2636dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2636dd8*, lpNumberOfBytesRead=0x540efcc*=0x44f, lpOverlapped=0x0) returned 1
	[0129.595] CloseHandle (hObject=0x5dc) returned 1
	[0129.596] CryptDestroyKey (hKey=0x82b100) returned 1
	[0129.596] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.596] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2637e74, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0129.596] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.596] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.596] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0129.596] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.596] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2637f2c*=0x1, dwFlags=0x0) returned 1
	[0129.596] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2637ef8, dwFlags=0x0) returned 1
	[0129.596] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2637f3c*, pdwDataLen=0x540efd4*=0x450, dwBufLen=0x450 | out: pbData=0x2637f3c*, pdwDataLen=0x540efd4*=0x450) returned 1
	[0129.596] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2638398*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2638398*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.596] CryptDestroyKey (hKey=0x82b400) returned 1
	[0129.596] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.596] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", lpFilePart=0x0) returned 0x5a
	[0129.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.596] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.598] GetFileType (hFile=0x5dc) returned 0x1
	[0129.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.598] GetFileType (hFile=0x5dc) returned 0x1
	[0129.598] WriteFile (in: hFile=0x5dc, lpBuffer=0x263852c*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x263852c*, lpNumberOfBytesWritten=0x540ef94*=0x450, lpOverlapped=0x0) returned 1
	[0129.599] CloseHandle (hObject=0x5dc) returned 1
	[0129.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", lpFilePart=0x0) returned 0x5a
	[0129.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x89
	[0129.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.600] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x87941a27, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x450)) returned 1
	[0129.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.600] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json", lpFilePart=0x0) returned 0x52
	[0129.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.601] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json"), fInfoLevelId=0x0, lpFileInformation=0x2639924 | out: lpFileInformation=0x2639924*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb0c71bce, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0xb0c71bce, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb0fb9083, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x4c)) returned 1
	[0129.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json", lpFilePart=0x0) returned 0x52
	[0129.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.601] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.603] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpFilePart=0x0) returned 0x96
	[0129.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.603] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json"), fInfoLevelId=0x0, lpFileInformation=0x263a0fc | out: lpFileInformation=0x263a0fc*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x2d95e660, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x2d95e660, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2e6edc8f, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1
	[0129.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.604] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpFilePart=0x0) returned 0x96
	[0129.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.604] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpFilePart=0x0) returned 0x96
	[0129.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.606] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json"), fInfoLevelId=0x0, lpFileInformation=0x263ae0c | out: lpFileInformation=0x263ae0c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7ea85252, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7ea85252, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f139471, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1
	[0129.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.606] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpFilePart=0x0) returned 0x96
	[0129.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.606] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.608] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpFilePart=0x0) returned 0x96
	[0129.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.608] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json"), fInfoLevelId=0x0, lpFileInformation=0x263bc58 | out: lpFileInformation=0x263bc58*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7f139471, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7f139471, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f4f45ae, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1
	[0129.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.608] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpFilePart=0x0) returned 0x96
	[0129.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.609] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json", lpFilePart=0x0) returned 0x42
	[0129.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.639] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), fInfoLevelId=0x0, lpFileInformation=0x263c7e8 | out: lpFileInformation=0x263c7e8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x698688ac, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x698688ac, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69d06e63, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xba4e)) returned 1
	[0129.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.643] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json", lpFilePart=0x0) returned 0x42
	[0129.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.643] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.645] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", lpFilePart=0x0) returned 0x45
	[0129.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.645] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk"), fInfoLevelId=0x0, lpFileInformation=0x263cee0 | out: lpFileInformation=0x263cee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x67f)) returned 1
	[0129.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", lpFilePart=0x0) returned 0x45
	[0129.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.646] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.646] GetFileType (hFile=0x5dc) returned 0x1
	[0129.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.646] GetFileType (hFile=0x5dc) returned 0x1
	[0129.646] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x67f
	[0129.647] ReadFile (in: hFile=0x5dc, lpBuffer=0x263d7cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x263d7cc*, lpNumberOfBytesRead=0x540efcc*=0x67f, lpOverlapped=0x0) returned 1
	[0129.649] CloseHandle (hObject=0x5dc) returned 1
	[0129.649] CryptDestroyKey (hKey=0x82b540) returned 1
	[0129.649] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.649] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263e868, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0129.649] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.649] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.649] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0129.649] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.649] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x263e920*=0x1, dwFlags=0x0) returned 1
	[0129.649] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x263e8ec, dwFlags=0x0) returned 1
	[0129.649] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263e930*, pdwDataLen=0x540efd4*=0x680, dwBufLen=0x680 | out: pbData=0x263e930*, pdwDataLen=0x540efd4*=0x680) returned 1
	[0129.649] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263efbc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x263efbc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.650] CryptDestroyKey (hKey=0x82b100) returned 1
	[0129.650] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.650] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", lpFilePart=0x0) returned 0x45
	[0129.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.650] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.652] GetFileType (hFile=0x5dc) returned 0x1
	[0129.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.652] GetFileType (hFile=0x5dc) returned 0x1
	[0129.652] WriteFile (in: hFile=0x5dc, lpBuffer=0x263f0f8*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x263f0f8*, lpNumberOfBytesWritten=0x540ef94*=0x680, lpOverlapped=0x0) returned 1
	[0129.653] CloseHandle (hObject=0x5dc) returned 1
	[0129.653] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", lpFilePart=0x0) returned 0x45
	[0129.653] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x74
	[0129.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.654] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x879b447a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x680)) returned 1
	[0129.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.654] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.655] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json", lpFilePart=0x0) returned 0x43
	[0129.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.655] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json"), fInfoLevelId=0x0, lpFileInformation=0x264044c | out: lpFileInformation=0x264044c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9)) returned 1
	[0129.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.656] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json", lpFilePart=0x0) returned 0x43
	[0129.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.656] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.658] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.658] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x2640b48 | out: lpFileInformation=0x2640b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bfa790, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4de62c84, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c2)) returned 1
	[0129.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.658] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.658] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.660] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.660] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x26413c4 | out: lpFileInformation=0x26413c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c20a14, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4defb5dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x441b)) returned 1
	[0129.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.662] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.662] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.664] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.664] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x2641c78 | out: lpFileInformation=0x2641c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4df6de00, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8128f6c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4180)) returned 1
	[0129.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.664] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.664] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.666] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.666] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x26424f4 | out: lpFileInformation=0x26424f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e006640, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb5c02e23, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187)) returned 1
	[0129.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.666] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.666] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.668] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.668] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x2642da8 | out: lpFileInformation=0x2642da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e09efaa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8625bd94, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4360)) returned 1
	[0129.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.669] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.670] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.671] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.671] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x2643624 | out: lpFileInformation=0x2643624*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e0c51fa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x86556ca1, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4473)) returned 1
	[0129.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.672] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.676] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x2643ed8 | out: lpFileInformation=0x2643ed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e15dbbf, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418e)) returned 1
	[0129.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.677] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.677] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.679] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x2644754 | out: lpFileInformation=0x2644754*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e1f64ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbb6d045, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418c)) returned 1
	[0129.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.679] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.681] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.681] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x2645008 | out: lpFileInformation=0x2645008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e24298b, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x433c)) returned 1
	[0129.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.713] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.715] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x2645884 | out: lpFileInformation=0x2645884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e28ee3c, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xba09c6cc, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x443f)) returned 1
	[0129.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.715] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.715] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.717] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.717] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x2646138 | out: lpFileInformation=0x2646138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2b5071, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8d3a091, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x442d)) returned 1
	[0129.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.718] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.718] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.721] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x26469b4 | out: lpFileInformation=0x26469b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2db2dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8c553ea, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187)) returned 1
	[0129.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.721] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.723] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.723] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x2647268 | out: lpFileInformation=0x2647268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e301522, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418b)) returned 1
	[0129.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.724] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.726] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x2647ae4 | out: lpFileInformation=0x2647ae4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e89d5, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e34d9d0, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbaf35d10, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4172)) returned 1
	[0129.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.726] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.728] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.729] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x2648398 | out: lpFileInformation=0x2648398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e399e7e, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8507a310, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c3a)) returned 1
	[0129.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.730] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.732] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.732] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x2648c14 | out: lpFileInformation=0x2648c14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e458a8d, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x85007c03, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x424c)) returned 1
	[0129.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.733] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.733] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.735] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.735] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x26494c8 | out: lpFileInformation=0x26494c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4a4f18, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb806a476, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x43ad)) returned 1
	[0129.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.736] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpFilePart=0x0) returned 0x5c
	[0129.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.736] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.738] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.738] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x2649d44 | out: lpFileInformation=0x2649d44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443)) returned 1
	[0129.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.738] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpFilePart=0x0) returned 0x60
	[0129.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.738] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.740] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll", lpFilePart=0x0) returned 0x3b
	[0129.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.740] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll"), fInfoLevelId=0x0, lpFileInformation=0x264a5f8 | out: lpFileInformation=0x264a5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0)) returned 1
	[0129.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll", lpFilePart=0x0) returned 0x3b
	[0129.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.741] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.741] GetFileType (hFile=0x5dc) returned 0x1
	[0129.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.741] GetFileType (hFile=0x5dc) returned 0x1
	[0129.741] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x62e0
	[0129.741] ReadFile (in: hFile=0x5dc, lpBuffer=0x264a840, nNumberOfBytesToRead=0x62e0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x264a840*, lpNumberOfBytesRead=0x540efcc*=0x62e0, lpOverlapped=0x0) returned 1
	[0129.756] CloseHandle (hObject=0x5dc) returned 1
	[0129.756] CryptDestroyKey (hKey=0x82b540) returned 1
	[0129.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.756] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2650bbc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0129.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.756] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0129.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.756] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2650c74*=0x1, dwFlags=0x0) returned 1
	[0129.756] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2650c40, dwFlags=0x0) returned 1
	[0129.756] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2650c84*, pdwDataLen=0x540efd4*=0x62f0, dwBufLen=0x62f0 | out: pbData=0x2650c84*, pdwDataLen=0x540efd4*=0x62f0) returned 1
	[0129.756] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2656f80*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2656f80*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.756] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0129.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.757] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll", lpFilePart=0x0) returned 0x3b
	[0129.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.757] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.758] GetFileType (hFile=0x5dc) returned 0x1
	[0129.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.758] GetFileType (hFile=0x5dc) returned 0x1
	[0129.758] WriteFile (in: hFile=0x5dc, lpBuffer=0x2650c84*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2650c84*, lpNumberOfBytesWritten=0x540efc0*=0x62f0, lpOverlapped=0x0) returned 1
	[0129.759] CloseHandle (hObject=0x5dc) returned 1
	[0129.759] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll", lpFilePart=0x0) returned 0x3b
	[0129.759] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6a
	[0129.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.760] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x87abf1ba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x62f0)) returned 1
	[0129.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.760] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll"), lpNewFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.760] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll", lpFilePart=0x0) returned 0x42
	[0129.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.760] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll"), fInfoLevelId=0x0, lpFileInformation=0x26573a8 | out: lpFileInformation=0x26573a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97ce8d28, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x60e0)) returned 1
	[0129.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.761] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll", lpFilePart=0x0) returned 0x42
	[0129.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.761] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.761] GetFileType (hFile=0x5dc) returned 0x1
	[0129.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.761] GetFileType (hFile=0x5dc) returned 0x1
	[0129.761] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x60e0
	[0129.761] ReadFile (in: hFile=0x5dc, lpBuffer=0x2657610, nNumberOfBytesToRead=0x60e0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2657610*, lpNumberOfBytesRead=0x540efcc*=0x60e0, lpOverlapped=0x0) returned 1
	[0129.762] CloseHandle (hObject=0x5dc) returned 1
	[0129.762] CryptDestroyKey (hKey=0x82b280) returned 1
	[0129.762] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.762] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265d78c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0129.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.762] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0129.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.762] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x265d844*=0x1, dwFlags=0x0) returned 1
	[0129.762] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x265d810, dwFlags=0x0) returned 1
	[0129.762] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265d854*, pdwDataLen=0x540efd4*=0x60f0, dwBufLen=0x60f0 | out: pbData=0x265d854*, pdwDataLen=0x540efd4*=0x60f0) returned 1
	[0129.762] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2663950*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2663950*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.763] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0129.763] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.763] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.763] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll", lpFilePart=0x0) returned 0x42
	[0129.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.763] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.764] GetFileType (hFile=0x5dc) returned 0x1
	[0129.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.764] GetFileType (hFile=0x5dc) returned 0x1
	[0129.764] WriteFile (in: hFile=0x5dc, lpBuffer=0x265d854*, nNumberOfBytesToWrite=0x60f0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x265d854*, lpNumberOfBytesWritten=0x540efc0*=0x60f0, lpOverlapped=0x0) returned 1
	[0129.765] CloseHandle (hObject=0x5dc) returned 1
	[0129.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll", lpFilePart=0x0) returned 0x42
	[0129.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x71
	[0129.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.766] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x87abf1ba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x60f0)) returned 1
	[0129.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.798] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll"), lpNewFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.799] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk", lpFilePart=0x0) returned 0x33
	[0129.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.799] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk"), fInfoLevelId=0x0, lpFileInformation=0x2663dbc | out: lpFileInformation=0x2663dbc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x571b1401, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0129.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.799] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk", lpFilePart=0x0) returned 0x33
	[0129.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.800] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.800] GetFileType (hFile=0x5dc) returned 0x1
	[0129.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.800] GetFileType (hFile=0x5dc) returned 0x1
	[0129.800] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0129.800] ReadFile (in: hFile=0x5dc, lpBuffer=0x2663fb4, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2663fb4*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0129.801] CloseHandle (hObject=0x5dc) returned 1
	[0129.801] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0129.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.801] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2666050, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0129.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.801] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0129.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.801] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2666108*=0x1, dwFlags=0x0) returned 1
	[0129.801] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26660d4, dwFlags=0x0) returned 1
	[0129.801] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2666118*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x2666118*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0129.801] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2668134*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2668134*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.801] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0129.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk", lpFilePart=0x0) returned 0x33
	[0129.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.801] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.802] GetFileType (hFile=0x5dc) returned 0x1
	[0129.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.803] GetFileType (hFile=0x5dc) returned 0x1
	[0129.803] WriteFile (in: hFile=0x5dc, lpBuffer=0x2666118*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2666118*, lpNumberOfBytesWritten=0x540efc0*=0x2010, lpOverlapped=0x0) returned 1
	[0129.803] CloseHandle (hObject=0x5dc) returned 1
	[0129.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk", lpFilePart=0x0) returned 0x33
	[0129.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x62
	[0129.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.804] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x87b31856, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0129.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.804] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.log", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.log", lpFilePart=0x0) returned 0x33
	[0129.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.805] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.log"), fInfoLevelId=0x0, lpFileInformation=0x26684f4 | out: lpFileInformation=0x26684f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e26fff, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x576f6993, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x140000)) returned 1
	[0129.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.log", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.log", lpFilePart=0x0) returned 0x33
	[0129.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.805] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0129.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0129.806] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs", lpFilePart=0x0) returned 0x3b
	[0129.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.806] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs"), fInfoLevelId=0x0, lpFileInformation=0x2668ba0 | out: lpFileInformation=0x2668ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e4d293, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e4d293, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5e734dc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000)) returned 1
	[0129.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.807] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs", lpFilePart=0x0) returned 0x3b
	[0129.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.807] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.807] GetFileType (hFile=0x5dc) returned 0x1
	[0129.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.807] GetFileType (hFile=0x5dc) returned 0x1
	[0129.807] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x140000
	[0129.809] ReadFile (in: hFile=0x5dc, lpBuffer=0x85eee60, nNumberOfBytesToRead=0x140000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x85eee60*, lpNumberOfBytesRead=0x540efcc*=0x140000, lpOverlapped=0x0) returned 1
	[0129.882] CloseHandle (hObject=0x5dc) returned 1
	[0129.882] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0129.882] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.882] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2668e68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0129.882] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.882] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.882] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0129.882] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.882] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x2668f20*=0x1, dwFlags=0x0) returned 1
	[0129.882] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x2668eec, dwFlags=0x0) returned 1
	[0129.902] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x872ee80*, pdwDataLen=0x540efd4*=0x140010, dwBufLen=0x140010 | out: pbData=0x872ee80*, pdwDataLen=0x540efd4*=0x140010) returned 1
	[0129.903] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2668f30*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2668f30*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0129.903] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0129.903] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.903] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.903] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs", lpFilePart=0x0) returned 0x3b
	[0129.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0129.904] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.906] GetFileType (hFile=0x5dc) returned 0x1
	[0129.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0129.907] GetFileType (hFile=0x5dc) returned 0x1
	[0129.907] WriteFile (in: hFile=0x5dc, lpBuffer=0x872ee80*, nNumberOfBytesToWrite=0x140010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x872ee80*, lpNumberOfBytesWritten=0x540efc0*=0x140010, lpOverlapped=0x0) returned 1
	[0129.930] CloseHandle (hObject=0x5dc) returned 1
	[0129.930] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs", lpFilePart=0x0) returned 0x3b
	[0129.930] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6a
	[0129.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0129.930] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e4d293, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e4d293, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x87c62c0d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x140010)) returned 1
	[0129.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0129.930] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0129.931] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs", lpFilePart=0x0) returned 0x3b
	[0129.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0129.931] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs"), fInfoLevelId=0x0, lpFileInformation=0x2669350 | out: lpFileInformation=0x2669350*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5e734dc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000)) returned 1
	[0129.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0129.932] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs", lpFilePart=0x0) returned 0x3b
	[0129.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0129.932] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0129.932] GetFileType (hFile=0x5dc) returned 0x1
	[0129.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0129.932] GetFileType (hFile=0x5dc) returned 0x1
	[0129.932] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x140000
	[0129.935] ReadFile (in: hFile=0x5dc, lpBuffer=0x886eeb0, nNumberOfBytesToRead=0x140000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x886eeb0*, lpNumberOfBytesRead=0x540efcc*=0x140000, lpOverlapped=0x0) returned 1
	[0129.992] CloseHandle (hObject=0x5dc) returned 1
	[0129.992] CryptDestroyKey (hKey=0x82b200) returned 1
	[0129.992] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0129.992] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2669618, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0129.992] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.993] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.993] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0129.993] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0129.993] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26696d0*=0x1, dwFlags=0x0) returned 1
	[0129.993] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x266969c, dwFlags=0x0) returned 1
	[0130.006] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x89aeed0*, pdwDataLen=0x540efd4*=0x140010, dwBufLen=0x140010 | out: pbData=0x89aeed0*, pdwDataLen=0x540efd4*=0x140010) returned 1
	[0130.007] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26696e0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26696e0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.007] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0130.007] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.007] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.007] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs", lpFilePart=0x0) returned 0x3b
	[0130.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.008] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.011] GetFileType (hFile=0x5dc) returned 0x1
	[0130.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.011] GetFileType (hFile=0x5dc) returned 0x1
	[0130.011] WriteFile (in: hFile=0x5dc, lpBuffer=0x89aeed0*, nNumberOfBytesToWrite=0x140010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x89aeed0*, lpNumberOfBytesWritten=0x540efc0*=0x140010, lpOverlapped=0x0) returned 1
	[0130.037] CloseHandle (hObject=0x5dc) returned 1
	[0130.037] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs", lpFilePart=0x0) returned 0x3b
	[0130.037] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6a
	[0130.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.037] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x87d6dcc5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x140010)) returned 1
	[0130.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.038] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log", lpFilePart=0x0) returned 0x36
	[0130.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.039] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log"), fInfoLevelId=0x0, lpFileInformation=0x2669b00 | out: lpFileInformation=0x2669b00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e4d293, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc63d09b3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000)) returned 1
	[0130.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log", lpFilePart=0x0) returned 0x36
	[0130.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.039] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.040] GetFileType (hFile=0x5dc) returned 0x1
	[0130.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.040] GetFileType (hFile=0x5dc) returned 0x1
	[0130.040] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x140000
	[0130.043] ReadFile (in: hFile=0x5dc, lpBuffer=0x8aeef00, nNumberOfBytesToRead=0x140000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x8aeef00*, lpNumberOfBytesRead=0x540efcc*=0x140000, lpOverlapped=0x0) returned 1
	[0130.096] CloseHandle (hObject=0x5dc) returned 1
	[0130.096] CryptDestroyKey (hKey=0x82b380) returned 1
	[0130.096] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.096] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2669da8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0130.096] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.096] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.096] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0130.096] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.096] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2669e60*=0x1, dwFlags=0x0) returned 1
	[0130.096] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2669e2c, dwFlags=0x0) returned 1
	[0130.114] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8c2ef20*, pdwDataLen=0x540efd4*=0x140010, dwBufLen=0x140010 | out: pbData=0x8c2ef20*, pdwDataLen=0x540efd4*=0x140010) returned 1
	[0130.115] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2669e70*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2669e70*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.115] CryptDestroyKey (hKey=0x82b040) returned 1
	[0130.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.115] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log", lpFilePart=0x0) returned 0x36
	[0130.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.115] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.118] GetFileType (hFile=0x5dc) returned 0x1
	[0130.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.118] GetFileType (hFile=0x5dc) returned 0x1
	[0130.118] WriteFile (in: hFile=0x5dc, lpBuffer=0x8c2ef20*, nNumberOfBytesToWrite=0x140010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x8c2ef20*, lpNumberOfBytesWritten=0x540efc0*=0x140010, lpOverlapped=0x0) returned 1
	[0130.143] CloseHandle (hObject=0x5dc) returned 1
	[0130.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log", lpFilePart=0x0) returned 0x36
	[0130.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0130.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.144] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e4d293, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x87e78cc3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x140010)) returned 1
	[0130.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.144] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db", lpFilePart=0x0) returned 0x33
	[0130.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.145] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db"), fInfoLevelId=0x0, lpFileInformation=0x266a254 | out: lpFileInformation=0x266a254*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc5e99732, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e99732, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4c7b8ba2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x140000)) returned 1
	[0130.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db", lpFilePart=0x0) returned 0x33
	[0130.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.146] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0130.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0130.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.jfm", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.jfm", lpFilePart=0x0) returned 0x34
	[0130.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.148] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.jfm" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.jfm"), fInfoLevelId=0x0, lpFileInformation=0x266a900 | out: lpFileInformation=0x266a900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x576d0867, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
	[0130.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.jfm", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.jfm", lpFilePart=0x0) returned 0x34
	[0130.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.148] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.jfm" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.jfm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0130.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0130.150] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.150] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x266afc4 | out: lpFileInformation=0x266afc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ea7c91, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ea7c91, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ea7c91, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x98c)) returned 1
	[0130.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.151] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.151] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.151] GetFileType (hFile=0x5dc) returned 0x1
	[0130.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.151] GetFileType (hFile=0x5dc) returned 0x1
	[0130.151] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x98c
	[0130.151] ReadFile (in: hFile=0x5dc, lpBuffer=0x266bc34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x266bc34*, lpNumberOfBytesRead=0x540efcc*=0x98c, lpOverlapped=0x0) returned 1
	[0130.159] CloseHandle (hObject=0x5dc) returned 1
	[0130.159] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0130.159] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.159] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266ccd0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0130.159] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.159] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.159] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0130.159] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.159] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x266cd88*=0x1, dwFlags=0x0) returned 1
	[0130.159] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x266cd54, dwFlags=0x0) returned 1
	[0130.160] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266cd98*, pdwDataLen=0x540efd4*=0x990, dwBufLen=0x990 | out: pbData=0x266cd98*, pdwDataLen=0x540efd4*=0x990) returned 1
	[0130.160] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266d734*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x266d734*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.160] CryptDestroyKey (hKey=0x82b400) returned 1
	[0130.160] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.160] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.160] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.160] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.161] GetFileType (hFile=0x5dc) returned 0x1
	[0130.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.161] GetFileType (hFile=0x5dc) returned 0x1
	[0130.161] WriteFile (in: hFile=0x5dc, lpBuffer=0x266d8ac*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x266d8ac*, lpNumberOfBytesWritten=0x540ef94*=0x990, lpOverlapped=0x0) returned 1
	[0130.162] CloseHandle (hObject=0x5dc) returned 1
	[0130.162] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.162] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.162] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ea7c91, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ea7c91, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x87ea103b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x990)) returned 1
	[0130.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.163] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.165] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x266ecd0 | out: lpFileInformation=0x266ecd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.165] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.165] GetFileType (hFile=0x5dc) returned 0x1
	[0130.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.165] GetFileType (hFile=0x5dc) returned 0x1
	[0130.165] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.166] ReadFile (in: hFile=0x5dc, lpBuffer=0x266f0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x266f0cc*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.166] CloseHandle (hObject=0x5dc) returned 1
	[0130.166] CryptDestroyKey (hKey=0x82b540) returned 1
	[0130.166] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.167] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2670168, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0130.167] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.167] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.167] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0130.167] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.167] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2670220*=0x1, dwFlags=0x0) returned 1
	[0130.167] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26701ec, dwFlags=0x0) returned 1
	[0130.167] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2670230*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x2670230*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.167] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267034c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x267034c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.167] CryptDestroyKey (hKey=0x82b280) returned 1
	[0130.167] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.167] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.167] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.168] GetFileType (hFile=0x5dc) returned 0x1
	[0130.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.168] GetFileType (hFile=0x5dc) returned 0x1
	[0130.168] WriteFile (in: hFile=0x5dc, lpBuffer=0x26704c8*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26704c8*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.169] CloseHandle (hObject=0x5dc) returned 1
	[0130.169] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.169] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.169] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x87ea103b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.169] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.170] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26718f0 | out: lpFileInformation=0x26718f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ebc18d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x504)) returned 1
	[0130.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.171] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.171] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.171] GetFileType (hFile=0x5dc) returned 0x1
	[0130.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.171] GetFileType (hFile=0x5dc) returned 0x1
	[0130.171] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x504
	[0130.171] ReadFile (in: hFile=0x5dc, lpBuffer=0x26720d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26720d8*, lpNumberOfBytesRead=0x540efcc*=0x504, lpOverlapped=0x0) returned 1
	[0130.284] CloseHandle (hObject=0x5dc) returned 1
	[0130.285] CryptDestroyKey (hKey=0x82b080) returned 1
	[0130.285] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.285] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2673174, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0130.285] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.285] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.285] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0130.285] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.285] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x267322c*=0x1, dwFlags=0x0) returned 1
	[0130.285] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26731f8, dwFlags=0x0) returned 1
	[0130.285] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267323c*, pdwDataLen=0x540efd4*=0x510, dwBufLen=0x510 | out: pbData=0x267323c*, pdwDataLen=0x540efd4*=0x510) returned 1
	[0130.285] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2673758*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2673758*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.286] CryptDestroyKey (hKey=0x82b540) returned 1
	[0130.286] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.286] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.286] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.286] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.287] GetFileType (hFile=0x5dc) returned 0x1
	[0130.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.287] GetFileType (hFile=0x5dc) returned 0x1
	[0130.288] WriteFile (in: hFile=0x5dc, lpBuffer=0x26738d0*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26738d0*, lpNumberOfBytesWritten=0x540ef94*=0x510, lpOverlapped=0x0) returned 1
	[0130.289] CloseHandle (hObject=0x5dc) returned 1
	[0130.289] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.289] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.289] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x87fd0324, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x510)) returned 1
	[0130.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.289] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.292] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.292] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2674cf4 | out: lpFileInformation=0x2674cf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ebc18d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.293] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.293] GetFileType (hFile=0x5dc) returned 0x1
	[0130.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.293] GetFileType (hFile=0x5dc) returned 0x1
	[0130.293] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.293] ReadFile (in: hFile=0x5dc, lpBuffer=0x26750f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26750f0*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.297] CloseHandle (hObject=0x5dc) returned 1
	[0130.297] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0130.297] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.297] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267618c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0130.297] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.297] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.297] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0130.297] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.297] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2676244*=0x1, dwFlags=0x0) returned 1
	[0130.297] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2676210, dwFlags=0x0) returned 1
	[0130.297] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2676254*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x2676254*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.297] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2676370*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2676370*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.297] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0130.298] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.298] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.298] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.298] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.299] GetFileType (hFile=0x5dc) returned 0x1
	[0130.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.299] GetFileType (hFile=0x5dc) returned 0x1
	[0130.299] WriteFile (in: hFile=0x5dc, lpBuffer=0x26764ec*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26764ec*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.300] CloseHandle (hObject=0x5dc) returned 1
	[0130.301] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.301] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.301] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x87ff63f2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.301] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.302] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.303] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x2677914 | out: lpFileInformation=0x2677914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540f90a7, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540f90a7, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x540f90a7, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcb9)) returned 1
	[0130.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.303] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.303] GetFileType (hFile=0x5dc) returned 0x1
	[0130.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.303] GetFileType (hFile=0x5dc) returned 0x1
	[0130.303] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xcb9
	[0130.304] ReadFile (in: hFile=0x5dc, lpBuffer=0x26788b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26788b4*, lpNumberOfBytesRead=0x540efcc*=0xcb9, lpOverlapped=0x0) returned 1
	[0130.306] CloseHandle (hObject=0x5dc) returned 1
	[0130.306] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0130.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.307] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2679950, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0130.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.307] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0130.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.307] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2679a08*=0x1, dwFlags=0x0) returned 1
	[0130.307] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26799d4, dwFlags=0x0) returned 1
	[0130.307] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2679a18*, pdwDataLen=0x540efd4*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x2679a18*, pdwDataLen=0x540efd4*=0xcc0) returned 1
	[0130.307] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267a6e4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x267a6e4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.307] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0130.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.307] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.307] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.309] GetFileType (hFile=0x5dc) returned 0x1
	[0130.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.309] GetFileType (hFile=0x5dc) returned 0x1
	[0130.309] WriteFile (in: hFile=0x5dc, lpBuffer=0x267a85c*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x267a85c*, lpNumberOfBytesWritten=0x540ef94*=0xcc0, lpOverlapped=0x0) returned 1
	[0130.310] CloseHandle (hObject=0x5dc) returned 1
	[0130.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.311] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540f90a7, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540f90a7, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x87ff63f2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xcc0)) returned 1
	[0130.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.311] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.319] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.319] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x267bc80 | out: lpFileInformation=0x267bc80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.320] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.320] GetFileType (hFile=0x5dc) returned 0x1
	[0130.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.320] GetFileType (hFile=0x5dc) returned 0x1
	[0130.320] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.320] ReadFile (in: hFile=0x5dc, lpBuffer=0x267c07c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x267c07c*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.324] CloseHandle (hObject=0x5dc) returned 1
	[0130.324] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0130.324] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.324] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267d118, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0130.324] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.324] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.324] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0130.324] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.324] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x267d1d0*=0x1, dwFlags=0x0) returned 1
	[0130.324] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x267d19c, dwFlags=0x0) returned 1
	[0130.324] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267d1e0*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x267d1e0*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.324] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267d2fc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x267d2fc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.324] CryptDestroyKey (hKey=0x82b280) returned 1
	[0130.324] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.324] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.324] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.325] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.326] GetFileType (hFile=0x5dc) returned 0x1
	[0130.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.326] GetFileType (hFile=0x5dc) returned 0x1
	[0130.326] WriteFile (in: hFile=0x5dc, lpBuffer=0x267d478*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x267d478*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.327] CloseHandle (hObject=0x5dc) returned 1
	[0130.327] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.327] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.328] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8801c542, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.328] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.345] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.345] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x267e8a0 | out: lpFileInformation=0x267e8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e3557c, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x65f)) returned 1
	[0130.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.346] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.346] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.346] GetFileType (hFile=0x5dc) returned 0x1
	[0130.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.346] GetFileType (hFile=0x5dc) returned 0x1
	[0130.346] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x65f
	[0130.346] ReadFile (in: hFile=0x5dc, lpBuffer=0x267f1e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x267f1e4*, lpNumberOfBytesRead=0x540efcc*=0x65f, lpOverlapped=0x0) returned 1
	[0130.348] CloseHandle (hObject=0x5dc) returned 1
	[0130.348] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0130.348] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.348] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2680280, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0130.348] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.348] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.348] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0130.348] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.349] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2680338*=0x1, dwFlags=0x0) returned 1
	[0130.349] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2680304, dwFlags=0x0) returned 1
	[0130.349] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2680348*, pdwDataLen=0x540efd4*=0x660, dwBufLen=0x660 | out: pbData=0x2680348*, pdwDataLen=0x540efd4*=0x660) returned 1
	[0130.349] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26809b4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26809b4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.349] CryptDestroyKey (hKey=0x82b200) returned 1
	[0130.349] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.349] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.349] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.349] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.350] GetFileType (hFile=0x5dc) returned 0x1
	[0130.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.351] GetFileType (hFile=0x5dc) returned 0x1
	[0130.351] WriteFile (in: hFile=0x5dc, lpBuffer=0x2680b2c*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2680b2c*, lpNumberOfBytesWritten=0x540ef94*=0x660, lpOverlapped=0x0) returned 1
	[0130.352] CloseHandle (hObject=0x5dc) returned 1
	[0130.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.352] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x88068bfb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x660)) returned 1
	[0130.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.352] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.379] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2681f50 | out: lpFileInformation=0x2681f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.379] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.380] GetFileType (hFile=0x5dc) returned 0x1
	[0130.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.380] GetFileType (hFile=0x5dc) returned 0x1
	[0130.380] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.380] ReadFile (in: hFile=0x5dc, lpBuffer=0x268234c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x268234c*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.381] CloseHandle (hObject=0x5dc) returned 1
	[0130.381] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0130.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.381] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26833e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0130.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.382] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0130.382] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.382] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26834a0*=0x1, dwFlags=0x0) returned 1
	[0130.382] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x268346c, dwFlags=0x0) returned 1
	[0130.382] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26834b0*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x26834b0*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.382] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26835cc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26835cc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.382] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0130.382] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.382] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.382] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.382] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.384] GetFileType (hFile=0x5dc) returned 0x1
	[0130.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.384] GetFileType (hFile=0x5dc) returned 0x1
	[0130.384] WriteFile (in: hFile=0x5dc, lpBuffer=0x2683748*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2683748*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.387] CloseHandle (hObject=0x5dc) returned 1
	[0130.387] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.387] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.387] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8808edfe, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.388] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.389] ReadFile (in: hFile=0x5dc, lpBuffer=0x26853f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26853f4*, lpNumberOfBytesRead=0x540efcc*=0x59f, lpOverlapped=0x0) returned 1
	[0130.392] CryptDestroyKey (hKey=0x82b280) returned 1
	[0130.392] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.392] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2686490, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0130.392] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.392] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.392] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0130.392] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.392] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2686548*=0x1, dwFlags=0x0) returned 1
	[0130.392] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2686514, dwFlags=0x0) returned 1
	[0130.392] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2686558*, pdwDataLen=0x540efd4*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x2686558*, pdwDataLen=0x540efd4*=0x5a0) returned 1
	[0130.392] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2686b04*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2686b04*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.392] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0130.393] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.393] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.393] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.393] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.394] GetFileType (hFile=0x5dc) returned 0x1
	[0130.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.394] GetFileType (hFile=0x5dc) returned 0x1
	[0130.394] WriteFile (in: hFile=0x5dc, lpBuffer=0x2686c7c*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2686c7c*, lpNumberOfBytesWritten=0x540ef94*=0x5a0, lpOverlapped=0x0) returned 1
	[0130.395] CloseHandle (hObject=0x5dc) returned 1
	[0130.396] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.396] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.396] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x880dfaae, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5a0)) returned 1
	[0130.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.396] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.410] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.410] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26880a0 | out: lpFileInformation=0x26880a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.410] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.411] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.411] GetFileType (hFile=0x5dc) returned 0x1
	[0130.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.411] GetFileType (hFile=0x5dc) returned 0x1
	[0130.411] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.411] ReadFile (in: hFile=0x5dc, lpBuffer=0x268849c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x268849c*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.412] CloseHandle (hObject=0x5dc) returned 1
	[0130.412] CryptDestroyKey (hKey=0x82b100) returned 1
	[0130.412] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.413] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2689538, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0130.413] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.413] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.413] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0130.413] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.413] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26895f0*=0x1, dwFlags=0x0) returned 1
	[0130.413] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26895bc, dwFlags=0x0) returned 1
	[0130.413] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2689600*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x2689600*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.413] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268971c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x268971c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.413] CryptDestroyKey (hKey=0x82b480) returned 1
	[0130.413] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.413] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.414] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.414] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.415] GetFileType (hFile=0x5dc) returned 0x1
	[0130.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.415] GetFileType (hFile=0x5dc) returned 0x1
	[0130.415] WriteFile (in: hFile=0x5dc, lpBuffer=0x2689898*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2689898*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.416] CloseHandle (hObject=0x5dc) returned 1
	[0130.417] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.417] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.417] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x881013e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.417] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.418] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.418] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x268acc0 | out: lpFileInformation=0x268acc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410e9a1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410e9a1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54134c0b, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1144)) returned 1
	[0130.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.419] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.419] GetFileType (hFile=0x5dc) returned 0x1
	[0130.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.419] GetFileType (hFile=0x5dc) returned 0x1
	[0130.419] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1144
	[0130.419] ReadFile (in: hFile=0x5dc, lpBuffer=0x268af98, nNumberOfBytesToRead=0x1144, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x268af98*, lpNumberOfBytesRead=0x540efcc*=0x1144, lpOverlapped=0x0) returned 1
	[0130.435] CloseHandle (hObject=0x5dc) returned 1
	[0130.435] CryptDestroyKey (hKey=0x82b540) returned 1
	[0130.435] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.435] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268c178, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0130.436] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.436] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.436] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0130.436] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.436] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x268c230*=0x1, dwFlags=0x0) returned 1
	[0130.436] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x268c1fc, dwFlags=0x0) returned 1
	[0130.436] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268c240*, pdwDataLen=0x540efd4*=0x1150, dwBufLen=0x1150 | out: pbData=0x268c240*, pdwDataLen=0x540efd4*=0x1150) returned 1
	[0130.436] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268d39c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x268d39c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.436] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0130.436] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.436] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.436] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.436] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.437] GetFileType (hFile=0x5dc) returned 0x1
	[0130.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.437] GetFileType (hFile=0x5dc) returned 0x1
	[0130.437] WriteFile (in: hFile=0x5dc, lpBuffer=0x268c240*, nNumberOfBytesToWrite=0x1150, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x268c240*, lpNumberOfBytesWritten=0x540efc0*=0x1150, lpOverlapped=0x0) returned 1
	[0130.438] CloseHandle (hObject=0x5dc) returned 1
	[0130.439] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.439] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.439] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410e9a1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410e9a1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x881276e5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1150)) returned 1
	[0130.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.440] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.440] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.441] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x268d92c | out: lpFileInformation=0x268d92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540c24cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540c24cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x540c24cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.441] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.441] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.441] GetFileType (hFile=0x5dc) returned 0x1
	[0130.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.441] GetFileType (hFile=0x5dc) returned 0x1
	[0130.441] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.441] ReadFile (in: hFile=0x5dc, lpBuffer=0x268dd28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x268dd28*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.443] CloseHandle (hObject=0x5dc) returned 1
	[0130.443] CryptDestroyKey (hKey=0x82b540) returned 1
	[0130.443] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.443] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268edc4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0130.443] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.443] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.443] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0130.443] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.443] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x268ee7c*=0x1, dwFlags=0x0) returned 1
	[0130.443] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x268ee48, dwFlags=0x0) returned 1
	[0130.443] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268ee8c*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x268ee8c*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.443] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268efa8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x268efa8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.443] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0130.443] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.443] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.444] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.444] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.445] GetFileType (hFile=0x5dc) returned 0x1
	[0130.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.445] GetFileType (hFile=0x5dc) returned 0x1
	[0130.445] WriteFile (in: hFile=0x5dc, lpBuffer=0x268f124*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x268f124*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.446] CloseHandle (hObject=0x5dc) returned 1
	[0130.446] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.446] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.446] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540c24cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540c24cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8814ef45, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.446] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.447] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.447] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x269054c | out: lpFileInformation=0x269054c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fff1c4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fff1c4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fff1c4, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x13d8)) returned 1
	[0130.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.448] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.448] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.448] GetFileType (hFile=0x5dc) returned 0x1
	[0130.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.448] GetFileType (hFile=0x5dc) returned 0x1
	[0130.448] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x13d8
	[0130.448] ReadFile (in: hFile=0x5dc, lpBuffer=0x2690824, nNumberOfBytesToRead=0x13d8, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2690824*, lpNumberOfBytesRead=0x540efcc*=0x13d8, lpOverlapped=0x0) returned 1
	[0130.461] CloseHandle (hObject=0x5dc) returned 1
	[0130.461] CryptDestroyKey (hKey=0x82b480) returned 1
	[0130.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.462] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2691c98, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0130.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.462] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0130.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.462] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2691d50*=0x1, dwFlags=0x0) returned 1
	[0130.462] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2691d1c, dwFlags=0x0) returned 1
	[0130.462] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2691d60*, pdwDataLen=0x540efd4*=0x13e0, dwBufLen=0x13e0 | out: pbData=0x2691d60*, pdwDataLen=0x540efd4*=0x13e0) returned 1
	[0130.462] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269314c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x269314c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.462] CryptDestroyKey (hKey=0x82b280) returned 1
	[0130.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.463] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.463] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.464] GetFileType (hFile=0x5dc) returned 0x1
	[0130.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.465] GetFileType (hFile=0x5dc) returned 0x1
	[0130.465] WriteFile (in: hFile=0x5dc, lpBuffer=0x2691d60*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2691d60*, lpNumberOfBytesWritten=0x540efc0*=0x13e0, lpOverlapped=0x0) returned 1
	[0130.466] CloseHandle (hObject=0x5dc) returned 1
	[0130.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.466] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fff1c4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fff1c4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x88173c63, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13e0)) returned 1
	[0130.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.467] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.473] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26936dc | out: lpFileInformation=0x26936dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8cab3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8cab3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f8cab3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.474] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.474] GetFileType (hFile=0x5dc) returned 0x1
	[0130.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.474] GetFileType (hFile=0x5dc) returned 0x1
	[0130.474] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.474] ReadFile (in: hFile=0x5dc, lpBuffer=0x2693ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2693ad8*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.475] CloseHandle (hObject=0x5dc) returned 1
	[0130.475] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0130.476] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.476] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2694b74, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0130.476] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.476] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.476] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0130.476] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.476] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x2694c2c*=0x1, dwFlags=0x0) returned 1
	[0130.476] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x2694bf8, dwFlags=0x0) returned 1
	[0130.476] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2694c3c*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x2694c3c*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.476] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2694d58*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2694d58*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.476] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0130.476] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.477] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.477] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.477] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.478] GetFileType (hFile=0x5dc) returned 0x1
	[0130.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.478] GetFileType (hFile=0x5dc) returned 0x1
	[0130.478] WriteFile (in: hFile=0x5dc, lpBuffer=0x2694ed4*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2694ed4*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.479] CloseHandle (hObject=0x5dc) returned 1
	[0130.480] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.480] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.480] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8cab3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8cab3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x88199f11, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.480] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.484] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26962fc | out: lpFileInformation=0x26962fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f19b66, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x34d)) returned 1
	[0130.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.489] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.489] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.490] GetFileType (hFile=0x5dc) returned 0x1
	[0130.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.490] GetFileType (hFile=0x5dc) returned 0x1
	[0130.490] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34d
	[0130.490] ReadFile (in: hFile=0x5dc, lpBuffer=0x2696930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2696930*, lpNumberOfBytesRead=0x540efcc*=0x34d, lpOverlapped=0x0) returned 1
	[0130.499] CloseHandle (hObject=0x5dc) returned 1
	[0130.499] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0130.499] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.499] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26979cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b0c0) returned 1
	[0130.499] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.499] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.499] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0130.499] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.500] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2697a84*=0x1, dwFlags=0x0) returned 1
	[0130.500] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2697a50, dwFlags=0x0) returned 1
	[0130.500] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2697a94*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x2697a94*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0130.500] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2697df0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2697df0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.500] CryptDestroyKey (hKey=0x82b100) returned 1
	[0130.500] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.500] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.501] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.502] GetFileType (hFile=0x5dc) returned 0x1
	[0130.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.502] GetFileType (hFile=0x5dc) returned 0x1
	[0130.502] WriteFile (in: hFile=0x5dc, lpBuffer=0x2697f68*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2697f68*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0130.504] CloseHandle (hObject=0x5dc) returned 1
	[0130.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.504] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x881e639b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0130.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.505] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.521] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x269938c | out: lpFileInformation=0x269938c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.521] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.522] GetFileType (hFile=0x5dc) returned 0x1
	[0130.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.522] GetFileType (hFile=0x5dc) returned 0x1
	[0130.522] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.522] ReadFile (in: hFile=0x5dc, lpBuffer=0x2699788, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2699788*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.552] CloseHandle (hObject=0x5dc) returned 1
	[0130.552] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0130.552] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.552] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269a824, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0130.552] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.552] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.552] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0130.552] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.552] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x269a8dc*=0x1, dwFlags=0x0) returned 1
	[0130.553] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x269a8a8, dwFlags=0x0) returned 1
	[0130.553] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269a8ec*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x269a8ec*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.553] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269aa08*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x269aa08*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.553] CryptDestroyKey (hKey=0x82b380) returned 1
	[0130.553] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.553] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.553] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.553] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.595] GetFileType (hFile=0x5dc) returned 0x1
	[0130.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.595] GetFileType (hFile=0x5dc) returned 0x1
	[0130.595] WriteFile (in: hFile=0x5dc, lpBuffer=0x269ab84*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x269ab84*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.604] CloseHandle (hObject=0x5dc) returned 1
	[0130.604] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.604] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.604] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x882ce959, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.604] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.605] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x269bfac | out: lpFileInformation=0x269bfac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fedfc8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fedfc8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fedfc8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0130.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.605] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.605] GetFileType (hFile=0x5dc) returned 0x1
	[0130.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.606] GetFileType (hFile=0x5dc) returned 0x1
	[0130.606] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x380
	[0130.606] ReadFile (in: hFile=0x5dc, lpBuffer=0x269c610, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x269c610*, lpNumberOfBytesRead=0x540efcc*=0x380, lpOverlapped=0x0) returned 1
	[0130.613] CloseHandle (hObject=0x5dc) returned 1
	[0130.613] CryptDestroyKey (hKey=0x82b300) returned 1
	[0130.614] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.614] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269d6ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0130.614] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.614] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.614] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0130.614] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.614] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x269d764*=0x1, dwFlags=0x0) returned 1
	[0130.614] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x269d730, dwFlags=0x0) returned 1
	[0130.614] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269d774*, pdwDataLen=0x540efd4*=0x390, dwBufLen=0x390 | out: pbData=0x269d774*, pdwDataLen=0x540efd4*=0x390) returned 1
	[0130.614] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269db10*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x269db10*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.614] CryptDestroyKey (hKey=0x82b300) returned 1
	[0130.615] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.615] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.615] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.615] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.616] GetFileType (hFile=0x5dc) returned 0x1
	[0130.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.616] GetFileType (hFile=0x5dc) returned 0x1
	[0130.616] WriteFile (in: hFile=0x5dc, lpBuffer=0x269dc88*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x269dc88*, lpNumberOfBytesWritten=0x540ef94*=0x390, lpOverlapped=0x0) returned 1
	[0130.618] CloseHandle (hObject=0x5dc) returned 1
	[0130.618] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.618] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.618] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fedfc8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fedfc8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x882f13c1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x390)) returned 1
	[0130.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.618] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.621] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.621] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x269f0ac | out: lpFileInformation=0x269f0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.621] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.622] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.622] GetFileType (hFile=0x5dc) returned 0x1
	[0130.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.622] GetFileType (hFile=0x5dc) returned 0x1
	[0130.622] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.622] ReadFile (in: hFile=0x5dc, lpBuffer=0x269f4a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x269f4a8*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.623] CloseHandle (hObject=0x5dc) returned 1
	[0130.623] CryptDestroyKey (hKey=0x82b340) returned 1
	[0130.623] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.623] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a0544, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0130.623] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.623] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.624] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0130.624] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.624] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26a05fc*=0x1, dwFlags=0x0) returned 1
	[0130.624] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26a05c8, dwFlags=0x0) returned 1
	[0130.624] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a060c*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x26a060c*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.624] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a0728*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a0728*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.624] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0130.624] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.624] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.624] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.624] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.625] GetFileType (hFile=0x5dc) returned 0x1
	[0130.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.625] GetFileType (hFile=0x5dc) returned 0x1
	[0130.627] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a08a4*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26a08a4*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.628] CloseHandle (hObject=0x5dc) returned 1
	[0130.628] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.628] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.629] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x88317568, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.629] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.630] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.630] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26a1ccc | out: lpFileInformation=0x26a1ccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8c7)) returned 1
	[0130.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.630] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.630] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.630] GetFileType (hFile=0x5dc) returned 0x1
	[0130.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.630] GetFileType (hFile=0x5dc) returned 0x1
	[0130.630] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x8c7
	[0130.631] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a2878, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a2878*, lpNumberOfBytesRead=0x540efcc*=0x8c7, lpOverlapped=0x0) returned 1
	[0130.632] CloseHandle (hObject=0x5dc) returned 1
	[0130.632] CryptDestroyKey (hKey=0x82b340) returned 1
	[0130.632] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.632] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a3914, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0130.632] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.632] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.632] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0130.633] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.633] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26a39cc*=0x1, dwFlags=0x0) returned 1
	[0130.633] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26a3998, dwFlags=0x0) returned 1
	[0130.633] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a39dc*, pdwDataLen=0x540efd4*=0x8d0, dwBufLen=0x8d0 | out: pbData=0x26a39dc*, pdwDataLen=0x540efd4*=0x8d0) returned 1
	[0130.633] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a42b8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a42b8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.633] CryptDestroyKey (hKey=0x82b200) returned 1
	[0130.633] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.633] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.633] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.633] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.634] GetFileType (hFile=0x5dc) returned 0x1
	[0130.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.634] GetFileType (hFile=0x5dc) returned 0x1
	[0130.634] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a4430*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26a4430*, lpNumberOfBytesWritten=0x540ef94*=0x8d0, lpOverlapped=0x0) returned 1
	[0130.635] CloseHandle (hObject=0x5dc) returned 1
	[0130.636] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.636] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.636] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x88317568, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8d0)) returned 1
	[0130.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.636] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.639] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26a5854 | out: lpFileInformation=0x26a5854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.639] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.639] GetFileType (hFile=0x5dc) returned 0x1
	[0130.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.639] GetFileType (hFile=0x5dc) returned 0x1
	[0130.639] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.639] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a5c50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a5c50*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.641] CloseHandle (hObject=0x5dc) returned 1
	[0130.641] CryptDestroyKey (hKey=0x82b080) returned 1
	[0130.641] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.641] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a6cec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0130.641] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.641] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.641] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0130.641] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.641] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26a6da4*=0x1, dwFlags=0x0) returned 1
	[0130.641] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26a6d70, dwFlags=0x0) returned 1
	[0130.642] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a6db4*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x26a6db4*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.642] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a6ed0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a6ed0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.642] CryptDestroyKey (hKey=0x82b200) returned 1
	[0130.642] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.642] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.642] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.642] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.643] GetFileType (hFile=0x5dc) returned 0x1
	[0130.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.643] GetFileType (hFile=0x5dc) returned 0x1
	[0130.643] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a704c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26a704c*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.677] CloseHandle (hObject=0x5dc) returned 1
	[0130.677] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.678] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x88389c86, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.678] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.679] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26a8474 | out: lpFileInformation=0x26a8474*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410decf, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410decf, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5410decf, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc1)) returned 1
	[0130.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.680] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.680] GetFileType (hFile=0x5dc) returned 0x1
	[0130.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.681] GetFileType (hFile=0x5dc) returned 0x1
	[0130.681] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cc1
	[0130.681] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a874c, nNumberOfBytesToRead=0x1cc1, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a874c*, lpNumberOfBytesRead=0x540efcc*=0x1cc1, lpOverlapped=0x0) returned 1
	[0130.682] CloseHandle (hObject=0x5dc) returned 1
	[0130.683] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0130.683] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.683] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26aa4ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b000) returned 1
	[0130.683] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.683] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.683] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0130.683] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.683] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26aa564*=0x1, dwFlags=0x0) returned 1
	[0130.683] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26aa530, dwFlags=0x0) returned 1
	[0130.683] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26aa574*, pdwDataLen=0x540efd4*=0x1cd0, dwBufLen=0x1cd0 | out: pbData=0x26aa574*, pdwDataLen=0x540efd4*=0x1cd0) returned 1
	[0130.683] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ac250*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26ac250*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.683] CryptDestroyKey (hKey=0x82b540) returned 1
	[0130.683] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.683] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.683] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.683] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.685] GetFileType (hFile=0x5dc) returned 0x1
	[0130.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.685] GetFileType (hFile=0x5dc) returned 0x1
	[0130.685] WriteFile (in: hFile=0x5dc, lpBuffer=0x26aa574*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26aa574*, lpNumberOfBytesWritten=0x540efc0*=0x1cd0, lpOverlapped=0x0) returned 1
	[0130.686] CloseHandle (hObject=0x5dc) returned 1
	[0130.686] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.686] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.686] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410decf, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410decf, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x88389c86, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1cd0)) returned 1
	[0130.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.687] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.710] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.710] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26ac7e0 | out: lpFileInformation=0x26ac7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.711] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.711] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.712] GetFileType (hFile=0x5dc) returned 0x1
	[0130.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.712] GetFileType (hFile=0x5dc) returned 0x1
	[0130.712] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.712] ReadFile (in: hFile=0x5dc, lpBuffer=0x26acbdc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26acbdc*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.713] CloseHandle (hObject=0x5dc) returned 1
	[0130.713] CryptDestroyKey (hKey=0x82b000) returned 1
	[0130.713] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.713] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26adc78, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0130.713] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.713] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.714] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0130.714] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.714] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26add30*=0x1, dwFlags=0x0) returned 1
	[0130.714] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26adcfc, dwFlags=0x0) returned 1
	[0130.714] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26add40*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x26add40*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.714] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ade5c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26ade5c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.714] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0130.714] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.714] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.714] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.715] GetFileType (hFile=0x5dc) returned 0x1
	[0130.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.716] GetFileType (hFile=0x5dc) returned 0x1
	[0130.716] WriteFile (in: hFile=0x5dc, lpBuffer=0x26adfd8*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26adfd8*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.717] CloseHandle (hObject=0x5dc) returned 1
	[0130.717] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.717] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.717] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x883d62dc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.717] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.718] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.718] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26af400 | out: lpFileInformation=0x26af400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f9117b, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f9117b, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f9117b, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x85a)) returned 1
	[0130.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.719] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.719] GetFileType (hFile=0x5dc) returned 0x1
	[0130.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.719] GetFileType (hFile=0x5dc) returned 0x1
	[0130.719] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x85a
	[0130.719] ReadFile (in: hFile=0x5dc, lpBuffer=0x26aff40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26aff40*, lpNumberOfBytesRead=0x540efcc*=0x85a, lpOverlapped=0x0) returned 1
	[0130.747] CloseHandle (hObject=0x5dc) returned 1
	[0130.747] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0130.747] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.747] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b0fdc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0130.747] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.747] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.747] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0130.748] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.748] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26b1094*=0x1, dwFlags=0x0) returned 1
	[0130.748] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26b1060, dwFlags=0x0) returned 1
	[0130.748] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b10a4*, pdwDataLen=0x540efd4*=0x860, dwBufLen=0x860 | out: pbData=0x26b10a4*, pdwDataLen=0x540efd4*=0x860) returned 1
	[0130.748] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b1910*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b1910*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.748] CryptDestroyKey (hKey=0x82b280) returned 1
	[0130.748] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.748] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.748] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.750] GetFileType (hFile=0x5dc) returned 0x1
	[0130.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.750] GetFileType (hFile=0x5dc) returned 0x1
	[0130.750] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b1a88*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26b1a88*, lpNumberOfBytesWritten=0x540ef94*=0x860, lpOverlapped=0x0) returned 1
	[0130.753] CloseHandle (hObject=0x5dc) returned 1
	[0130.753] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.753] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.754] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f9117b, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f9117b, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x88448857, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x860)) returned 1
	[0130.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.754] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.755] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26b2eac | out: lpFileInformation=0x26b2eac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6af14, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6af14, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f6af14, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.756] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.756] GetFileType (hFile=0x5dc) returned 0x1
	[0130.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.756] GetFileType (hFile=0x5dc) returned 0x1
	[0130.756] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.756] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b32a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26b32a8*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.757] CloseHandle (hObject=0x5dc) returned 1
	[0130.757] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0130.757] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.757] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b4344, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0130.757] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.758] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0130.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.758] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26b43fc*=0x1, dwFlags=0x0) returned 1
	[0130.758] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26b43c8, dwFlags=0x0) returned 1
	[0130.758] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b440c*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x26b440c*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.758] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b4528*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b4528*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.758] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0130.758] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.758] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.758] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.758] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.760] GetFileType (hFile=0x5dc) returned 0x1
	[0130.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.760] GetFileType (hFile=0x5dc) returned 0x1
	[0130.760] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b46a4*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26b46a4*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.761] CloseHandle (hObject=0x5dc) returned 1
	[0130.761] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.761] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.761] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6af14, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6af14, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x88448857, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.762] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.763] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.763] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26b5acc | out: lpFileInformation=0x26b5acc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fb24d6, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fb24d6, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fb24d6, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8b5)) returned 1
	[0130.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.763] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.764] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.764] GetFileType (hFile=0x5dc) returned 0x1
	[0130.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.764] GetFileType (hFile=0x5dc) returned 0x1
	[0130.764] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x8b5
	[0130.764] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b6668, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26b6668*, lpNumberOfBytesRead=0x540efcc*=0x8b5, lpOverlapped=0x0) returned 1
	[0130.776] CloseHandle (hObject=0x5dc) returned 1
	[0130.776] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0130.776] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.776] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b7704, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0130.776] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.777] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.777] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0130.777] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.777] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26b77bc*=0x1, dwFlags=0x0) returned 1
	[0130.777] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26b7788, dwFlags=0x0) returned 1
	[0130.777] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b77cc*, pdwDataLen=0x540efd4*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x26b77cc*, pdwDataLen=0x540efd4*=0x8c0) returned 1
	[0130.777] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b8098*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b8098*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.777] CryptDestroyKey (hKey=0x82b440) returned 1
	[0130.777] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.777] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.777] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.778] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b8210*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26b8210*, lpNumberOfBytesWritten=0x540ef94*=0x8c0, lpOverlapped=0x0) returned 1
	[0130.780] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.921] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.921] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.922] GetFileType (hFile=0x5dc) returned 0x1
	[0130.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.922] GetFileType (hFile=0x5dc) returned 0x1
	[0130.922] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.922] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b9a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26b9a30*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.925] CloseHandle (hObject=0x5dc) returned 1
	[0130.925] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0130.925] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.925] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26baacc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b0c0) returned 1
	[0130.925] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.925] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.925] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0130.925] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.925] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x26bab84*=0x1, dwFlags=0x0) returned 1
	[0130.925] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26bab50, dwFlags=0x0) returned 1
	[0130.925] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bab94*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x26bab94*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.925] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bacb0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26bacb0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.925] CryptDestroyKey (hKey=0x82b400) returned 1
	[0130.925] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.925] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.925] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.926] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.927] GetFileType (hFile=0x5dc) returned 0x1
	[0130.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.927] GetFileType (hFile=0x5dc) returned 0x1
	[0130.927] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bae2c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26bae2c*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.928] CloseHandle (hObject=0x5dc) returned 1
	[0130.928] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.928] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.928] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8c279, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8c279, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x885ec1be, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.928] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.929] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26bc254 | out: lpFileInformation=0x26bc254*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x67b)) returned 1
	[0130.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.930] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.930] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.930] GetFileType (hFile=0x5dc) returned 0x1
	[0130.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.930] GetFileType (hFile=0x5dc) returned 0x1
	[0130.930] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x67b
	[0130.930] ReadFile (in: hFile=0x5dc, lpBuffer=0x26bcbb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26bcbb4*, lpNumberOfBytesRead=0x540efcc*=0x67b, lpOverlapped=0x0) returned 1
	[0130.936] CloseHandle (hObject=0x5dc) returned 1
	[0130.936] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0130.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.937] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bdc50, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0130.937] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.937] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.937] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0130.937] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.937] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26bdd08*=0x1, dwFlags=0x0) returned 1
	[0130.937] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26bdcd4, dwFlags=0x0) returned 1
	[0130.937] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bdd18*, pdwDataLen=0x540efd4*=0x680, dwBufLen=0x680 | out: pbData=0x26bdd18*, pdwDataLen=0x540efd4*=0x680) returned 1
	[0130.937] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26be3a4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26be3a4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.937] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0130.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.937] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.937] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.939] GetFileType (hFile=0x5dc) returned 0x1
	[0130.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.939] GetFileType (hFile=0x5dc) returned 0x1
	[0130.939] WriteFile (in: hFile=0x5dc, lpBuffer=0x26be51c*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26be51c*, lpNumberOfBytesWritten=0x540ef94*=0x680, lpOverlapped=0x0) returned 1
	[0130.940] CloseHandle (hObject=0x5dc) returned 1
	[0130.943] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.944] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0130.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.944] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x88616282, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x680)) returned 1
	[0130.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.944] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.981] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.981] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26bf940 | out: lpFileInformation=0x26bf940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0130.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.981] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.981] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.982] GetFileType (hFile=0x5dc) returned 0x1
	[0130.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.982] GetFileType (hFile=0x5dc) returned 0x1
	[0130.982] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0130.982] ReadFile (in: hFile=0x5dc, lpBuffer=0x26bfd3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26bfd3c*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0130.983] CloseHandle (hObject=0x5dc) returned 1
	[0130.983] CryptDestroyKey (hKey=0x82b380) returned 1
	[0130.983] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.983] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c0dd8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0130.983] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.983] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.983] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0130.983] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0130.983] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26c0e90*=0x1, dwFlags=0x0) returned 1
	[0130.983] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26c0e5c, dwFlags=0x0) returned 1
	[0130.984] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0ea0*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x26c0ea0*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0130.984] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c0fbc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c0fbc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0130.984] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0130.984] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.984] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0130.984] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0130.984] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.987] GetFileType (hFile=0x5dc) returned 0x1
	[0130.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0130.987] GetFileType (hFile=0x5dc) returned 0x1
	[0130.987] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c1138*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26c1138*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0130.988] CloseHandle (hObject=0x5dc) returned 1
	[0130.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0130.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0130.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0130.988] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8868550a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0130.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0130.988] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0130.989] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0130.990] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26c2560 | out: lpFileInformation=0x26c2560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930c721b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x930c721b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x930c721b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x9ba5b)) returned 1
	[0130.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0130.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0130.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0130.990] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0130.991] GetFileType (hFile=0x5dc) returned 0x1
	[0130.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0130.991] GetFileType (hFile=0x5dc) returned 0x1
	[0130.991] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x9ba5b
	[0130.993] ReadFile (in: hFile=0x5dc, lpBuffer=0x8d6ef50, nNumberOfBytesToRead=0x9ba5b, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x8d6ef50*, lpNumberOfBytesRead=0x540efcc*=0x9ba5b, lpOverlapped=0x0) returned 1
	[0131.025] CloseHandle (hObject=0x5dc) returned 1
	[0131.025] CryptDestroyKey (hKey=0x82b280) returned 1
	[0131.025] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.025] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c28c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0131.026] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.026] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.026] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0131.026] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.026] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26c2980*=0x1, dwFlags=0x0) returned 1
	[0131.026] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26c294c, dwFlags=0x0) returned 1
	[0131.036] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8ea1018*, pdwDataLen=0x540efd4*=0x9ba60, dwBufLen=0x9ba60 | out: pbData=0x8ea1018*, pdwDataLen=0x540efd4*=0x9ba60) returned 1
	[0131.037] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c2990*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c2990*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.037] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0131.037] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.037] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.037] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.037] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.043] GetFileType (hFile=0x5dc) returned 0x1
	[0131.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0131.044] GetFileType (hFile=0x5dc) returned 0x1
	[0131.044] WriteFile (in: hFile=0x5dc, lpBuffer=0x8ea1018*, nNumberOfBytesToWrite=0x9ba60, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x8ea1018*, lpNumberOfBytesWritten=0x540efc0*=0x9ba60, lpOverlapped=0x0) returned 1
	[0131.060] CloseHandle (hObject=0x5dc) returned 1
	[0131.060] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.060] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0131.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0131.060] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930c721b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x930c721b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8871d57d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9ba60)) returned 1
	[0131.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0131.061] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0131.061] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.062] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26c2f20 | out: lpFileInformation=0x26c2f20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0131.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.062] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.062] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.062] GetFileType (hFile=0x5dc) returned 0x1
	[0131.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.062] GetFileType (hFile=0x5dc) returned 0x1
	[0131.062] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0131.062] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c331c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c331c*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0131.064] CloseHandle (hObject=0x5dc) returned 1
	[0131.064] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0131.064] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.064] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c43b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0131.064] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.064] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.064] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0131.065] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.065] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26c4470*=0x1, dwFlags=0x0) returned 1
	[0131.065] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26c443c, dwFlags=0x0) returned 1
	[0131.065] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c4480*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x26c4480*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0131.065] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c459c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c459c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.065] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0131.065] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.065] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.065] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.065] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.066] GetFileType (hFile=0x5dc) returned 0x1
	[0131.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0131.066] GetFileType (hFile=0x5dc) returned 0x1
	[0131.066] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c4718*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26c4718*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0131.067] CloseHandle (hObject=0x5dc) returned 1
	[0131.068] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.068] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0131.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0131.068] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x88743737, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0131.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0131.068] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0131.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.069] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26c5b40 | out: lpFileInformation=0x26c5b40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x732)) returned 1
	[0131.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.069] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.069] GetFileType (hFile=0x5dc) returned 0x1
	[0131.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.070] GetFileType (hFile=0x5dc) returned 0x1
	[0131.070] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x732
	[0131.070] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c6558, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c6558*, lpNumberOfBytesRead=0x540efcc*=0x732, lpOverlapped=0x0) returned 1
	[0131.071] CloseHandle (hObject=0x5dc) returned 1
	[0131.071] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0131.071] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.071] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c75f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0131.072] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.072] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.072] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0131.072] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.072] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26c76ac*=0x1, dwFlags=0x0) returned 1
	[0131.072] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26c7678, dwFlags=0x0) returned 1
	[0131.072] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c76bc*, pdwDataLen=0x540efd4*=0x740, dwBufLen=0x740 | out: pbData=0x26c76bc*, pdwDataLen=0x540efd4*=0x740) returned 1
	[0131.072] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c7e08*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c7e08*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.072] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0131.072] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.072] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.072] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.072] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.073] GetFileType (hFile=0x5dc) returned 0x1
	[0131.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0131.074] GetFileType (hFile=0x5dc) returned 0x1
	[0131.074] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c7f80*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26c7f80*, lpNumberOfBytesWritten=0x540ef94*=0x740, lpOverlapped=0x0) returned 1
	[0131.075] CloseHandle (hObject=0x5dc) returned 1
	[0131.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0131.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0131.075] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x88743737, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x740)) returned 1
	[0131.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0131.075] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0131.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.078] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26c93a4 | out: lpFileInformation=0x26c93a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0131.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.078] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.078] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.078] GetFileType (hFile=0x5dc) returned 0x1
	[0131.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.078] GetFileType (hFile=0x5dc) returned 0x1
	[0131.078] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0131.078] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c97a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c97a0*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0131.080] CloseHandle (hObject=0x5dc) returned 1
	[0131.080] CryptDestroyKey (hKey=0x82b280) returned 1
	[0131.080] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.080] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ca83c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0131.080] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.080] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.080] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0131.080] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.080] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26ca8f4*=0x1, dwFlags=0x0) returned 1
	[0131.080] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26ca8c0, dwFlags=0x0) returned 1
	[0131.080] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ca904*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x26ca904*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0131.081] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26caa20*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26caa20*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.081] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0131.081] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.081] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.081] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.081] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.082] GetFileType (hFile=0x5dc) returned 0x1
	[0131.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0131.082] GetFileType (hFile=0x5dc) returned 0x1
	[0131.082] WriteFile (in: hFile=0x5dc, lpBuffer=0x26cab9c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26cab9c*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0131.083] CloseHandle (hObject=0x5dc) returned 1
	[0131.083] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.083] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0131.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0131.083] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x887698fa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0131.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0131.084] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0131.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.085] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26cbfc4 | out: lpFileInformation=0x26cbfc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6a449, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6a449, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f6a449, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8a8)) returned 1
	[0131.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.085] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.085] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.085] GetFileType (hFile=0x5dc) returned 0x1
	[0131.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.085] GetFileType (hFile=0x5dc) returned 0x1
	[0131.085] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x8a8
	[0131.085] ReadFile (in: hFile=0x5dc, lpBuffer=0x26ccb50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ccb50*, lpNumberOfBytesRead=0x540efcc*=0x8a8, lpOverlapped=0x0) returned 1
	[0131.103] CloseHandle (hObject=0x5dc) returned 1
	[0131.103] CryptDestroyKey (hKey=0x82b080) returned 1
	[0131.103] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.103] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26cdbec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0131.103] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.103] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.103] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0131.103] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.103] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26cdca4*=0x1, dwFlags=0x0) returned 1
	[0131.103] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26cdc70, dwFlags=0x0) returned 1
	[0131.103] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26cdcb4*, pdwDataLen=0x540efd4*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x26cdcb4*, pdwDataLen=0x540efd4*=0x8b0) returned 1
	[0131.103] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ce570*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26ce570*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.103] CryptDestroyKey (hKey=0x82b540) returned 1
	[0131.103] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.103] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.103] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.104] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.105] GetFileType (hFile=0x5dc) returned 0x1
	[0131.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0131.105] GetFileType (hFile=0x5dc) returned 0x1
	[0131.105] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ce6e8*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26ce6e8*, lpNumberOfBytesWritten=0x540ef94*=0x8b0, lpOverlapped=0x0) returned 1
	[0131.106] CloseHandle (hObject=0x5dc) returned 1
	[0131.106] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.106] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0131.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0131.106] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6a449, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6a449, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8878fb5e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8b0)) returned 1
	[0131.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0131.107] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0131.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.113] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26cfb0c | out: lpFileInformation=0x26cfb0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0131.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.114] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.114] ReadFile (in: hFile=0x5dc, lpBuffer=0x26cff08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26cff08*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0131.115] CryptDestroyKey (hKey=0x82b340) returned 1
	[0131.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.115] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d0fa4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0131.116] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.116] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.116] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0131.116] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.116] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26d105c*=0x1, dwFlags=0x0) returned 1
	[0131.116] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26d1028, dwFlags=0x0) returned 1
	[0131.116] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d106c*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x26d106c*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0131.116] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d1188*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26d1188*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.116] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0131.116] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.116] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.116] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.116] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.117] GetFileType (hFile=0x5dc) returned 0x1
	[0131.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0131.118] GetFileType (hFile=0x5dc) returned 0x1
	[0131.118] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d1304*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26d1304*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0131.119] CloseHandle (hObject=0x5dc) returned 1
	[0131.119] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.119] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0131.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0131.119] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x887b5dd4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0131.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0131.119] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0131.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.120] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26d272c | out: lpFileInformation=0x26d272c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x560ed25a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x560ed25a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x560ed25a, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x6274)) returned 1
	[0131.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.121] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.121] GetFileType (hFile=0x5dc) returned 0x1
	[0131.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.121] GetFileType (hFile=0x5dc) returned 0x1
	[0131.121] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x6274
	[0131.121] ReadFile (in: hFile=0x5dc, lpBuffer=0x26d2a04, nNumberOfBytesToRead=0x6274, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d2a04*, lpNumberOfBytesRead=0x540efcc*=0x6274, lpOverlapped=0x0) returned 1
	[0131.136] CloseHandle (hObject=0x5dc) returned 1
	[0131.136] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0131.136] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.136] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d8d14, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0131.136] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.136] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.136] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0131.136] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.137] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26d8dcc*=0x1, dwFlags=0x0) returned 1
	[0131.137] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26d8d98, dwFlags=0x0) returned 1
	[0131.137] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d8ddc*, pdwDataLen=0x540efd4*=0x6280, dwBufLen=0x6280 | out: pbData=0x26d8ddc*, pdwDataLen=0x540efd4*=0x6280) returned 1
	[0131.137] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26df068*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26df068*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.137] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0131.137] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.137] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.137] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.139] GetFileType (hFile=0x5dc) returned 0x1
	[0131.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0131.139] GetFileType (hFile=0x5dc) returned 0x1
	[0131.139] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d8ddc*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26d8ddc*, lpNumberOfBytesWritten=0x540efc0*=0x6280, lpOverlapped=0x0) returned 1
	[0131.141] CloseHandle (hObject=0x5dc) returned 1
	[0131.141] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", lpFilePart=0x0) returned 0x5f
	[0131.141] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8e
	[0131.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0131.141] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x560ed25a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x560ed25a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x887dc0d5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x6280)) returned 1
	[0131.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0131.141] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0131.142] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.142] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26df5f8 | out: lpFileInformation=0x26df5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55d0d528, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55d0d528, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55d0d528, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f)) returned 1
	[0131.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.143] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.143] GetFileType (hFile=0x5dc) returned 0x1
	[0131.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.143] GetFileType (hFile=0x5dc) returned 0x1
	[0131.143] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10f
	[0131.143] ReadFile (in: hFile=0x5dc, lpBuffer=0x26df9f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26df9f4*, lpNumberOfBytesRead=0x540efcc*=0x10f, lpOverlapped=0x0) returned 1
	[0131.144] CloseHandle (hObject=0x5dc) returned 1
	[0131.144] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0131.144] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.145] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e0a90, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0131.145] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.145] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.145] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0131.145] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.145] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x26e0b48*=0x1, dwFlags=0x0) returned 1
	[0131.145] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x26e0b14, dwFlags=0x0) returned 1
	[0131.145] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e0b58*, pdwDataLen=0x540efd4*=0x110, dwBufLen=0x110 | out: pbData=0x26e0b58*, pdwDataLen=0x540efd4*=0x110) returned 1
	[0131.145] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e0c74*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e0c74*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.145] CryptDestroyKey (hKey=0x82b080) returned 1
	[0131.145] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.145] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.145] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.147] GetFileType (hFile=0x5dc) returned 0x1
	[0131.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0131.147] GetFileType (hFile=0x5dc) returned 0x1
	[0131.147] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e0df0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26e0df0*, lpNumberOfBytesWritten=0x540ef94*=0x110, lpOverlapped=0x0) returned 1
	[0131.148] CloseHandle (hObject=0x5dc) returned 1
	[0131.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x60
	[0131.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8f
	[0131.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0131.148] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55d0d528, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55d0d528, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8880231e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0131.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0131.148] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0131.149] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", lpFilePart=0x0) returned 0x37
	[0131.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.149] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.chk"), fInfoLevelId=0x0, lpFileInformation=0x26e2218 | out: lpFileInformation=0x26e2218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd4ae8d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b93f8ea, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0131.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.152] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", lpFilePart=0x0) returned 0x37
	[0131.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.152] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.152] GetFileType (hFile=0x5dc) returned 0x1
	[0131.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.152] GetFileType (hFile=0x5dc) returned 0x1
	[0131.152] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2000
	[0131.152] ReadFile (in: hFile=0x5dc, lpBuffer=0x26e2420, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e2420*, lpNumberOfBytesRead=0x540efcc*=0x2000, lpOverlapped=0x0) returned 1
	[0131.175] CloseHandle (hObject=0x5dc) returned 1
	[0131.175] CryptDestroyKey (hKey=0x82b040) returned 1
	[0131.175] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.175] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e44bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0131.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.175] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0131.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.175] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26e4574*=0x1, dwFlags=0x0) returned 1
	[0131.175] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26e4540, dwFlags=0x0) returned 1
	[0131.175] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e4584*, pdwDataLen=0x540efd4*=0x2010, dwBufLen=0x2010 | out: pbData=0x26e4584*, pdwDataLen=0x540efd4*=0x2010) returned 1
	[0131.175] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e65a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e65a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.175] CryptDestroyKey (hKey=0x82b540) returned 1
	[0131.175] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.175] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.175] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", lpFilePart=0x0) returned 0x37
	[0131.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.175] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.chk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.177] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log", lpFilePart=0x0) returned 0x37
	[0131.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.178] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.log"), fInfoLevelId=0x0, lpFileInformation=0x26e6b14 | out: lpFileInformation=0x26e6b14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd24c5a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dec862e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b93f8ea, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0131.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log", lpFilePart=0x0) returned 0x37
	[0131.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.178] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.178] GetFileType (hFile=0x5dc) returned 0x1
	[0131.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.179] GetFileType (hFile=0x5dc) returned 0x1
	[0131.179] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10000
	[0131.179] ReadFile (in: hFile=0x5dc, lpBuffer=0x26e6d1c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e6d1c*, lpNumberOfBytesRead=0x540efcc*=0x10000, lpOverlapped=0x0) returned 1
	[0131.192] CloseHandle (hObject=0x5dc) returned 1
	[0131.193] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0131.193] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.193] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f6db8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b0c0) returned 1
	[0131.193] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.193] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.193] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0131.193] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.193] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26f6e70*=0x1, dwFlags=0x0) returned 1
	[0131.193] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26f6e3c, dwFlags=0x0) returned 1
	[0131.193] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f6e80*, pdwDataLen=0x540efd4*=0x10010, dwBufLen=0x10010 | out: pbData=0x26f6e80*, pdwDataLen=0x540efd4*=0x10010) returned 1
	[0131.193] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2706e9c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2706e9c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.193] CryptDestroyKey (hKey=0x82b540) returned 1
	[0131.193] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.193] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.193] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log", lpFilePart=0x0) returned 0x37
	[0131.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.194] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.195] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", lpFilePart=0x0) returned 0x3c
	[0131.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.195] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb00002.log"), fInfoLevelId=0x0, lpFileInformation=0x2707410 | out: lpFileInformation=0x2707410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd24c5a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b42ee8a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0131.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.196] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", lpFilePart=0x0) returned 0x3c
	[0131.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.197] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb00002.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.197] GetFileType (hFile=0x5dc) returned 0x1
	[0131.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.197] GetFileType (hFile=0x5dc) returned 0x1
	[0131.197] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10000
	[0131.197] ReadFile (in: hFile=0x5dc, lpBuffer=0x2707648, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2707648*, lpNumberOfBytesRead=0x540efcc*=0x10000, lpOverlapped=0x0) returned 1
	[0131.213] CloseHandle (hObject=0x5dc) returned 1
	[0131.214] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0131.214] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.214] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27176e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0131.214] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.214] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.214] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0131.214] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.214] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x271779c*=0x1, dwFlags=0x0) returned 1
	[0131.214] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2717768, dwFlags=0x0) returned 1
	[0131.214] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27177ac*, pdwDataLen=0x540efd4*=0x10010, dwBufLen=0x10010 | out: pbData=0x27177ac*, pdwDataLen=0x540efd4*=0x10010) returned 1
	[0131.214] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27277c8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27277c8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.214] CryptDestroyKey (hKey=0x82b480) returned 1
	[0131.214] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.214] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", lpFilePart=0x0) returned 0x3c
	[0131.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.215] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb00002.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", lpFilePart=0x0) returned 0x3f
	[0131.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.217] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs"), fInfoLevelId=0x0, lpFileInformation=0x2727d74 | out: lpFileInformation=0x2727d74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd4ae8d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dd4ae8d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0131.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.218] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", lpFilePart=0x0) returned 0x3f
	[0131.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.218] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.218] GetFileType (hFile=0x5dc) returned 0x1
	[0131.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.218] GetFileType (hFile=0x5dc) returned 0x1
	[0131.219] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10000
	[0131.219] ReadFile (in: hFile=0x5dc, lpBuffer=0x2727fbc, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2727fbc*, lpNumberOfBytesRead=0x540efcc*=0x10000, lpOverlapped=0x0) returned 1
	[0131.279] CloseHandle (hObject=0x5dc) returned 1
	[0131.279] CryptDestroyKey (hKey=0x82b540) returned 1
	[0131.279] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.279] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2738058, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0131.279] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.279] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.279] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0131.279] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.280] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2738110*=0x1, dwFlags=0x0) returned 1
	[0131.280] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27380dc, dwFlags=0x0) returned 1
	[0131.280] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2738120*, pdwDataLen=0x540efd4*=0x10010, dwBufLen=0x10010 | out: pbData=0x2738120*, pdwDataLen=0x540efd4*=0x10010) returned 1
	[0131.280] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274813c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x274813c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.280] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0131.280] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.280] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", lpFilePart=0x0) returned 0x3f
	[0131.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.280] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.283] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", lpFilePart=0x0) returned 0x3f
	[0131.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.283] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs"), fInfoLevelId=0x0, lpFileInformation=0x2748700 | out: lpFileInformation=0x2748700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd4ae8d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dd4ae8d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0131.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.284] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", lpFilePart=0x0) returned 0x3f
	[0131.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.284] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.284] GetFileType (hFile=0x5dc) returned 0x1
	[0131.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.284] GetFileType (hFile=0x5dc) returned 0x1
	[0131.284] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10000
	[0131.284] ReadFile (in: hFile=0x5dc, lpBuffer=0x2748948, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2748948*, lpNumberOfBytesRead=0x540efcc*=0x10000, lpOverlapped=0x0) returned 1
	[0131.286] CloseHandle (hObject=0x5dc) returned 1
	[0131.286] CryptDestroyKey (hKey=0x82b380) returned 1
	[0131.286] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.286] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27589e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0131.286] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.286] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.286] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0131.286] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.286] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2758a9c*=0x1, dwFlags=0x0) returned 1
	[0131.286] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2758a68, dwFlags=0x0) returned 1
	[0131.286] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2758aac*, pdwDataLen=0x540efd4*=0x10010, dwBufLen=0x10010 | out: pbData=0x2758aac*, pdwDataLen=0x540efd4*=0x10010) returned 1
	[0131.287] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2768ac8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2768ac8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.287] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0131.287] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.287] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.287] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", lpFilePart=0x0) returned 0x3f
	[0131.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.287] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.289] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", lpFilePart=0x0) returned 0x3a
	[0131.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.289] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), fInfoLevelId=0x0, lpFileInformation=0x276908c | out: lpFileInformation=0x276908c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd24c5a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd24c5a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1deee89a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0131.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.289] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", lpFilePart=0x0) returned 0x3a
	[0131.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.289] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.289] GetFileType (hFile=0x5dc) returned 0x1
	[0131.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.290] GetFileType (hFile=0x5dc) returned 0x1
	[0131.290] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10000
	[0131.290] ReadFile (in: hFile=0x5dc, lpBuffer=0x27692b4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27692b4*, lpNumberOfBytesRead=0x540efcc*=0x10000, lpOverlapped=0x0) returned 1
	[0131.315] CloseHandle (hObject=0x5dc) returned 1
	[0131.315] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0131.315] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.316] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2779350, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0131.316] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.316] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.316] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0131.316] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.316] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x2779408*=0x1, dwFlags=0x0) returned 1
	[0131.316] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x27793d4, dwFlags=0x0) returned 1
	[0131.316] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2779418*, pdwDataLen=0x540efd4*=0x10010, dwBufLen=0x10010 | out: pbData=0x2779418*, pdwDataLen=0x540efd4*=0x10010) returned 1
	[0131.316] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2789434*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2789434*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.316] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0131.316] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.316] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", lpFilePart=0x0) returned 0x3a
	[0131.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.316] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.318] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", lpFilePart=0x0) returned 0x44
	[0131.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.318] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), fInfoLevelId=0x0, lpFileInformation=0x27899cc | out: lpFileInformation=0x27899cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd973cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd973cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b74fcb1, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x30000)) returned 1
	[0131.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.319] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", lpFilePart=0x0) returned 0x44
	[0131.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.319] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.319] GetFileType (hFile=0x5dc) returned 0x1
	[0131.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.319] GetFileType (hFile=0x5dc) returned 0x1
	[0131.319] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x30000
	[0131.320] ReadFile (in: hFile=0x5dc, lpBuffer=0x8e0a9c8, nNumberOfBytesToRead=0x30000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x8e0a9c8*, lpNumberOfBytesRead=0x540efcc*=0x30000, lpOverlapped=0x0) returned 1
	[0131.326] CloseHandle (hObject=0x5dc) returned 1
	[0131.326] CryptDestroyKey (hKey=0x82b300) returned 1
	[0131.326] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.326] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2789cd4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0131.326] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.326] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.326] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0131.326] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.326] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2789d8c*=0x1, dwFlags=0x0) returned 1
	[0131.326] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2789d58, dwFlags=0x0) returned 1
	[0131.329] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8e3a9e8*, pdwDataLen=0x540efd4*=0x30010, dwBufLen=0x30010 | out: pbData=0x8e3a9e8*, pdwDataLen=0x540efd4*=0x30010) returned 1
	[0131.329] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2789d9c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2789d9c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.329] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0131.329] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.329] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.329] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", lpFilePart=0x0) returned 0x44
	[0131.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.329] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.334] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", lpFilePart=0x0) returned 0x45
	[0131.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.335] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm"), fInfoLevelId=0x0, lpFileInformation=0x278a398 | out: lpFileInformation=0x278a398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd7110f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd7110f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b74fcb1, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
	[0131.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.335] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", lpFilePart=0x0) returned 0x45
	[0131.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.335] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.335] GetFileType (hFile=0x5dc) returned 0x1
	[0131.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.335] GetFileType (hFile=0x5dc) returned 0x1
	[0131.335] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x4000
	[0131.335] ReadFile (in: hFile=0x5dc, lpBuffer=0x278a610, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x278a610*, lpNumberOfBytesRead=0x540efcc*=0x4000, lpOverlapped=0x0) returned 1
	[0131.337] CloseHandle (hObject=0x5dc) returned 1
	[0131.337] CryptDestroyKey (hKey=0x82b480) returned 1
	[0131.337] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.337] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278e6ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0131.337] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.337] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.337] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0131.337] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.337] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x278e764*=0x1, dwFlags=0x0) returned 1
	[0131.337] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x278e730, dwFlags=0x0) returned 1
	[0131.338] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278e774*, pdwDataLen=0x540efd4*=0x4010, dwBufLen=0x4010 | out: pbData=0x278e774*, pdwDataLen=0x540efd4*=0x4010) returned 1
	[0131.338] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2792790*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2792790*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.338] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0131.338] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.338] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.338] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", lpFilePart=0x0) returned 0x45
	[0131.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.338] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.340] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", lpFilePart=0x0) returned 0x43
	[0131.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.340] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), fInfoLevelId=0x0, lpFileInformation=0x2792d90 | out: lpFileInformation=0x2792d90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4771)) returned 1
	[0131.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.355] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", lpFilePart=0x0) returned 0x43
	[0131.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.355] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.355] GetFileType (hFile=0x5dc) returned 0x1
	[0131.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.355] GetFileType (hFile=0x5dc) returned 0x1
	[0131.355] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x4771
	[0131.355] ReadFile (in: hFile=0x5dc, lpBuffer=0x2793008, nNumberOfBytesToRead=0x4771, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2793008*, lpNumberOfBytesRead=0x540efcc*=0x4771, lpOverlapped=0x0) returned 1
	[0131.364] CloseHandle (hObject=0x5dc) returned 1
	[0131.364] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0131.364] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.364] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2797818, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0131.364] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.365] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0131.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.365] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27978d0*=0x1, dwFlags=0x0) returned 1
	[0131.365] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x279789c, dwFlags=0x0) returned 1
	[0131.365] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27978e0*, pdwDataLen=0x540efd4*=0x4780, dwBufLen=0x4780 | out: pbData=0x27978e0*, pdwDataLen=0x540efd4*=0x4780) returned 1
	[0131.365] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279c06c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x279c06c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.365] CryptDestroyKey (hKey=0x82b380) returned 1
	[0131.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", lpFilePart=0x0) returned 0x43
	[0131.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.365] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.367] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", lpFilePart=0x0) returned 0x48
	[0131.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.367] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), fInfoLevelId=0x0, lpFileInformation=0x279c660 | out: lpFileInformation=0x279c660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x173d)) returned 1
	[0131.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.368] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", lpFilePart=0x0) returned 0x48
	[0131.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.368] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.368] GetFileType (hFile=0x5dc) returned 0x1
	[0131.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.368] GetFileType (hFile=0x5dc) returned 0x1
	[0131.368] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x173d
	[0131.369] ReadFile (in: hFile=0x5dc, lpBuffer=0x279c908, nNumberOfBytesToRead=0x173d, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x279c908*, lpNumberOfBytesRead=0x540efcc*=0x173d, lpOverlapped=0x0) returned 1
	[0131.381] CloseHandle (hObject=0x5dc) returned 1
	[0131.381] CryptDestroyKey (hKey=0x82b340) returned 1
	[0131.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.381] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279e0e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0131.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.381] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0131.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.381] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x279e19c*=0x1, dwFlags=0x0) returned 1
	[0131.381] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x279e168, dwFlags=0x0) returned 1
	[0131.381] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279e1ac*, pdwDataLen=0x540efd4*=0x1740, dwBufLen=0x1740 | out: pbData=0x279e1ac*, pdwDataLen=0x540efd4*=0x1740) returned 1
	[0131.381] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279f8f8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x279f8f8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.381] CryptDestroyKey (hKey=0x82b380) returned 1
	[0131.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", lpFilePart=0x0) returned 0x48
	[0131.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.382] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.384] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", lpFilePart=0x0) returned 0x4d
	[0131.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.384] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), fInfoLevelId=0x0, lpFileInformation=0x279ff24 | out: lpFileInformation=0x279ff24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc27)) returned 1
	[0131.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.404] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", lpFilePart=0x0) returned 0x4d
	[0131.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.404] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.404] GetFileType (hFile=0x5dc) returned 0x1
	[0131.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.404] GetFileType (hFile=0x5dc) returned 0x1
	[0131.404] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xc27
	[0131.404] ReadFile (in: hFile=0x5dc, lpBuffer=0x27a0e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a0e20*, lpNumberOfBytesRead=0x540efcc*=0xc27, lpOverlapped=0x0) returned 1
	[0131.426] CloseHandle (hObject=0x5dc) returned 1
	[0131.426] CryptDestroyKey (hKey=0x82b340) returned 1
	[0131.427] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.427] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a1ebc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0131.427] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.427] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.427] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0131.427] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.427] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27a1f74*=0x1, dwFlags=0x0) returned 1
	[0131.427] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27a1f40, dwFlags=0x0) returned 1
	[0131.427] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a1f84*, pdwDataLen=0x540efd4*=0xc30, dwBufLen=0xc30 | out: pbData=0x27a1f84*, pdwDataLen=0x540efd4*=0xc30) returned 1
	[0131.427] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a2bc0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a2bc0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.427] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0131.427] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.427] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", lpFilePart=0x0) returned 0x4d
	[0131.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.427] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", lpFilePart=0x0) returned 0x53
	[0131.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.429] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), fInfoLevelId=0x0, lpFileInformation=0x27a3218 | out: lpFileInformation=0x27a3218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb)) returned 1
	[0131.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.430] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", lpFilePart=0x0) returned 0x53
	[0131.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.430] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.430] GetFileType (hFile=0x5dc) returned 0x1
	[0131.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.430] GetFileType (hFile=0x5dc) returned 0x1
	[0131.430] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x9eb
	[0131.430] ReadFile (in: hFile=0x5dc, lpBuffer=0x27a3f08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a3f08*, lpNumberOfBytesRead=0x540efcc*=0x9eb, lpOverlapped=0x0) returned 1
	[0131.437] CloseHandle (hObject=0x5dc) returned 1
	[0131.437] CryptDestroyKey (hKey=0x82b080) returned 1
	[0131.437] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.438] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a4fa4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0131.438] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.438] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.438] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0131.438] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.438] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27a505c*=0x1, dwFlags=0x0) returned 1
	[0131.438] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27a5028, dwFlags=0x0) returned 1
	[0131.438] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a506c*, pdwDataLen=0x540efd4*=0x9f0, dwBufLen=0x9f0 | out: pbData=0x27a506c*, pdwDataLen=0x540efd4*=0x9f0) returned 1
	[0131.438] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a5a68*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a5a68*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.438] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0131.438] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.438] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.438] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", lpFilePart=0x0) returned 0x53
	[0131.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.438] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.443] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", lpFilePart=0x0) returned 0x41
	[0131.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.444] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), fInfoLevelId=0x0, lpFileInformation=0x27a60fc | out: lpFileInformation=0x27a60fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf80)) returned 1
	[0131.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.444] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", lpFilePart=0x0) returned 0x41
	[0131.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.444] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.444] GetFileType (hFile=0x5dc) returned 0x1
	[0131.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.444] GetFileType (hFile=0x5dc) returned 0x1
	[0131.444] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xf80
	[0131.445] ReadFile (in: hFile=0x5dc, lpBuffer=0x27a72f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a72f0*, lpNumberOfBytesRead=0x540efcc*=0xf80, lpOverlapped=0x0) returned 1
	[0131.446] CloseHandle (hObject=0x5dc) returned 1
	[0131.447] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0131.447] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.447] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a838c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0131.447] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.447] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.447] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0131.447] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.447] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27a8444*=0x1, dwFlags=0x0) returned 1
	[0131.447] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27a8410, dwFlags=0x0) returned 1
	[0131.447] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a8454*, pdwDataLen=0x540efd4*=0xf90, dwBufLen=0xf90 | out: pbData=0x27a8454*, pdwDataLen=0x540efd4*=0xf90) returned 1
	[0131.447] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a93f0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a93f0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.447] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0131.447] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.447] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.447] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", lpFilePart=0x0) returned 0x41
	[0131.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.447] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.449] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", lpFilePart=0x0) returned 0x46
	[0131.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.449] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), fInfoLevelId=0x0, lpFileInformation=0x27a99d0 | out: lpFileInformation=0x27a99d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31)) returned 1
	[0131.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.451] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", lpFilePart=0x0) returned 0x46
	[0131.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.451] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.451] GetFileType (hFile=0x5dc) returned 0x1
	[0131.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.451] GetFileType (hFile=0x5dc) returned 0x1
	[0131.451] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb31
	[0131.451] ReadFile (in: hFile=0x5dc, lpBuffer=0x27aa7a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27aa7a8*, lpNumberOfBytesRead=0x540efcc*=0xb31, lpOverlapped=0x0) returned 1
	[0131.453] CloseHandle (hObject=0x5dc) returned 1
	[0131.453] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0131.453] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.453] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ab844, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0131.453] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.453] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.453] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0131.453] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.453] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27ab8fc*=0x1, dwFlags=0x0) returned 1
	[0131.453] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27ab8c8, dwFlags=0x0) returned 1
	[0131.454] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ab90c*, pdwDataLen=0x540efd4*=0xb40, dwBufLen=0xb40 | out: pbData=0x27ab90c*, pdwDataLen=0x540efd4*=0xb40) returned 1
	[0131.454] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ac458*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27ac458*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.454] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0131.454] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.454] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.454] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", lpFilePart=0x0) returned 0x46
	[0131.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.454] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.456] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", lpFilePart=0x0) returned 0x46
	[0131.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.456] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), fInfoLevelId=0x0, lpFileInformation=0x27aca70 | out: lpFileInformation=0x27aca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31)) returned 1
	[0131.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.457] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", lpFilePart=0x0) returned 0x46
	[0131.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.457] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.457] GetFileType (hFile=0x5dc) returned 0x1
	[0131.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.457] GetFileType (hFile=0x5dc) returned 0x1
	[0131.457] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb31
	[0131.457] ReadFile (in: hFile=0x5dc, lpBuffer=0x27ad848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27ad848*, lpNumberOfBytesRead=0x540efcc*=0xb31, lpOverlapped=0x0) returned 1
	[0131.462] CloseHandle (hObject=0x5dc) returned 1
	[0131.462] CryptDestroyKey (hKey=0x82b280) returned 1
	[0131.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.462] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ae8e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0131.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.463] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0131.463] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.463] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27ae99c*=0x1, dwFlags=0x0) returned 1
	[0131.463] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27ae968, dwFlags=0x0) returned 1
	[0131.463] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ae9ac*, pdwDataLen=0x540efd4*=0xb40, dwBufLen=0xb40 | out: pbData=0x27ae9ac*, pdwDataLen=0x540efd4*=0xb40) returned 1
	[0131.463] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27af4f8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27af4f8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.463] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0131.463] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.463] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.463] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", lpFilePart=0x0) returned 0x46
	[0131.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.463] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", lpFilePart=0x0) returned 0x40
	[0131.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.465] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), fInfoLevelId=0x0, lpFileInformation=0x27afb10 | out: lpFileInformation=0x27afb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd)) returned 1
	[0131.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", lpFilePart=0x0) returned 0x40
	[0131.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.466] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.466] GetFileType (hFile=0x5dc) returned 0x1
	[0131.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.466] GetFileType (hFile=0x5dc) returned 0x1
	[0131.466] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3bd
	[0131.466] ReadFile (in: hFile=0x5dc, lpBuffer=0x27b0144, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b0144*, lpNumberOfBytesRead=0x540efcc*=0x3bd, lpOverlapped=0x0) returned 1
	[0131.494] CloseHandle (hObject=0x5dc) returned 1
	[0131.494] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0131.494] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.495] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b11e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0131.495] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.495] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.495] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0131.495] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.495] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27b1298*=0x1, dwFlags=0x0) returned 1
	[0131.495] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27b1264, dwFlags=0x0) returned 1
	[0131.495] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b12a8*, pdwDataLen=0x540efd4*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x27b12a8*, pdwDataLen=0x540efd4*=0x3c0) returned 1
	[0131.495] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b1674*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b1674*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.495] CryptDestroyKey (hKey=0x82b540) returned 1
	[0131.495] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.495] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.495] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", lpFilePart=0x0) returned 0x40
	[0131.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.495] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.497] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", lpFilePart=0x0) returned 0x48
	[0131.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.497] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), fInfoLevelId=0x0, lpFileInformation=0x27b1c50 | out: lpFileInformation=0x27b1c50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51)) returned 1
	[0131.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.499] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", lpFilePart=0x0) returned 0x48
	[0131.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.499] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.499] GetFileType (hFile=0x5dc) returned 0x1
	[0131.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.499] GetFileType (hFile=0x5dc) returned 0x1
	[0131.499] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x11c51
	[0131.499] ReadFile (in: hFile=0x5dc, lpBuffer=0x27b1ef8, nNumberOfBytesToRead=0x11c51, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b1ef8*, lpNumberOfBytesRead=0x540efcc*=0x11c51, lpOverlapped=0x0) returned 1
	[0131.515] CloseHandle (hObject=0x5dc) returned 1
	[0131.515] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0131.515] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.516] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c3be8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0131.516] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.516] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.516] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0131.516] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.516] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27c3ca0*=0x1, dwFlags=0x0) returned 1
	[0131.516] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27c3c6c, dwFlags=0x0) returned 1
	[0131.516] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c3cb0*, pdwDataLen=0x540efd4*=0x11c60, dwBufLen=0x11c60 | out: pbData=0x27c3cb0*, pdwDataLen=0x540efd4*=0x11c60) returned 1
	[0131.516] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d591c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27d591c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.516] CryptDestroyKey (hKey=0x82b300) returned 1
	[0131.516] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.516] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.516] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", lpFilePart=0x0) returned 0x48
	[0131.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.517] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.519] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", lpFilePart=0x0) returned 0x48
	[0131.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.519] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), fInfoLevelId=0x0, lpFileInformation=0x27d5f48 | out: lpFileInformation=0x27d5f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51)) returned 1
	[0131.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", lpFilePart=0x0) returned 0x48
	[0131.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.525] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.525] GetFileType (hFile=0x5dc) returned 0x1
	[0131.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.525] GetFileType (hFile=0x5dc) returned 0x1
	[0131.525] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x11c51
	[0131.525] ReadFile (in: hFile=0x5dc, lpBuffer=0x27d61f0, nNumberOfBytesToRead=0x11c51, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27d61f0*, lpNumberOfBytesRead=0x540efcc*=0x11c51, lpOverlapped=0x0) returned 1
	[0131.537] CloseHandle (hObject=0x5dc) returned 1
	[0131.538] CryptDestroyKey (hKey=0x82b400) returned 1
	[0131.538] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.538] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e7ee0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0131.538] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.538] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.538] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0131.538] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.538] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27e7f98*=0x1, dwFlags=0x0) returned 1
	[0131.538] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27e7f64, dwFlags=0x0) returned 1
	[0131.538] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e7fa8*, pdwDataLen=0x540efd4*=0x11c60, dwBufLen=0x11c60 | out: pbData=0x27e7fa8*, pdwDataLen=0x540efd4*=0x11c60) returned 1
	[0131.538] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f9c14*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f9c14*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.539] CryptDestroyKey (hKey=0x82b280) returned 1
	[0131.539] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.539] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.539] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", lpFilePart=0x0) returned 0x48
	[0131.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.539] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.542] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", lpFilePart=0x0) returned 0x4e
	[0131.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.542] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), fInfoLevelId=0x0, lpFileInformation=0x27fa240 | out: lpFileInformation=0x27fa240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368)) returned 1
	[0131.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.543] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", lpFilePart=0x0) returned 0x4e
	[0131.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.543] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.543] GetFileType (hFile=0x5dc) returned 0x1
	[0131.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.543] GetFileType (hFile=0x5dc) returned 0x1
	[0131.543] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3368
	[0131.543] ReadFile (in: hFile=0x5dc, lpBuffer=0x27fa518, nNumberOfBytesToRead=0x3368, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27fa518*, lpNumberOfBytesRead=0x540efcc*=0x3368, lpOverlapped=0x0) returned 1
	[0131.584] CloseHandle (hObject=0x5dc) returned 1
	[0131.585] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0131.585] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.585] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fd91c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0131.585] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.585] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.585] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0131.585] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.585] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x27fd9d4*=0x1, dwFlags=0x0) returned 1
	[0131.585] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x27fd9a0, dwFlags=0x0) returned 1
	[0131.585] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27fd9e4*, pdwDataLen=0x540efd4*=0x3370, dwBufLen=0x3370 | out: pbData=0x27fd9e4*, pdwDataLen=0x540efd4*=0x3370) returned 1
	[0131.585] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2800d60*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2800d60*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.585] CryptDestroyKey (hKey=0x82b040) returned 1
	[0131.585] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.585] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.585] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", lpFilePart=0x0) returned 0x4e
	[0131.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.586] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", lpFilePart=0x0) returned 0x4e
	[0131.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.588] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), fInfoLevelId=0x0, lpFileInformation=0x28013c8 | out: lpFileInformation=0x28013c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368)) returned 1
	[0131.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", lpFilePart=0x0) returned 0x4e
	[0131.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.589] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.589] GetFileType (hFile=0x5dc) returned 0x1
	[0131.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.589] GetFileType (hFile=0x5dc) returned 0x1
	[0131.589] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3368
	[0131.590] ReadFile (in: hFile=0x5dc, lpBuffer=0x28016a0, nNumberOfBytesToRead=0x3368, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x28016a0*, lpNumberOfBytesRead=0x540efcc*=0x3368, lpOverlapped=0x0) returned 1
	[0131.617] CloseHandle (hObject=0x5dc) returned 1
	[0131.618] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0131.618] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.618] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2804aa4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0131.618] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.618] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.618] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0131.619] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.619] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2804b5c*=0x1, dwFlags=0x0) returned 1
	[0131.620] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2804b28, dwFlags=0x0) returned 1
	[0131.620] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2804b6c*, pdwDataLen=0x540efd4*=0x3370, dwBufLen=0x3370 | out: pbData=0x2804b6c*, pdwDataLen=0x540efd4*=0x3370) returned 1
	[0131.620] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2807ee8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2807ee8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.620] CryptDestroyKey (hKey=0x82b280) returned 1
	[0131.620] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.620] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.620] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", lpFilePart=0x0) returned 0x4e
	[0131.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.621] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.623] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", lpFilePart=0x0) returned 0x51
	[0131.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.623] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), fInfoLevelId=0x0, lpFileInformation=0x2808550 | out: lpFileInformation=0x2808550*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964)) returned 1
	[0131.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.624] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", lpFilePart=0x0) returned 0x51
	[0131.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.625] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.625] GetFileType (hFile=0x5dc) returned 0x1
	[0131.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.626] GetFileType (hFile=0x5dc) returned 0x1
	[0131.626] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2964
	[0131.626] ReadFile (in: hFile=0x5dc, lpBuffer=0x2808838, nNumberOfBytesToRead=0x2964, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2808838*, lpNumberOfBytesRead=0x540efcc*=0x2964, lpOverlapped=0x0) returned 1
	[0131.666] CloseHandle (hObject=0x5dc) returned 1
	[0131.666] CryptDestroyKey (hKey=0x82b100) returned 1
	[0131.666] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.666] CryptImportKey (in: hProv=0x7f93c0, pbData=0x280b238, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0131.666] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.666] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.666] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0131.666] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.666] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x280b2f0*=0x1, dwFlags=0x0) returned 1
	[0131.666] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x280b2bc, dwFlags=0x0) returned 1
	[0131.666] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x280b300*, pdwDataLen=0x540efd4*=0x2970, dwBufLen=0x2970 | out: pbData=0x280b300*, pdwDataLen=0x540efd4*=0x2970) returned 1
	[0131.667] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x280dc7c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x280dc7c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.667] CryptDestroyKey (hKey=0x82b080) returned 1
	[0131.667] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.667] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", lpFilePart=0x0) returned 0x51
	[0131.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.667] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.669] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", lpFilePart=0x0) returned 0x51
	[0131.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.670] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), fInfoLevelId=0x0, lpFileInformation=0x280e2fc | out: lpFileInformation=0x280e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964)) returned 1
	[0131.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.671] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", lpFilePart=0x0) returned 0x51
	[0131.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.671] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.671] GetFileType (hFile=0x5dc) returned 0x1
	[0131.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.672] GetFileType (hFile=0x5dc) returned 0x1
	[0131.672] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2964
	[0131.672] ReadFile (in: hFile=0x5dc, lpBuffer=0x280e5e4, nNumberOfBytesToRead=0x2964, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x280e5e4*, lpNumberOfBytesRead=0x540efcc*=0x2964, lpOverlapped=0x0) returned 1
	[0131.877] CloseHandle (hObject=0x5dc) returned 1
	[0131.878] CryptDestroyKey (hKey=0x82b480) returned 1
	[0131.878] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.878] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2810fe4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0131.878] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.878] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.878] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0131.878] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.878] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x281109c*=0x1, dwFlags=0x0) returned 1
	[0131.878] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2811068, dwFlags=0x0) returned 1
	[0131.878] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28110ac*, pdwDataLen=0x540efd4*=0x2970, dwBufLen=0x2970 | out: pbData=0x28110ac*, pdwDataLen=0x540efd4*=0x2970) returned 1
	[0131.878] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2813a28*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2813a28*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.879] CryptDestroyKey (hKey=0x82b280) returned 1
	[0131.879] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.879] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.879] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", lpFilePart=0x0) returned 0x51
	[0131.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.879] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", lpFilePart=0x0) returned 0x48
	[0131.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.881] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), fInfoLevelId=0x0, lpFileInformation=0x28140a8 | out: lpFileInformation=0x28140a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f)) returned 1
	[0131.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.882] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", lpFilePart=0x0) returned 0x48
	[0131.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.882] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.882] GetFileType (hFile=0x5dc) returned 0x1
	[0131.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.882] GetFileType (hFile=0x5dc) returned 0x1
	[0131.882] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10b0f
	[0131.882] ReadFile (in: hFile=0x5dc, lpBuffer=0x2814350, nNumberOfBytesToRead=0x10b0f, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2814350*, lpNumberOfBytesRead=0x540efcc*=0x10b0f, lpOverlapped=0x0) returned 1
	[0131.886] CloseHandle (hObject=0x5dc) returned 1
	[0131.886] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0131.887] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.887] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2824efc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0131.887] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.887] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.887] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0131.887] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.887] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2824fb4*=0x1, dwFlags=0x0) returned 1
	[0131.887] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2824f80, dwFlags=0x0) returned 1
	[0131.887] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2824fc4*, pdwDataLen=0x540efd4*=0x10b10, dwBufLen=0x10b10 | out: pbData=0x2824fc4*, pdwDataLen=0x540efd4*=0x10b10) returned 1
	[0131.887] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2835ae0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2835ae0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.887] CryptDestroyKey (hKey=0x82b280) returned 1
	[0131.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.888] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", lpFilePart=0x0) returned 0x48
	[0131.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.888] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.890] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", lpFilePart=0x0) returned 0x48
	[0131.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.890] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), fInfoLevelId=0x0, lpFileInformation=0x283610c | out: lpFileInformation=0x283610c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f)) returned 1
	[0131.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", lpFilePart=0x0) returned 0x48
	[0131.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.891] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.891] GetFileType (hFile=0x5dc) returned 0x1
	[0131.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.891] GetFileType (hFile=0x5dc) returned 0x1
	[0131.891] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10b0f
	[0131.899] ReadFile (in: hFile=0x5dc, lpBuffer=0x262e01c, nNumberOfBytesToRead=0x10b0f, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x262e01c*, lpNumberOfBytesRead=0x540efcc*=0x10b0f, lpOverlapped=0x0) returned 1
	[0131.973] CloseHandle (hObject=0x5dc) returned 1
	[0131.973] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0131.973] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.973] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263ebc8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0131.973] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.973] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.973] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0131.974] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0131.974] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x263ec80*=0x1, dwFlags=0x0) returned 1
	[0131.974] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x263ec4c, dwFlags=0x0) returned 1
	[0131.974] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263ec90*, pdwDataLen=0x540efd4*=0x10b10, dwBufLen=0x10b10 | out: pbData=0x263ec90*, pdwDataLen=0x540efd4*=0x10b10) returned 1
	[0131.974] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264f7ac*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x264f7ac*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0131.974] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0131.974] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.974] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0131.974] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", lpFilePart=0x0) returned 0x48
	[0131.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0131.974] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0131.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0131.976] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", lpFilePart=0x0) returned 0x4e
	[0131.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0131.976] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), fInfoLevelId=0x0, lpFileInformation=0x264fdd8 | out: lpFileInformation=0x264fdd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368)) returned 1
	[0131.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0131.976] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", lpFilePart=0x0) returned 0x4e
	[0131.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0131.976] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0131.976] GetFileType (hFile=0x5dc) returned 0x1
	[0131.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0131.976] GetFileType (hFile=0x5dc) returned 0x1
	[0131.976] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3368
	[0131.976] ReadFile (in: hFile=0x5dc, lpBuffer=0x26500b0, nNumberOfBytesToRead=0x3368, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26500b0*, lpNumberOfBytesRead=0x540efcc*=0x3368, lpOverlapped=0x0) returned 1
	[0132.014] CloseHandle (hObject=0x5dc) returned 1
	[0132.014] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0132.014] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0132.014] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26534b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0132.014] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0132.015] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0132.015] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0132.015] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0132.015] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x265356c*=0x1, dwFlags=0x0) returned 1
	[0132.015] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2653538, dwFlags=0x0) returned 1
	[0132.015] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265357c*, pdwDataLen=0x540efd4*=0x3370, dwBufLen=0x3370 | out: pbData=0x265357c*, pdwDataLen=0x540efd4*=0x3370) returned 1
	[0132.015] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26568f8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26568f8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0132.015] CryptDestroyKey (hKey=0x82b200) returned 1
	[0132.015] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0132.015] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0132.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", lpFilePart=0x0) returned 0x4e
	[0132.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0132.015] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0132.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0132.017] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", lpFilePart=0x0) returned 0x4e
	[0132.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0132.017] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), fInfoLevelId=0x0, lpFileInformation=0x2656f60 | out: lpFileInformation=0x2656f60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368)) returned 1
	[0132.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0132.035] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", lpFilePart=0x0) returned 0x4e
	[0132.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0132.035] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0132.035] GetFileType (hFile=0x5dc) returned 0x1
	[0132.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0132.035] GetFileType (hFile=0x5dc) returned 0x1
	[0132.035] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3368
	[0132.035] ReadFile (in: hFile=0x5dc, lpBuffer=0x2657238, nNumberOfBytesToRead=0x3368, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2657238*, lpNumberOfBytesRead=0x540efcc*=0x3368, lpOverlapped=0x0) returned 1
	[0132.092] CloseHandle (hObject=0x5dc) returned 1
	[0132.092] CryptDestroyKey (hKey=0x82b040) returned 1
	[0132.092] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0132.092] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265a63c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0132.092] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0132.092] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0132.093] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0132.093] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0132.093] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x265a6f4*=0x1, dwFlags=0x0) returned 1
	[0132.093] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x265a6c0, dwFlags=0x0) returned 1
	[0132.093] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265a704*, pdwDataLen=0x540efd4*=0x3370, dwBufLen=0x3370 | out: pbData=0x265a704*, pdwDataLen=0x540efd4*=0x3370) returned 1
	[0132.093] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265da80*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x265da80*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0132.093] CryptDestroyKey (hKey=0x82b480) returned 1
	[0132.093] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0132.093] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0132.093] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", lpFilePart=0x0) returned 0x4e
	[0132.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0132.093] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0132.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0132.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", lpFilePart=0x0) returned 0x48
	[0132.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0132.095] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), fInfoLevelId=0x0, lpFileInformation=0x265e0e8 | out: lpFileInformation=0x265e0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c3)) returned 1
	[0132.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0132.096] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", lpFilePart=0x0) returned 0x48
	[0132.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0132.096] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0132.096] GetFileType (hFile=0x5dc) returned 0x1
	[0132.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0132.096] GetFileType (hFile=0x5dc) returned 0x1
	[0132.096] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x100c3
	[0132.096] ReadFile (in: hFile=0x5dc, lpBuffer=0x265e390, nNumberOfBytesToRead=0x100c3, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x265e390*, lpNumberOfBytesRead=0x540efcc*=0x100c3, lpOverlapped=0x0) returned 1
	[0132.133] CloseHandle (hObject=0x5dc) returned 1
	[0132.133] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0132.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0132.133] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266e4f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0132.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0132.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0132.133] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0132.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0132.133] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x266e5a8*=0x1, dwFlags=0x0) returned 1
	[0132.134] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x266e574, dwFlags=0x0) returned 1
	[0132.134] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266e5b8*, pdwDataLen=0x540efd4*=0x100d0, dwBufLen=0x100d0 | out: pbData=0x266e5b8*, pdwDataLen=0x540efd4*=0x100d0) returned 1
	[0132.134] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267e694*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x267e694*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0132.134] CryptDestroyKey (hKey=0x82b380) returned 1
	[0132.134] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0132.134] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0132.134] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", lpFilePart=0x0) returned 0x48
	[0132.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0132.135] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0132.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0132.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", lpFilePart=0x0) returned 0x48
	[0132.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0132.137] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), fInfoLevelId=0x0, lpFileInformation=0x267ecc0 | out: lpFileInformation=0x267ecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c6)) returned 1
	[0132.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0132.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", lpFilePart=0x0) returned 0x48
	[0132.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0132.137] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0132.138] GetFileType (hFile=0x5dc) returned 0x1
	[0132.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0132.138] GetFileType (hFile=0x5dc) returned 0x1
	[0132.138] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x100c6
	[0132.138] ReadFile (in: hFile=0x5dc, lpBuffer=0x267ef68, nNumberOfBytesToRead=0x100c6, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x267ef68*, lpNumberOfBytesRead=0x540efcc*=0x100c6, lpOverlapped=0x0) returned 1
	[0132.191] CloseHandle (hObject=0x5dc) returned 1
	[0132.191] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0132.191] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0132.191] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268f0cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0132.191] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0132.191] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0132.191] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0132.191] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0132.191] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x268f184*=0x1, dwFlags=0x0) returned 1
	[0132.191] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x268f150, dwFlags=0x0) returned 1
	[0132.192] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268f194*, pdwDataLen=0x540efd4*=0x100d0, dwBufLen=0x100d0 | out: pbData=0x268f194*, pdwDataLen=0x540efd4*=0x100d0) returned 1
	[0132.192] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269f270*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x269f270*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0132.192] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0132.192] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0132.192] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0132.192] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", lpFilePart=0x0) returned 0x48
	[0132.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0132.192] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0132.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0132.194] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", lpFilePart=0x0) returned 0x4b
	[0132.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0132.194] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), fInfoLevelId=0x0, lpFileInformation=0x269f89c | out: lpFileInformation=0x269f89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506)) returned 1
	[0132.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0132.195] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", lpFilePart=0x0) returned 0x4b
	[0132.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0132.195] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0132.195] GetFileType (hFile=0x5dc) returned 0x1
	[0132.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0132.195] GetFileType (hFile=0x5dc) returned 0x1
	[0132.195] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x506
	[0132.195] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a0068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a0068*, lpNumberOfBytesRead=0x540efcc*=0x506, lpOverlapped=0x0) returned 1
	[0133.108] CloseHandle (hObject=0x5dc) returned 1
	[0133.108] CryptDestroyKey (hKey=0x82b280) returned 1
	[0133.108] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.109] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a1104, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0133.109] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.109] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.109] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0133.109] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.109] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26a11bc*=0x1, dwFlags=0x0) returned 1
	[0133.109] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x26a1188, dwFlags=0x0) returned 1
	[0133.109] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a11cc*, pdwDataLen=0x540efd4*=0x510, dwBufLen=0x510 | out: pbData=0x26a11cc*, pdwDataLen=0x540efd4*=0x510) returned 1
	[0133.109] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a16e8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a16e8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0133.109] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0133.109] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.109] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.109] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", lpFilePart=0x0) returned 0x4b
	[0133.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0133.109] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0133.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0133.111] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", lpFilePart=0x0) returned 0x4b
	[0133.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0133.111] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), fInfoLevelId=0x0, lpFileInformation=0x26a1d2c | out: lpFileInformation=0x26a1d2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506)) returned 1
	[0133.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0133.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", lpFilePart=0x0) returned 0x4b
	[0133.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0133.113] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0133.113] GetFileType (hFile=0x5dc) returned 0x1
	[0133.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0133.114] GetFileType (hFile=0x5dc) returned 0x1
	[0133.114] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x506
	[0133.114] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a24f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a24f8*, lpNumberOfBytesRead=0x540efcc*=0x506, lpOverlapped=0x0) returned 1
	[0133.207] CloseHandle (hObject=0x5dc) returned 1
	[0133.207] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0133.207] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.207] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a3594, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0133.207] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.207] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.207] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0133.207] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.207] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26a364c*=0x1, dwFlags=0x0) returned 1
	[0133.207] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26a3618, dwFlags=0x0) returned 1
	[0133.208] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a365c*, pdwDataLen=0x540efd4*=0x510, dwBufLen=0x510 | out: pbData=0x26a365c*, pdwDataLen=0x540efd4*=0x510) returned 1
	[0133.208] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a3b78*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a3b78*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0133.208] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0133.208] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.208] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.208] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", lpFilePart=0x0) returned 0x4b
	[0133.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0133.208] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0133.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0133.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", lpFilePart=0x0) returned 0x4b
	[0133.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0133.245] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), fInfoLevelId=0x0, lpFileInformation=0x26a41bc | out: lpFileInformation=0x26a41bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509)) returned 1
	[0133.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0133.246] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", lpFilePart=0x0) returned 0x4b
	[0133.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0133.246] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0133.246] GetFileType (hFile=0x5dc) returned 0x1
	[0133.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0133.246] GetFileType (hFile=0x5dc) returned 0x1
	[0133.246] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x509
	[0133.247] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a498c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a498c*, lpNumberOfBytesRead=0x540efcc*=0x509, lpOverlapped=0x0) returned 1
	[0133.316] CloseHandle (hObject=0x5dc) returned 1
	[0133.316] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0133.316] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.316] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a5a28, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0133.316] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.316] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.316] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0133.316] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.316] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26a5ae0*=0x1, dwFlags=0x0) returned 1
	[0133.316] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x26a5aac, dwFlags=0x0) returned 1
	[0133.316] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a5af0*, pdwDataLen=0x540efd4*=0x510, dwBufLen=0x510 | out: pbData=0x26a5af0*, pdwDataLen=0x540efd4*=0x510) returned 1
	[0133.316] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a600c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a600c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0133.316] CryptDestroyKey (hKey=0x82b380) returned 1
	[0133.316] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.316] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", lpFilePart=0x0) returned 0x4b
	[0133.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0133.317] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0133.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0133.318] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", lpFilePart=0x0) returned 0x4b
	[0133.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0133.319] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), fInfoLevelId=0x0, lpFileInformation=0x26a6650 | out: lpFileInformation=0x26a6650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509)) returned 1
	[0133.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0133.319] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", lpFilePart=0x0) returned 0x4b
	[0133.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0133.319] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0133.319] GetFileType (hFile=0x5dc) returned 0x1
	[0133.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0133.320] GetFileType (hFile=0x5dc) returned 0x1
	[0133.320] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x509
	[0133.320] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a6e20*, lpNumberOfBytesRead=0x540efcc*=0x509, lpOverlapped=0x0) returned 1
	[0133.381] CloseHandle (hObject=0x5dc) returned 1
	[0133.381] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0133.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.381] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a7ebc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0133.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.382] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.382] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0133.382] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.382] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26a7f74*=0x1, dwFlags=0x0) returned 1
	[0133.382] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26a7f40, dwFlags=0x0) returned 1
	[0133.382] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a7f84*, pdwDataLen=0x540efd4*=0x510, dwBufLen=0x510 | out: pbData=0x26a7f84*, pdwDataLen=0x540efd4*=0x510) returned 1
	[0133.382] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a84a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a84a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0133.382] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0133.382] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.382] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.382] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", lpFilePart=0x0) returned 0x4b
	[0133.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0133.382] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0133.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0133.385] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", lpFilePart=0x0) returned 0x52
	[0133.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0133.385] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), fInfoLevelId=0x0, lpFileInformation=0x26a8ae4 | out: lpFileInformation=0x26a8ae4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b)) returned 1
	[0133.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0135.659] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0135.791] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0135.905] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0135.983] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0136.089] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0136.211] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0136.397] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0136.487] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0136.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0136.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0136.940] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0136.987] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.049] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.126] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.179] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.218] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.612] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.646] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.692] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.752] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.790] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.834] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.884] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.927] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0137.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.002] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.049] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.189] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.241] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.429] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.471] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.517] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.611] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.661] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.705] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.752] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.799] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.845] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0138.987] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0139.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.147] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe", lpFilePart=0x0) returned 0x2c
	[0155.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.147] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0155.147] GetFileType (hFile=0x5dc) returned 0x1
	[0155.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0155.148] GetFileType (hFile=0x5dc) returned 0x1
	[0155.148] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x32840
	[0155.148] ReadFile (in: hFile=0x5dc, lpBuffer=0x8e6aa18, nNumberOfBytesToRead=0x32840, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x8e6aa18*, lpNumberOfBytesRead=0x540efcc*=0x32840, lpOverlapped=0x0) returned 1
	[0155.167] CloseHandle (hObject=0x5dc) returned 1
	[0155.167] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0155.167] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.167] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26df090, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0155.167] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.167] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.167] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0155.167] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.168] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26df148*=0x1, dwFlags=0x0) returned 1
	[0155.168] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26df114, dwFlags=0x0) returned 1
	[0155.169] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8f3ca98*, pdwDataLen=0x540efd4*=0x32850, dwBufLen=0x32850 | out: pbData=0x8f3ca98*, pdwDataLen=0x540efd4*=0x32850) returned 1
	[0155.169] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26df158*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26df158*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0155.169] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0155.169] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.169] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.169] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe", lpFilePart=0x0) returned 0x2c
	[0155.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0155.169] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\java.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0155.172] GetFileType (hFile=0x5dc) returned 0x1
	[0155.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0155.172] GetFileType (hFile=0x5dc) returned 0x1
	[0155.172] WriteFile (in: hFile=0x5dc, lpBuffer=0x8f3ca98*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x8f3ca98*, lpNumberOfBytesWritten=0x540efc0*=0x32850, lpOverlapped=0x0) returned 1
	[0155.176] CloseHandle (hObject=0x5dc) returned 1
	[0155.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe", lpFilePart=0x0) returned 0x2c
	[0155.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0155.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0155.176] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\java.exe"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x96d21e8b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x32850)) returned 1
	[0155.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0155.176] MoveFileW (lpExistingFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\java.exe"), lpNewFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\oracle\\java\\javapath\\java.exe id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0155.179] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe", lpFilePart=0x0) returned 0x2d
	[0155.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.179] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\javaw.exe"), fInfoLevelId=0x0, lpFileInformation=0x26df4d4 | out: lpFileInformation=0x26df4d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840)) returned 1
	[0155.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.180] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe", lpFilePart=0x0) returned 0x2d
	[0155.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.180] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.181] GetFileType (hFile=0x47c) returned 0x1
	[0155.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0155.181] GetFileType (hFile=0x47c) returned 0x1
	[0155.181] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x32840
	[0155.181] ReadFile (in: hFile=0x47c, lpBuffer=0x8f6f308, nNumberOfBytesToRead=0x32840, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x8f6f308*, lpNumberOfBytesRead=0x540efcc*=0x32840, lpOverlapped=0x0) returned 1
	[0155.203] CloseHandle (hObject=0x47c) returned 1
	[0155.203] CryptDestroyKey (hKey=0x82b400) returned 1
	[0155.203] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.203] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26df74c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0155.203] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.204] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0155.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.204] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26df804*=0x1, dwFlags=0x0) returned 1
	[0155.204] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26df7d0, dwFlags=0x0) returned 1
	[0155.205] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8fa1b68*, pdwDataLen=0x540efd4*=0x32850, dwBufLen=0x32850 | out: pbData=0x8fa1b68*, pdwDataLen=0x540efd4*=0x32850) returned 1
	[0155.205] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26df814*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26df814*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0155.205] CryptDestroyKey (hKey=0x82b440) returned 1
	[0155.205] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.205] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.205] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe", lpFilePart=0x0) returned 0x2d
	[0155.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0155.206] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\javaw.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.208] GetFileType (hFile=0x47c) returned 0x1
	[0155.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0155.208] GetFileType (hFile=0x47c) returned 0x1
	[0155.208] WriteFile (in: hFile=0x47c, lpBuffer=0x8fa1b68*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x8fa1b68*, lpNumberOfBytesWritten=0x540efc0*=0x32850, lpOverlapped=0x0) returned 1
	[0155.212] CloseHandle (hObject=0x47c) returned 1
	[0155.213] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe", lpFilePart=0x0) returned 0x2d
	[0155.213] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0155.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0155.214] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\javaw.exe"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x96d6e4a0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x32850)) returned 1
	[0155.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0155.214] MoveFileW (lpExistingFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\javaw.exe"), lpNewFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaw.exe id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\oracle\\java\\javapath\\javaw.exe id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0155.215] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe", lpFilePart=0x0) returned 0x2e
	[0155.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.215] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\javaws.exe"), fInfoLevelId=0x0, lpFileInformation=0x26dfb9c | out: lpFileInformation=0x26dfb9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040)) returned 1
	[0155.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.215] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe", lpFilePart=0x0) returned 0x2e
	[0155.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.215] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.215] GetFileType (hFile=0x47c) returned 0x1
	[0155.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0155.215] GetFileType (hFile=0x47c) returned 0x1
	[0155.216] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x4e040
	[0155.216] ReadFile (in: hFile=0x47c, lpBuffer=0x8fd43d8, nNumberOfBytesToRead=0x4e040, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x8fd43d8*, lpNumberOfBytesRead=0x540efcc*=0x4e040, lpOverlapped=0x0) returned 1
	[0155.262] CloseHandle (hObject=0x47c) returned 1
	[0155.262] CryptDestroyKey (hKey=0x82b540) returned 1
	[0155.263] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.263] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e0014, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0155.263] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.263] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.263] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0155.263] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.263] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26e00cc*=0x1, dwFlags=0x0) returned 1
	[0155.263] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26e0098, dwFlags=0x0) returned 1
	[0155.264] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9022438*, pdwDataLen=0x540efd4*=0x4e050, dwBufLen=0x4e050 | out: pbData=0x9022438*, pdwDataLen=0x540efd4*=0x4e050) returned 1
	[0155.265] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e00dc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e00dc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0155.265] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0155.265] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.265] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.265] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe", lpFilePart=0x0) returned 0x2e
	[0155.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0155.265] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\javaws.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.268] GetFileType (hFile=0x47c) returned 0x1
	[0155.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0155.268] GetFileType (hFile=0x47c) returned 0x1
	[0155.268] WriteFile (in: hFile=0x47c, lpBuffer=0x9022438*, nNumberOfBytesToWrite=0x4e050, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x9022438*, lpNumberOfBytesWritten=0x540efc0*=0x4e050, lpOverlapped=0x0) returned 1
	[0155.273] CloseHandle (hObject=0x47c) returned 1
	[0155.273] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe", lpFilePart=0x0) returned 0x2e
	[0155.273] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0155.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0155.273] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\javaws.exe"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x96e07277, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4e050)) returned 1
	[0155.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0155.274] MoveFileW (lpExistingFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\javaws.exe"), lpNewFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\javaws.exe id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\oracle\\java\\javapath\\javaws.exe id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0155.274] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\java.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\java.exe", lpFilePart=0x0) returned 0x3a
	[0155.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.274] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\java.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath_target_474984\\java.exe"), fInfoLevelId=0x0, lpFileInformation=0x26e0470 | out: lpFileInformation=0x26e0470*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.275] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\javaw.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\javaw.exe", lpFilePart=0x0) returned 0x3b
	[0155.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.276] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\javaw.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath_target_474984\\javaw.exe"), fInfoLevelId=0x0, lpFileInformation=0x26e07d0 | out: lpFileInformation=0x26e07d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.282] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\javaws.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\javaws.exe", lpFilePart=0x0) returned 0x3c
	[0155.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.282] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\javaws.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath_target_474984\\javaws.exe"), fInfoLevelId=0x0, lpFileInformation=0x26e0b34 | out: lpFileInformation=0x26e0b34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.284] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", lpFilePart=0x0) returned 0x3e
	[0155.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.284] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml"), fInfoLevelId=0x0, lpFileInformation=0x26e0ea0 | out: lpFileInformation=0x26e0ea0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.285] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", lpFilePart=0x0) returned 0x3e
	[0155.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.285] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml"), fInfoLevelId=0x0, lpFileInformation=0x26e122c | out: lpFileInformation=0x26e122c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.286] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", lpFilePart=0x0) returned 0x3e
	[0155.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.286] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml"), fInfoLevelId=0x0, lpFileInformation=0x26e15b8 | out: lpFileInformation=0x26e15b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.287] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs", lpFilePart=0x0) returned 0x3e
	[0155.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.287] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_costdeferred.rbs"), fInfoLevelId=0x0, lpFileInformation=0x26e1944 | out: lpFileInformation=0x26e1944*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666)) returned 1
	[0155.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.288] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs", lpFilePart=0x0) returned 0x3e
	[0155.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.288] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_costdeferred.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0155.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0155.289] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs", lpFilePart=0x0) returned 0x38
	[0155.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.289] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_normal.rbs"), fInfoLevelId=0x0, lpFileInformation=0x26e203c | out: lpFileInformation=0x26e203c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b5e567a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b5e567a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x1000000)) returned 1
	[0155.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.290] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs", lpFilePart=0x0) returned 0x38
	[0155.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.290] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_normal.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0155.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0155.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs", lpFilePart=0x0) returned 0x40
	[0155.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.291] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_normalcritical.rbs"), fInfoLevelId=0x0, lpFileInformation=0x26e26e0 | out: lpFileInformation=0x26e26e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666)) returned 1
	[0155.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs", lpFilePart=0x0) returned 0x40
	[0155.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.291] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_normalcritical.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0155.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0155.293] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs", lpFilePart=0x0) returned 0x3a
	[0155.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.293] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_realtime.rbs"), fInfoLevelId=0x0, lpFileInformation=0x26e2df4 | out: lpFileInformation=0x26e2df4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x333333)) returned 1
	[0155.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.293] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs", lpFilePart=0x0) returned 0x3a
	[0155.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.294] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_realtime.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0155.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0155.295] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt", lpFilePart=0x0) returned 0x30
	[0155.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.295] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt"), fInfoLevelId=0x0, lpFileInformation=0x26e34b4 | out: lpFileInformation=0x26e34b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa)) returned 1
	[0155.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.295] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt", lpFilePart=0x0) returned 0x30
	[0155.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.296] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0155.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0155.297] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat", lpFilePart=0x0) returned 0x30
	[0155.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.297] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat"), fInfoLevelId=0x0, lpFileInformation=0x26e3ae8 | out: lpFileInformation=0x26e3ae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0155.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.297] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat", lpFilePart=0x0) returned 0x30
	[0155.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.298] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0155.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0155.299] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat", lpFilePart=0x0) returned 0x3f
	[0155.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.299] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat"), fInfoLevelId=0x0, lpFileInformation=0x26e411c | out: lpFileInformation=0x26e411c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0155.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.299] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat", lpFilePart=0x0) returned 0x3f
	[0155.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.299] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0155.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d900) returned 1
	[0155.300] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL", lpFilePart=0x0) returned 0x2a
	[0155.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.301] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl"), fInfoLevelId=0x0, lpFileInformation=0x26e4820 | out: lpFileInformation=0x26e4820*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.302] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL", lpFilePart=0x0) returned 0x2b
	[0155.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.302] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl"), fInfoLevelId=0x0, lpFileInformation=0x26e4b44 | out: lpFileInformation=0x26e4b44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.303] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFilePart=0x0) returned 0x3b
	[0155.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.303] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), fInfoLevelId=0x0, lpFileInformation=0x26e4e6c | out: lpFileInformation=0x26e4e6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.305] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml", lpFilePart=0x0) returned 0x3a
	[0155.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.305] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml"), fInfoLevelId=0x0, lpFileInformation=0x26e51ec | out: lpFileInformation=0x26e51ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60aed0fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x60aed0fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x60aed0fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70bb)) returned 1
	[0155.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.305] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml", lpFilePart=0x0) returned 0x3a
	[0155.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.305] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.305] GetFileType (hFile=0x47c) returned 0x1
	[0155.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0155.305] GetFileType (hFile=0x47c) returned 0x1
	[0155.305] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x70bb
	[0155.306] ReadFile (in: hFile=0x47c, lpBuffer=0x26e542c, nNumberOfBytesToRead=0x70bb, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e542c*, lpNumberOfBytesRead=0x540efcc*=0x70bb, lpOverlapped=0x0) returned 1
	[0155.306] CloseHandle (hObject=0x47c) returned 1
	[0155.306] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0155.306] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.307] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ec584, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0155.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.307] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0155.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.307] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26ec63c*=0x1, dwFlags=0x0) returned 1
	[0155.307] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26ec608, dwFlags=0x0) returned 1
	[0155.358] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ec64c*, pdwDataLen=0x540efd4*=0x70c0, dwBufLen=0x70c0 | out: pbData=0x26ec64c*, pdwDataLen=0x540efd4*=0x70c0) returned 1
	[0155.358] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f3718*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f3718*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0155.358] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0155.358] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.358] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.358] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml", lpFilePart=0x0) returned 0x3a
	[0155.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0155.358] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0155.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0155.360] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat", lpFilePart=0x0) returned 0x44
	[0155.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.360] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storageeventsarchive.dat"), fInfoLevelId=0x0, lpFileInformation=0x26f3cbc | out: lpFileInformation=0x26f3cbc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.361] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat", lpFilePart=0x0) returned 0x42
	[0155.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.362] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat"), fInfoLevelId=0x0, lpFileInformation=0x26f4064 | out: lpFileInformation=0x26f4064*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f)) returned 1
	[0155.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.362] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat", lpFilePart=0x0) returned 0x42
	[0155.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.362] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.362] GetFileType (hFile=0x47c) returned 0x1
	[0155.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0155.362] GetFileType (hFile=0x47c) returned 0x1
	[0155.362] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1375f
	[0155.363] ReadFile (in: hFile=0x47c, lpBuffer=0x26f42dc, nNumberOfBytesToRead=0x1375f, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f42dc*, lpNumberOfBytesRead=0x540efcc*=0x1375f, lpOverlapped=0x0) returned 1
	[0155.363] CloseHandle (hObject=0x47c) returned 1
	[0155.363] CryptDestroyKey (hKey=0x82b100) returned 1
	[0155.363] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.364] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2707ad8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0155.364] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.364] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.364] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0155.364] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.364] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2707b90*=0x1, dwFlags=0x0) returned 1
	[0155.364] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2707b5c, dwFlags=0x0) returned 1
	[0155.364] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2707ba0*, pdwDataLen=0x540efd4*=0x13760, dwBufLen=0x13760 | out: pbData=0x2707ba0*, pdwDataLen=0x540efd4*=0x13760) returned 1
	[0155.364] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271b30c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271b30c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0155.364] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0155.364] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.364] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.364] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat", lpFilePart=0x0) returned 0x42
	[0155.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0155.364] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0155.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0155.366] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat", lpFilePart=0x0) returned 0x43
	[0155.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.366] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default user.dat"), fInfoLevelId=0x0, lpFileInformation=0x271b8fc | out: lpFileInformation=0x271b8fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.368] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat", lpFilePart=0x0) returned 0x3d
	[0155.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.368] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\fd1hvy.dat"), fInfoLevelId=0x0, lpFileInformation=0x271bc90 | out: lpFileInformation=0x271bc90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.369] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp", lpFilePart=0x0) returned 0x3c
	[0155.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.369] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp"), fInfoLevelId=0x0, lpFileInformation=0x271c000 | out: lpFileInformation=0x271c000*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.371] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png", lpFilePart=0x0) returned 0x3c
	[0155.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.371] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png"), fInfoLevelId=0x0, lpFileInformation=0x271c368 | out: lpFileInformation=0x271c368*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.372] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png", lpFilePart=0x0) returned 0x3f
	[0155.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.372] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png"), fInfoLevelId=0x0, lpFileInformation=0x271c6d0 | out: lpFileInformation=0x271c6d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.373] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png", lpFilePart=0x0) returned 0x3e
	[0155.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.373] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png"), fInfoLevelId=0x0, lpFileInformation=0x271ca4c | out: lpFileInformation=0x271ca4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.375] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png", lpFilePart=0x0) returned 0x3e
	[0155.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.375] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png"), fInfoLevelId=0x0, lpFileInformation=0x271cdc0 | out: lpFileInformation=0x271cdc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.376] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png", lpFilePart=0x0) returned 0x3e
	[0155.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.376] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png"), fInfoLevelId=0x0, lpFileInformation=0x271d134 | out: lpFileInformation=0x271d134*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.377] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp", lpFilePart=0x0) returned 0x3b
	[0155.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.377] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp"), fInfoLevelId=0x0, lpFileInformation=0x271d4a8 | out: lpFileInformation=0x271d4a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.379] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png", lpFilePart=0x0) returned 0x3b
	[0155.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.379] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png"), fInfoLevelId=0x0, lpFileInformation=0x271d80c | out: lpFileInformation=0x271d80c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.380] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini", lpFilePart=0x0) returned 0x38
	[0155.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini"), fInfoLevelId=0x0, lpFileInformation=0x271db70 | out: lpFileInformation=0x271db70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.381] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", lpFilePart=0x0) returned 0x51
	[0155.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.381] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x271ded0 | out: lpFileInformation=0x271ded0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.383] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", lpFilePart=0x0) returned 0x58
	[0155.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), fInfoLevelId=0x0, lpFileInformation=0x271e28c | out: lpFileInformation=0x271e28c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.384] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", lpFilePart=0x0) returned 0x51
	[0155.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x271e674 | out: lpFileInformation=0x271e674*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.385] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", lpFilePart=0x0) returned 0x58
	[0155.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.385] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), fInfoLevelId=0x0, lpFileInformation=0x271ea30 | out: lpFileInformation=0x271ea30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.387] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", lpFilePart=0x0) returned 0x51
	[0155.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x271ee18 | out: lpFileInformation=0x271ee18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.388] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", lpFilePart=0x0) returned 0x58
	[0155.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.388] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), fInfoLevelId=0x0, lpFileInformation=0x271f1d4 | out: lpFileInformation=0x271f1d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.389] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", lpFilePart=0x0) returned 0x51
	[0155.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.389] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x271f5bc | out: lpFileInformation=0x271f5bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.390] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", lpFilePart=0x0) returned 0x59
	[0155.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), fInfoLevelId=0x0, lpFileInformation=0x271f978 | out: lpFileInformation=0x271f978*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.391] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", lpFilePart=0x0) returned 0x51
	[0155.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x271fd64 | out: lpFileInformation=0x271fd64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.392] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", lpFilePart=0x0) returned 0x58
	[0155.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.393] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), fInfoLevelId=0x0, lpFileInformation=0x2720120 | out: lpFileInformation=0x2720120*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.394] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", lpFilePart=0x0) returned 0x51
	[0155.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.394] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x2720508 | out: lpFileInformation=0x2720508*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.395] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", lpFilePart=0x0) returned 0x59
	[0155.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), fInfoLevelId=0x0, lpFileInformation=0x27208c4 | out: lpFileInformation=0x27208c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.396] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", lpFilePart=0x0) returned 0x3c
	[0155.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.396] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2720cb0 | out: lpFileInformation=0x2720cb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.398] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", lpFilePart=0x0) returned 0x5d
	[0155.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), fInfoLevelId=0x0, lpFileInformation=0x272102c | out: lpFileInformation=0x272102c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.399] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl", lpFilePart=0x0) returned 0x38
	[0155.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.399] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl"), fInfoLevelId=0x0, lpFileInformation=0x272146c | out: lpFileInformation=0x272146c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.400] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl", lpFilePart=0x0) returned 0x38
	[0155.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.400] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl"), fInfoLevelId=0x0, lpFileInformation=0x27217e0 | out: lpFileInformation=0x27217e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl", lpFilePart=0x0) returned 0x3e
	[0155.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.558] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl"), fInfoLevelId=0x0, lpFileInformation=0x2721b54 | out: lpFileInformation=0x2721b54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.560] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl", lpFilePart=0x0) returned 0x3e
	[0155.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.560] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl"), fInfoLevelId=0x0, lpFileInformation=0x2721eec | out: lpFileInformation=0x2721eec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.561] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl", lpFilePart=0x0) returned 0x3e
	[0155.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.561] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl"), fInfoLevelId=0x0, lpFileInformation=0x2722284 | out: lpFileInformation=0x2722284*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.562] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl", lpFilePart=0x0) returned 0x3e
	[0155.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl"), fInfoLevelId=0x0, lpFileInformation=0x272261c | out: lpFileInformation=0x272261c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.564] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl", lpFilePart=0x0) returned 0x3e
	[0155.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl"), fInfoLevelId=0x0, lpFileInformation=0x27229b4 | out: lpFileInformation=0x27229b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.565] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl", lpFilePart=0x0) returned 0x3e
	[0155.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl"), fInfoLevelId=0x0, lpFileInformation=0x2722d4c | out: lpFileInformation=0x2722d4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.567] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl", lpFilePart=0x0) returned 0x3e
	[0155.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.567] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl"), fInfoLevelId=0x0, lpFileInformation=0x27230e4 | out: lpFileInformation=0x27230e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.568] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl", lpFilePart=0x0) returned 0x3e
	[0155.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.568] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl"), fInfoLevelId=0x0, lpFileInformation=0x272347c | out: lpFileInformation=0x272347c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl", lpFilePart=0x0) returned 0x3e
	[0155.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl"), fInfoLevelId=0x0, lpFileInformation=0x2723814 | out: lpFileInformation=0x2723814*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.571] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl", lpFilePart=0x0) returned 0x3e
	[0155.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.571] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl"), fInfoLevelId=0x0, lpFileInformation=0x2723bac | out: lpFileInformation=0x2723bac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.572] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl", lpFilePart=0x0) returned 0x3e
	[0155.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl"), fInfoLevelId=0x0, lpFileInformation=0x2723f44 | out: lpFileInformation=0x2723f44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.573] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl", lpFilePart=0x0) returned 0x3e
	[0155.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl"), fInfoLevelId=0x0, lpFileInformation=0x27242dc | out: lpFileInformation=0x27242dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.575] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl", lpFilePart=0x0) returned 0x3e
	[0155.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.575] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl"), fInfoLevelId=0x0, lpFileInformation=0x2724674 | out: lpFileInformation=0x2724674*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.576] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl", lpFilePart=0x0) returned 0x3e
	[0155.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.576] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl"), fInfoLevelId=0x0, lpFileInformation=0x2724a0c | out: lpFileInformation=0x2724a0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.577] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl", lpFilePart=0x0) returned 0x3e
	[0155.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.577] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl"), fInfoLevelId=0x0, lpFileInformation=0x2724da4 | out: lpFileInformation=0x2724da4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.578] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl", lpFilePart=0x0) returned 0x3e
	[0155.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.579] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl"), fInfoLevelId=0x0, lpFileInformation=0x272513c | out: lpFileInformation=0x272513c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.580] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl", lpFilePart=0x0) returned 0x3e
	[0155.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl"), fInfoLevelId=0x0, lpFileInformation=0x27254d4 | out: lpFileInformation=0x27254d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.581] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", lpFilePart=0x0) returned 0x44
	[0155.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl"), fInfoLevelId=0x0, lpFileInformation=0x272586c | out: lpFileInformation=0x272586c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x56ec7d41, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x8d7246f1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1
	[0155.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.582] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", lpFilePart=0x0) returned 0x44
	[0155.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.582] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.582] GetFileType (hFile=0x47c) returned 0x1
	[0155.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0155.582] GetFileType (hFile=0x47c) returned 0x1
	[0155.582] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3000
	[0155.582] ReadFile (in: hFile=0x47c, lpBuffer=0x2725b1c, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2725b1c*, lpNumberOfBytesRead=0x540efcc*=0x3000, lpOverlapped=0x0) returned 1
	[0155.584] CloseHandle (hObject=0x47c) returned 1
	[0155.584] CryptDestroyKey (hKey=0x82b440) returned 1
	[0155.584] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.584] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2728bb8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0155.584] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.584] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.584] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0155.584] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.585] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2728c70*=0x1, dwFlags=0x0) returned 1
	[0155.585] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2728c3c, dwFlags=0x0) returned 1
	[0155.585] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2728c80*, pdwDataLen=0x540efd4*=0x3010, dwBufLen=0x3010 | out: pbData=0x2728c80*, pdwDataLen=0x540efd4*=0x3010) returned 1
	[0155.585] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272bc9c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x272bc9c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0155.585] CryptDestroyKey (hKey=0x82b200) returned 1
	[0155.585] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.585] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.585] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", lpFilePart=0x0) returned 0x44
	[0155.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0155.585] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.586] GetFileType (hFile=0x47c) returned 0x1
	[0155.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0155.586] GetFileType (hFile=0x47c) returned 0x1
	[0155.586] WriteFile (in: hFile=0x47c, lpBuffer=0x2728c80*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2728c80*, lpNumberOfBytesWritten=0x540efc0*=0x3010, lpOverlapped=0x0) returned 1
	[0155.587] CloseHandle (hObject=0x47c) returned 1
	[0155.588] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", lpFilePart=0x0) returned 0x44
	[0155.588] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x73
	[0155.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0155.588] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x56ec7d41, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x97101e75, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1
	[0155.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0155.588] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0155.589] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", lpFilePart=0x0) returned 0x44
	[0155.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.589] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl"), fInfoLevelId=0x0, lpFileInformation=0x272c13c | out: lpFileInformation=0x272c13c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.590] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", lpFilePart=0x0) returned 0x44
	[0155.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.590] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl"), fInfoLevelId=0x0, lpFileInformation=0x272c4f8 | out: lpFileInformation=0x272c4f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.591] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", lpFilePart=0x0) returned 0x44
	[0155.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.591] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl"), fInfoLevelId=0x0, lpFileInformation=0x272c8b4 | out: lpFileInformation=0x272c8b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.592] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", lpFilePart=0x0) returned 0x44
	[0155.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.592] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl"), fInfoLevelId=0x0, lpFileInformation=0x272cc70 | out: lpFileInformation=0x272cc70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.594] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", lpFilePart=0x0) returned 0x44
	[0155.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.594] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl"), fInfoLevelId=0x0, lpFileInformation=0x272d02c | out: lpFileInformation=0x272d02c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.595] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", lpFilePart=0x0) returned 0x44
	[0155.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.595] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl"), fInfoLevelId=0x0, lpFileInformation=0x272d3e8 | out: lpFileInformation=0x272d3e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.596] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", lpFilePart=0x0) returned 0x44
	[0155.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.596] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl"), fInfoLevelId=0x0, lpFileInformation=0x272d7a4 | out: lpFileInformation=0x272d7a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.597] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", lpFilePart=0x0) returned 0x44
	[0155.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.597] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl"), fInfoLevelId=0x0, lpFileInformation=0x272db60 | out: lpFileInformation=0x272db60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.598] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", lpFilePart=0x0) returned 0x44
	[0155.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.598] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl"), fInfoLevelId=0x0, lpFileInformation=0x272df1c | out: lpFileInformation=0x272df1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.599] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", lpFilePart=0x0) returned 0x44
	[0155.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.600] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl"), fInfoLevelId=0x0, lpFileInformation=0x272e2d8 | out: lpFileInformation=0x272e2d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.601] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", lpFilePart=0x0) returned 0x44
	[0155.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.601] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl"), fInfoLevelId=0x0, lpFileInformation=0x272e694 | out: lpFileInformation=0x272e694*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.602] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", lpFilePart=0x0) returned 0x44
	[0155.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl"), fInfoLevelId=0x0, lpFileInformation=0x272ea50 | out: lpFileInformation=0x272ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.603] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", lpFilePart=0x0) returned 0x44
	[0155.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.603] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl"), fInfoLevelId=0x0, lpFileInformation=0x272ee0c | out: lpFileInformation=0x272ee0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.604] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", lpFilePart=0x0) returned 0x44
	[0155.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl"), fInfoLevelId=0x0, lpFileInformation=0x272f1c8 | out: lpFileInformation=0x272f1c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.653] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", lpFilePart=0x0) returned 0x44
	[0155.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.653] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl"), fInfoLevelId=0x0, lpFileInformation=0x272f6b0 | out: lpFileInformation=0x272f6b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.654] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", lpFilePart=0x0) returned 0x44
	[0155.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.654] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl"), fInfoLevelId=0x0, lpFileInformation=0x272fa6c | out: lpFileInformation=0x272fa6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.656] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", lpFilePart=0x0) returned 0x44
	[0155.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.656] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl"), fInfoLevelId=0x0, lpFileInformation=0x272fe28 | out: lpFileInformation=0x272fe28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.657] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", lpFilePart=0x0) returned 0x44
	[0155.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.657] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl"), fInfoLevelId=0x0, lpFileInformation=0x27301e4 | out: lpFileInformation=0x27301e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.658] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", lpFilePart=0x0) returned 0x44
	[0155.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.658] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl"), fInfoLevelId=0x0, lpFileInformation=0x27305a0 | out: lpFileInformation=0x27305a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.659] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", lpFilePart=0x0) returned 0x44
	[0155.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.659] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl"), fInfoLevelId=0x0, lpFileInformation=0x273095c | out: lpFileInformation=0x273095c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.660] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", lpFilePart=0x0) returned 0x44
	[0155.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.660] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl"), fInfoLevelId=0x0, lpFileInformation=0x2730d18 | out: lpFileInformation=0x2730d18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.661] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", lpFilePart=0x0) returned 0x44
	[0155.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl"), fInfoLevelId=0x0, lpFileInformation=0x27310d4 | out: lpFileInformation=0x27310d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.663] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", lpFilePart=0x0) returned 0x44
	[0155.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.663] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl"), fInfoLevelId=0x0, lpFileInformation=0x2731490 | out: lpFileInformation=0x2731490*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.664] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", lpFilePart=0x0) returned 0x44
	[0155.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl"), fInfoLevelId=0x0, lpFileInformation=0x273184c | out: lpFileInformation=0x273184c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.665] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", lpFilePart=0x0) returned 0x44
	[0155.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl"), fInfoLevelId=0x0, lpFileInformation=0x2731c08 | out: lpFileInformation=0x2731c08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.666] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", lpFilePart=0x0) returned 0x44
	[0155.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.666] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl"), fInfoLevelId=0x0, lpFileInformation=0x2731fc4 | out: lpFileInformation=0x2731fc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.667] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", lpFilePart=0x0) returned 0x44
	[0155.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.667] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.028.etl"), fInfoLevelId=0x0, lpFileInformation=0x2732380 | out: lpFileInformation=0x2732380*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.668] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl", lpFilePart=0x0) returned 0x32
	[0155.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.669] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl"), fInfoLevelId=0x0, lpFileInformation=0x273273c | out: lpFileInformation=0x273273c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.670] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl", lpFilePart=0x0) returned 0x32
	[0155.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl"), fInfoLevelId=0x0, lpFileInformation=0x2732a8c | out: lpFileInformation=0x2732a8c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db", lpFilePart=0x0) returned 0x2a
	[0155.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.671] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db"), fInfoLevelId=0x0, lpFileInformation=0x2732ddc | out: lpFileInformation=0x2732ddc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4a3b706e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4a3b706e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x56f5f2ae, ftLastWriteTime.dwHighDateTime=0x1d4ae7c, nFileSizeHigh=0x0, nFileSizeLow=0x11110)) returned 1
	[0155.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.672] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db", lpFilePart=0x0) returned 0x2a
	[0155.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.672] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.672] GetFileType (hFile=0x47c) returned 0x1
	[0155.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0155.672] GetFileType (hFile=0x47c) returned 0x1
	[0155.672] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x11110
	[0155.672] ReadFile (in: hFile=0x47c, lpBuffer=0x2732fcc, nNumberOfBytesToRead=0x11110, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2732fcc*, lpNumberOfBytesRead=0x540efcc*=0x11110, lpOverlapped=0x0) returned 1
	[0155.673] CloseHandle (hObject=0x47c) returned 1
	[0155.673] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0155.673] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.673] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2744178, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0155.673] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.673] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.673] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0155.673] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.673] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2744230*=0x1, dwFlags=0x0) returned 1
	[0155.673] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27441fc, dwFlags=0x0) returned 1
	[0155.674] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2744240*, pdwDataLen=0x540efd4*=0x11120, dwBufLen=0x11120 | out: pbData=0x2744240*, pdwDataLen=0x540efd4*=0x11120) returned 1
	[0155.674] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275536c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x275536c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0155.674] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0155.674] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.674] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.674] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db", lpFilePart=0x0) returned 0x2a
	[0155.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0155.674] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0155.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0155.675] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3", lpFilePart=0x0) returned 0x38
	[0155.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.675] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\2ephmi6_npz8vbbcb df.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2755888 | out: lpFileInformation=0x2755888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa4f7360, ftCreationTime.dwHighDateTime=0x1d4d22a, ftLastAccessTime.dwLowDateTime=0xd4c36c40, ftLastAccessTime.dwHighDateTime=0x1d4ca92, ftLastWriteTime.dwLowDateTime=0xd4c36c40, ftLastWriteTime.dwHighDateTime=0x1d4ca92, nFileSizeHigh=0x0, nFileSizeLow=0x16e84)) returned 1
	[0155.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.676] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3", lpFilePart=0x0) returned 0x38
	[0155.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.676] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\2ephmi6_npz8vbbcb df.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.676] GetFileType (hFile=0x47c) returned 0x1
	[0155.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0155.676] GetFileType (hFile=0x47c) returned 0x1
	[0155.676] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x16e84
	[0155.676] ReadFile (in: hFile=0x47c, lpBuffer=0x90704a8, nNumberOfBytesToRead=0x16e84, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x90704a8*, lpNumberOfBytesRead=0x540efcc*=0x16e84, lpOverlapped=0x0) returned 1
	[0155.677] CloseHandle (hObject=0x47c) returned 1
	[0155.677] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0155.677] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.677] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2755b70, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0155.677] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.677] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.678] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0155.678] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.678] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2755c28*=0x1, dwFlags=0x0) returned 1
	[0155.678] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2755bf4, dwFlags=0x0) returned 1
	[0155.678] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9087348*, pdwDataLen=0x540efd4*=0x16e90, dwBufLen=0x16e90 | out: pbData=0x9087348*, pdwDataLen=0x540efd4*=0x16e90) returned 1
	[0155.678] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2755c38*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2755c38*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0155.678] CryptDestroyKey (hKey=0x82b200) returned 1
	[0155.679] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.679] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.679] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3", lpFilePart=0x0) returned 0x38
	[0155.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0155.679] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\2ephmi6_npz8vbbcb df.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.680] GetFileType (hFile=0x47c) returned 0x1
	[0155.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0155.680] GetFileType (hFile=0x47c) returned 0x1
	[0155.680] WriteFile (in: hFile=0x47c, lpBuffer=0x9087348*, nNumberOfBytesToWrite=0x16e90, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x9087348*, lpNumberOfBytesWritten=0x540efc0*=0x16e90, lpOverlapped=0x0) returned 1
	[0155.682] CloseHandle (hObject=0x47c) returned 1
	[0155.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3", lpFilePart=0x0) returned 0x38
	[0155.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0155.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0155.683] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\2ephmi6_npz8vbbcb df.mp3"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa4f7360, ftCreationTime.dwHighDateTime=0x1d4d22a, ftLastAccessTime.dwLowDateTime=0xd4c36c40, ftLastAccessTime.dwHighDateTime=0x1d4ca92, ftLastWriteTime.dwLowDateTime=0x971e6b4f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x16e90)) returned 1
	[0155.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0155.683] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\2ephmi6_npz8vbbcb df.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2EPHmi6_nPZ8vbbcb DF.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\2ephmi6_npz8vbbcb df.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0155.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a", lpFilePart=0x0) returned 0x2f
	[0155.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.683] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\2e_mullvgkk.m4a"), fInfoLevelId=0x0, lpFileInformation=0x275604c | out: lpFileInformation=0x275604c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb29b600, ftCreationTime.dwHighDateTime=0x1d4d3a5, ftLastAccessTime.dwLowDateTime=0xcbdd7100, ftLastAccessTime.dwHighDateTime=0x1d4cf44, ftLastWriteTime.dwLowDateTime=0xcbdd7100, ftLastWriteTime.dwHighDateTime=0x1d4cf44, nFileSizeHigh=0x0, nFileSizeLow=0x7c14)) returned 1
	[0155.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a", lpFilePart=0x0) returned 0x2f
	[0155.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.684] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\2e_mullvgkk.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.684] GetFileType (hFile=0x47c) returned 0x1
	[0155.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0155.684] GetFileType (hFile=0x47c) returned 0x1
	[0155.684] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x7c14
	[0155.684] ReadFile (in: hFile=0x47c, lpBuffer=0x2756254, nNumberOfBytesToRead=0x7c14, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2756254*, lpNumberOfBytesRead=0x540efcc*=0x7c14, lpOverlapped=0x0) returned 1
	[0155.685] CloseHandle (hObject=0x47c) returned 1
	[0155.685] CryptDestroyKey (hKey=0x82b040) returned 1
	[0155.685] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.685] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275df04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0155.685] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.685] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.685] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0155.685] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.685] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x275dfbc*=0x1, dwFlags=0x0) returned 1
	[0155.685] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x275df88, dwFlags=0x0) returned 1
	[0155.685] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275dfcc*, pdwDataLen=0x540efd4*=0x7c20, dwBufLen=0x7c20 | out: pbData=0x275dfcc*, pdwDataLen=0x540efd4*=0x7c20) returned 1
	[0155.685] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2765bf8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2765bf8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0155.686] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0155.686] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.686] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.686] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a", lpFilePart=0x0) returned 0x2f
	[0155.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0155.686] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\2e_mullvgkk.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.687] GetFileType (hFile=0x47c) returned 0x1
	[0155.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0155.687] GetFileType (hFile=0x47c) returned 0x1
	[0155.687] WriteFile (in: hFile=0x47c, lpBuffer=0x275dfcc*, nNumberOfBytesToWrite=0x7c20, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x275dfcc*, lpNumberOfBytesWritten=0x540efc0*=0x7c20, lpOverlapped=0x0) returned 1
	[0155.688] CloseHandle (hObject=0x47c) returned 1
	[0155.688] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a", lpFilePart=0x0) returned 0x2f
	[0155.688] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0155.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0155.688] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\2e_mullvgkk.m4a"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb29b600, ftCreationTime.dwHighDateTime=0x1d4d3a5, ftLastAccessTime.dwLowDateTime=0xcbdd7100, ftLastAccessTime.dwHighDateTime=0x1d4cf44, ftLastWriteTime.dwLowDateTime=0x9720cd2e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7c20)) returned 1
	[0155.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0155.689] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\2e_mullvgkk.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\2e_muLLvgKK.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\2e_mullvgkk.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0155.689] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav", lpFilePart=0x0) returned 0x36
	[0155.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4angj8tevfsap 6-81.wav"), fInfoLevelId=0x0, lpFileInformation=0x2765fa0 | out: lpFileInformation=0x2765fa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9030f030, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0xe4b37d20, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0xe4b37d20, ftLastWriteTime.dwHighDateTime=0x1d4d0a0, nFileSizeHigh=0x0, nFileSizeLow=0xf20d)) returned 1
	[0155.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.689] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav", lpFilePart=0x0) returned 0x36
	[0155.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.690] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4angj8tevfsap 6-81.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.690] GetFileType (hFile=0x47c) returned 0x1
	[0155.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0155.690] GetFileType (hFile=0x47c) returned 0x1
	[0155.690] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xf20d
	[0155.690] ReadFile (in: hFile=0x47c, lpBuffer=0x27661e8, nNumberOfBytesToRead=0xf20d, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27661e8*, lpNumberOfBytesRead=0x540efcc*=0xf20d, lpOverlapped=0x0) returned 1
	[0155.691] CloseHandle (hObject=0x47c) returned 1
	[0155.691] CryptDestroyKey (hKey=0x82b540) returned 1
	[0155.691] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.691] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2775494, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0155.691] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.691] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.691] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0155.691] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.691] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x277554c*=0x1, dwFlags=0x0) returned 1
	[0155.691] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2775518, dwFlags=0x0) returned 1
	[0155.691] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277555c*, pdwDataLen=0x540efd4*=0xf210, dwBufLen=0xf210 | out: pbData=0x277555c*, pdwDataLen=0x540efd4*=0xf210) returned 1
	[0155.691] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2784778*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2784778*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0155.691] CryptDestroyKey (hKey=0x82b200) returned 1
	[0155.691] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.691] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav", lpFilePart=0x0) returned 0x36
	[0155.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0155.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4angj8tevfsap 6-81.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.693] GetFileType (hFile=0x47c) returned 0x1
	[0155.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0155.693] GetFileType (hFile=0x47c) returned 0x1
	[0155.693] WriteFile (in: hFile=0x47c, lpBuffer=0x277555c*, nNumberOfBytesToWrite=0xf210, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x277555c*, lpNumberOfBytesWritten=0x540efc0*=0xf210, lpOverlapped=0x0) returned 1
	[0155.694] CloseHandle (hObject=0x47c) returned 1
	[0155.695] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav", lpFilePart=0x0) returned 0x36
	[0155.695] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0155.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0155.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4angj8tevfsap 6-81.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9030f030, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0xe4b37d20, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0x9720cd2e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xf210)) returned 1
	[0155.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0155.695] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4angj8tevfsap 6-81.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4ANgj8teVFsAP 6-81.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4angj8tevfsap 6-81.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0155.695] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv", lpFilePart=0x0) returned 0x36
	[0155.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0155.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4aqdbabsidrppojboy.csv"), fInfoLevelId=0x0, lpFileInformation=0x2784b74 | out: lpFileInformation=0x2784b74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31283c10, ftCreationTime.dwHighDateTime=0x1d4cc99, ftLastAccessTime.dwLowDateTime=0x1afbbaf0, ftLastAccessTime.dwHighDateTime=0x1d4ce44, ftLastWriteTime.dwLowDateTime=0x1afbbaf0, ftLastWriteTime.dwHighDateTime=0x1d4ce44, nFileSizeHigh=0x0, nFileSizeLow=0x64ce)) returned 1
	[0155.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0155.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv", lpFilePart=0x0) returned 0x36
	[0155.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0155.696] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4aqdbabsidrppojboy.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0155.696] GetFileType (hFile=0x47c) returned 0x1
	[0155.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0155.696] GetFileType (hFile=0x47c) returned 0x1
	[0155.696] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x64ce
	[0155.696] ReadFile (in: hFile=0x47c, lpBuffer=0x2784dbc, nNumberOfBytesToRead=0x64ce, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2784dbc*, lpNumberOfBytesRead=0x540efcc*=0x64ce, lpOverlapped=0x0) returned 1
	[0155.697] CloseHandle (hObject=0x47c) returned 1
	[0155.697] CryptDestroyKey (hKey=0x82b540) returned 1
	[0155.697] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.697] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278b328, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0155.697] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.697] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.697] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0155.697] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0155.697] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x278b3e0*=0x1, dwFlags=0x0) returned 1
	[0155.697] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x278b3ac, dwFlags=0x0) returned 1
	[0155.697] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278b3f0*, pdwDataLen=0x540efd4*=0x64d0, dwBufLen=0x64d0 | out: pbData=0x278b3f0*, pdwDataLen=0x540efd4*=0x64d0) returned 1
	[0155.698] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27918cc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27918cc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0155.698] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0155.698] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0155.698] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv", lpFilePart=0x0) returned 0x36
	[0156.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.090] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4aqdbabsidrppojboy.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.091] GetFileType (hFile=0x47c) returned 0x1
	[0156.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.091] GetFileType (hFile=0x47c) returned 0x1
	[0156.091] WriteFile (in: hFile=0x47c, lpBuffer=0x278b3f0*, nNumberOfBytesToWrite=0x64d0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x278b3f0*, lpNumberOfBytesWritten=0x540efc0*=0x64d0, lpOverlapped=0x0) returned 1
	[0156.093] CloseHandle (hObject=0x47c) returned 1
	[0156.093] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv", lpFilePart=0x0) returned 0x36
	[0156.093] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0156.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.093] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4aqdbabsidrppojboy.csv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31283c10, ftCreationTime.dwHighDateTime=0x1d4cc99, ftLastAccessTime.dwLowDateTime=0x1afbbaf0, ftLastAccessTime.dwHighDateTime=0x1d4ce44, ftLastWriteTime.dwLowDateTime=0x975eca47, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x64d0)) returned 1
	[0156.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.093] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4aqdbabsidrppojboy.csv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4AqDBaBsIdRpPojboy.csv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4aqdbabsidrppojboy.csv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp", lpFilePart=0x0) returned 0x33
	[0156.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.094] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4q6l9ygqv_4yle0.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2791cc8 | out: lpFileInformation=0x2791cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc06baf10, ftCreationTime.dwHighDateTime=0x1d4d1b7, ftLastAccessTime.dwLowDateTime=0x5b0df8d0, ftLastAccessTime.dwHighDateTime=0x1d4cd7f, ftLastWriteTime.dwLowDateTime=0x5b0df8d0, ftLastWriteTime.dwHighDateTime=0x1d4cd7f, nFileSizeHigh=0x0, nFileSizeLow=0x471)) returned 1
	[0156.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp", lpFilePart=0x0) returned 0x33
	[0156.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.095] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4q6l9ygqv_4yle0.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.095] GetFileType (hFile=0x47c) returned 0x1
	[0156.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.095] GetFileType (hFile=0x47c) returned 0x1
	[0156.095] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x471
	[0156.095] ReadFile (in: hFile=0x47c, lpBuffer=0x2792370, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2792370*, lpNumberOfBytesRead=0x540efcc*=0x471, lpOverlapped=0x0) returned 1
	[0156.096] CloseHandle (hObject=0x47c) returned 1
	[0156.096] CryptDestroyKey (hKey=0x82b280) returned 1
	[0156.096] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.096] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279340c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0156.096] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.096] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.096] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0156.096] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.096] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27934c4*=0x1, dwFlags=0x0) returned 1
	[0156.096] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x2793490, dwFlags=0x0) returned 1
	[0156.097] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27934d4*, pdwDataLen=0x540efd4*=0x480, dwBufLen=0x480 | out: pbData=0x27934d4*, pdwDataLen=0x540efd4*=0x480) returned 1
	[0156.097] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2793960*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2793960*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.097] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0156.097] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.097] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.097] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp", lpFilePart=0x0) returned 0x33
	[0156.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.097] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4q6l9ygqv_4yle0.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.098] GetFileType (hFile=0x47c) returned 0x1
	[0156.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.098] GetFileType (hFile=0x47c) returned 0x1
	[0156.098] WriteFile (in: hFile=0x47c, lpBuffer=0x2793a80*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2793a80*, lpNumberOfBytesWritten=0x540ef94*=0x480, lpOverlapped=0x0) returned 1
	[0156.099] CloseHandle (hObject=0x47c) returned 1
	[0156.099] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp", lpFilePart=0x0) returned 0x33
	[0156.099] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x62
	[0156.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.099] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4q6l9ygqv_4yle0.bmp"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc06baf10, ftCreationTime.dwHighDateTime=0x1d4d1b7, ftLastAccessTime.dwLowDateTime=0x5b0df8d0, ftLastAccessTime.dwHighDateTime=0x1d4cd7f, ftLastWriteTime.dwLowDateTime=0x975eca47, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x480)) returned 1
	[0156.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.100] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4q6l9ygqv_4yle0.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4Q6L9ygQV_4yle0.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4q6l9ygqv_4yle0.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav", lpFilePart=0x0) returned 0x36
	[0156.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.100] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\90edkidfizwsrlcadt.wav"), fInfoLevelId=0x0, lpFileInformation=0x2794d44 | out: lpFileInformation=0x2794d44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f14e020, ftCreationTime.dwHighDateTime=0x1d4c977, ftLastAccessTime.dwLowDateTime=0x4f4791c0, ftLastAccessTime.dwHighDateTime=0x1d4c62f, ftLastWriteTime.dwLowDateTime=0x4f4791c0, ftLastWriteTime.dwHighDateTime=0x1d4c62f, nFileSizeHigh=0x0, nFileSizeLow=0xdf5d)) returned 1
	[0156.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.101] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav", lpFilePart=0x0) returned 0x36
	[0156.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.101] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\90edkidfizwsrlcadt.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.101] GetFileType (hFile=0x47c) returned 0x1
	[0156.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.101] GetFileType (hFile=0x47c) returned 0x1
	[0156.101] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xdf5d
	[0156.101] ReadFile (in: hFile=0x47c, lpBuffer=0x2794f8c, nNumberOfBytesToRead=0xdf5d, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2794f8c*, lpNumberOfBytesRead=0x540efcc*=0xdf5d, lpOverlapped=0x0) returned 1
	[0156.102] CloseHandle (hObject=0x47c) returned 1
	[0156.103] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0156.103] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.103] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a2f88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0156.103] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.103] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.103] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0156.103] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.103] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27a3040*=0x1, dwFlags=0x0) returned 1
	[0156.103] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27a300c, dwFlags=0x0) returned 1
	[0156.103] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a3050*, pdwDataLen=0x540efd4*=0xdf60, dwBufLen=0xdf60 | out: pbData=0x27a3050*, pdwDataLen=0x540efd4*=0xdf60) returned 1
	[0156.103] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b0fbc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b0fbc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.103] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0156.103] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.103] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.103] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav", lpFilePart=0x0) returned 0x36
	[0156.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.103] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\90edkidfizwsrlcadt.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.105] GetFileType (hFile=0x47c) returned 0x1
	[0156.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.106] GetFileType (hFile=0x47c) returned 0x1
	[0156.106] WriteFile (in: hFile=0x47c, lpBuffer=0x27a3050*, nNumberOfBytesToWrite=0xdf60, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27a3050*, lpNumberOfBytesWritten=0x540efc0*=0xdf60, lpOverlapped=0x0) returned 1
	[0156.107] CloseHandle (hObject=0x47c) returned 1
	[0156.108] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav", lpFilePart=0x0) returned 0x36
	[0156.108] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0156.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.108] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\90edkidfizwsrlcadt.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f14e020, ftCreationTime.dwHighDateTime=0x1d4c977, ftLastAccessTime.dwLowDateTime=0x4f4791c0, ftLastAccessTime.dwHighDateTime=0x1d4c62f, ftLastWriteTime.dwLowDateTime=0x97612cf0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xdf60)) returned 1
	[0156.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.108] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\90edkidfizwsrlcadt.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\90eDKidfizwsRlcadt.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\90edkidfizwsrlcadt.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.109] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a", lpFilePart=0x0) returned 0x2b
	[0156.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.109] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aeqbumx.m4a"), fInfoLevelId=0x0, lpFileInformation=0x27b13b8 | out: lpFileInformation=0x27b13b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb03c31d0, ftCreationTime.dwHighDateTime=0x1d4d218, ftLastAccessTime.dwLowDateTime=0xd96b5910, ftLastAccessTime.dwHighDateTime=0x1d4cc09, ftLastWriteTime.dwLowDateTime=0xd96b5910, ftLastWriteTime.dwHighDateTime=0x1d4cc09, nFileSizeHigh=0x0, nFileSizeLow=0x7db6)) returned 1
	[0156.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.109] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a", lpFilePart=0x0) returned 0x2b
	[0156.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.109] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aeqbumx.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.110] GetFileType (hFile=0x47c) returned 0x1
	[0156.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.110] GetFileType (hFile=0x47c) returned 0x1
	[0156.110] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x7db6
	[0156.110] ReadFile (in: hFile=0x47c, lpBuffer=0x27b15a0, nNumberOfBytesToRead=0x7db6, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b15a0*, lpNumberOfBytesRead=0x540efcc*=0x7db6, lpOverlapped=0x0) returned 1
	[0156.111] CloseHandle (hObject=0x47c) returned 1
	[0156.111] CryptDestroyKey (hKey=0x82b300) returned 1
	[0156.111] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.111] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b93f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0156.111] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.111] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.111] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0156.111] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.111] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27b94ac*=0x1, dwFlags=0x0) returned 1
	[0156.111] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27b9478, dwFlags=0x0) returned 1
	[0156.111] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b94bc*, pdwDataLen=0x540efd4*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27b94bc*, pdwDataLen=0x540efd4*=0x7dc0) returned 1
	[0156.111] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c1288*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c1288*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.111] CryptDestroyKey (hKey=0x82b340) returned 1
	[0156.111] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.111] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a", lpFilePart=0x0) returned 0x2b
	[0156.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.112] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aeqbumx.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.113] GetFileType (hFile=0x47c) returned 0x1
	[0156.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.113] GetFileType (hFile=0x47c) returned 0x1
	[0156.113] WriteFile (in: hFile=0x47c, lpBuffer=0x27b94bc*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27b94bc*, lpNumberOfBytesWritten=0x540efc0*=0x7dc0, lpOverlapped=0x0) returned 1
	[0156.115] CloseHandle (hObject=0x47c) returned 1
	[0156.115] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a", lpFilePart=0x0) returned 0x2b
	[0156.115] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5a
	[0156.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.115] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aeqbumx.m4a"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb03c31d0, ftCreationTime.dwHighDateTime=0x1d4d218, ftLastAccessTime.dwLowDateTime=0xd96b5910, ftLastAccessTime.dwHighDateTime=0x1d4cc09, ftLastWriteTime.dwLowDateTime=0x97612cf0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7dc0)) returned 1
	[0156.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.115] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aeqbumx.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AeQBUMx.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aeqbumx.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.116] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv", lpFilePart=0x0) returned 0x38
	[0156.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.116] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aupaxo5kqbnxyraoimas.mkv"), fInfoLevelId=0x0, lpFileInformation=0x27c1600 | out: lpFileInformation=0x27c1600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1492c540, ftCreationTime.dwHighDateTime=0x1d4c6cf, ftLastAccessTime.dwLowDateTime=0x41731a00, ftLastAccessTime.dwHighDateTime=0x1d4cf2c, ftLastWriteTime.dwLowDateTime=0x41731a00, ftLastWriteTime.dwHighDateTime=0x1d4cf2c, nFileSizeHigh=0x0, nFileSizeLow=0x1091a)) returned 1
	[0156.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.116] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv", lpFilePart=0x0) returned 0x38
	[0156.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.116] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aupaxo5kqbnxyraoimas.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.117] GetFileType (hFile=0x47c) returned 0x1
	[0156.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.117] GetFileType (hFile=0x47c) returned 0x1
	[0156.117] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1091a
	[0156.117] ReadFile (in: hFile=0x47c, lpBuffer=0x27c1858, nNumberOfBytesToRead=0x1091a, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c1858*, lpNumberOfBytesRead=0x540efcc*=0x1091a, lpOverlapped=0x0) returned 1
	[0156.118] CloseHandle (hObject=0x47c) returned 1
	[0156.118] CryptDestroyKey (hKey=0x82b540) returned 1
	[0156.118] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.118] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d2210, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0156.118] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.118] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.118] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0156.118] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.118] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27d22c8*=0x1, dwFlags=0x0) returned 1
	[0156.118] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27d2294, dwFlags=0x0) returned 1
	[0156.118] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d22d8*, pdwDataLen=0x540efd4*=0x10920, dwBufLen=0x10920 | out: pbData=0x27d22d8*, pdwDataLen=0x540efd4*=0x10920) returned 1
	[0156.119] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e2c04*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27e2c04*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.119] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0156.119] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.119] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.119] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv", lpFilePart=0x0) returned 0x38
	[0156.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.119] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aupaxo5kqbnxyraoimas.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.121] GetFileType (hFile=0x47c) returned 0x1
	[0156.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.121] GetFileType (hFile=0x47c) returned 0x1
	[0156.121] WriteFile (in: hFile=0x47c, lpBuffer=0x27d22d8*, nNumberOfBytesToWrite=0x10920, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27d22d8*, lpNumberOfBytesWritten=0x540efc0*=0x10920, lpOverlapped=0x0) returned 1
	[0156.123] CloseHandle (hObject=0x47c) returned 1
	[0156.123] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv", lpFilePart=0x0) returned 0x38
	[0156.123] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0156.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aupaxo5kqbnxyraoimas.mkv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1492c540, ftCreationTime.dwHighDateTime=0x1d4c6cf, ftLastAccessTime.dwLowDateTime=0x41731a00, ftLastAccessTime.dwHighDateTime=0x1d4cf2c, ftLastWriteTime.dwLowDateTime=0x97638f6d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10920)) returned 1
	[0156.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.123] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aupaxo5kqbnxyraoimas.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aupAXO5KQBNxYrAoimAs.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aupaxo5kqbnxyraoimas.mkv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.124] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv", lpFilePart=0x0) returned 0x2f
	[0156.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.124] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bzd10ffq-jb.flv"), fInfoLevelId=0x0, lpFileInformation=0x27e3018 | out: lpFileInformation=0x27e3018*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530d06f0, ftCreationTime.dwHighDateTime=0x1d4d511, ftLastAccessTime.dwLowDateTime=0x47623750, ftLastAccessTime.dwHighDateTime=0x1d4cc86, ftLastWriteTime.dwLowDateTime=0x47623750, ftLastWriteTime.dwHighDateTime=0x1d4cc86, nFileSizeHigh=0x0, nFileSizeLow=0x154cf)) returned 1
	[0156.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.125] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv", lpFilePart=0x0) returned 0x2f
	[0156.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bzd10ffq-jb.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.125] GetFileType (hFile=0x47c) returned 0x1
	[0156.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.125] GetFileType (hFile=0x47c) returned 0x1
	[0156.125] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x154cf
	[0156.125] ReadFile (in: hFile=0x47c, lpBuffer=0x909e1f8, nNumberOfBytesToRead=0x154cf, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x909e1f8*, lpNumberOfBytesRead=0x540efcc*=0x154cf, lpOverlapped=0x0) returned 1
	[0156.128] CloseHandle (hObject=0x47c) returned 1
	[0156.128] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0156.128] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.128] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e32b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0156.128] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.128] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.128] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0156.128] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.128] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27e3368*=0x1, dwFlags=0x0) returned 1
	[0156.128] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27e3334, dwFlags=0x0) returned 1
	[0156.130] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x90b36e8*, pdwDataLen=0x540efd4*=0x154d0, dwBufLen=0x154d0 | out: pbData=0x90b36e8*, pdwDataLen=0x540efd4*=0x154d0) returned 1
	[0156.130] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e3378*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27e3378*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.130] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0156.130] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.130] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv", lpFilePart=0x0) returned 0x2f
	[0156.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.130] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bzd10ffq-jb.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.132] GetFileType (hFile=0x47c) returned 0x1
	[0156.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.132] GetFileType (hFile=0x47c) returned 0x1
	[0156.132] WriteFile (in: hFile=0x47c, lpBuffer=0x90b36e8*, nNumberOfBytesToWrite=0x154d0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x90b36e8*, lpNumberOfBytesWritten=0x540efc0*=0x154d0, lpOverlapped=0x0) returned 1
	[0156.134] CloseHandle (hObject=0x47c) returned 1
	[0156.134] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv", lpFilePart=0x0) returned 0x2f
	[0156.134] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0156.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.134] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bzd10ffq-jb.flv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530d06f0, ftCreationTime.dwHighDateTime=0x1d4d511, ftLastAccessTime.dwLowDateTime=0x47623750, ftLastAccessTime.dwHighDateTime=0x1d4cc86, ftLastWriteTime.dwLowDateTime=0x97638f6d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x154d0)) returned 1
	[0156.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.135] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bzd10ffq-jb.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Bzd10fFq-Jb.flv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bzd10ffq-jb.flv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.231] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3", lpFilePart=0x0) returned 0x2c
	[0156.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.231] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\c2l2stzr.mp3"), fInfoLevelId=0x0, lpFileInformation=0x27e3720 | out: lpFileInformation=0x27e3720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e847d0, ftCreationTime.dwHighDateTime=0x1d4c872, ftLastAccessTime.dwLowDateTime=0x4f620b80, ftLastAccessTime.dwHighDateTime=0x1d4c888, ftLastWriteTime.dwLowDateTime=0x4f620b80, ftLastWriteTime.dwHighDateTime=0x1d4c888, nFileSizeHigh=0x0, nFileSizeLow=0xa8d1)) returned 1
	[0156.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.231] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3", lpFilePart=0x0) returned 0x2c
	[0156.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.231] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\c2l2stzr.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.232] GetFileType (hFile=0x47c) returned 0x1
	[0156.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.232] GetFileType (hFile=0x47c) returned 0x1
	[0156.232] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xa8d1
	[0156.232] ReadFile (in: hFile=0x47c, lpBuffer=0x27e3918, nNumberOfBytesToRead=0xa8d1, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27e3918*, lpNumberOfBytesRead=0x540efcc*=0xa8d1, lpOverlapped=0x0) returned 1
	[0156.233] CloseHandle (hObject=0x47c) returned 1
	[0156.233] CryptDestroyKey (hKey=0x82b540) returned 1
	[0156.233] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.233] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ee288, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0156.233] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.233] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.233] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0156.233] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.233] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27ee340*=0x1, dwFlags=0x0) returned 1
	[0156.233] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27ee30c, dwFlags=0x0) returned 1
	[0156.234] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ee350*, pdwDataLen=0x540efd4*=0xa8e0, dwBufLen=0xa8e0 | out: pbData=0x27ee350*, pdwDataLen=0x540efd4*=0xa8e0) returned 1
	[0156.234] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f8c3c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f8c3c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.234] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0156.234] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.234] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.234] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3", lpFilePart=0x0) returned 0x2c
	[0156.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.234] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\c2l2stzr.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.235] GetFileType (hFile=0x47c) returned 0x1
	[0156.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.236] GetFileType (hFile=0x47c) returned 0x1
	[0156.236] WriteFile (in: hFile=0x47c, lpBuffer=0x27ee350*, nNumberOfBytesToWrite=0xa8e0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27ee350*, lpNumberOfBytesWritten=0x540efc0*=0xa8e0, lpOverlapped=0x0) returned 1
	[0156.237] CloseHandle (hObject=0x47c) returned 1
	[0156.237] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3", lpFilePart=0x0) returned 0x2c
	[0156.237] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0156.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.238] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\c2l2stzr.mp3"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e847d0, ftCreationTime.dwHighDateTime=0x1d4c872, ftLastAccessTime.dwLowDateTime=0x4f620b80, ftLastAccessTime.dwHighDateTime=0x1d4c888, ftLastWriteTime.dwLowDateTime=0x97745db8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xa8e0)) returned 1
	[0156.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.238] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\c2l2stzr.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\c2l2sTZr.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\c2l2stzr.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.239] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4", lpFilePart=0x0) returned 0x30
	[0156.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.239] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\cffnjbyncpj1.mp4"), fInfoLevelId=0x0, lpFileInformation=0x27f8fc0 | out: lpFileInformation=0x27f8fc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9299690, ftCreationTime.dwHighDateTime=0x1d4c961, ftLastAccessTime.dwLowDateTime=0x8275f430, ftLastAccessTime.dwHighDateTime=0x1d4cccc, ftLastWriteTime.dwLowDateTime=0x8275f430, ftLastWriteTime.dwHighDateTime=0x1d4cccc, nFileSizeHigh=0x0, nFileSizeLow=0xa0da)) returned 1
	[0156.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.239] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4", lpFilePart=0x0) returned 0x30
	[0156.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.239] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\cffnjbyncpj1.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.239] GetFileType (hFile=0x47c) returned 0x1
	[0156.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.239] GetFileType (hFile=0x47c) returned 0x1
	[0156.239] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xa0da
	[0156.239] ReadFile (in: hFile=0x47c, lpBuffer=0x27f91d8, nNumberOfBytesToRead=0xa0da, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27f91d8*, lpNumberOfBytesRead=0x540efcc*=0xa0da, lpOverlapped=0x0) returned 1
	[0156.240] CloseHandle (hObject=0x47c) returned 1
	[0156.240] CryptDestroyKey (hKey=0x82b380) returned 1
	[0156.240] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.240] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2803350, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0156.240] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.240] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.241] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0156.241] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.241] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2803408*=0x1, dwFlags=0x0) returned 1
	[0156.241] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x28033d4, dwFlags=0x0) returned 1
	[0156.241] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2803418*, pdwDataLen=0x540efd4*=0xa0e0, dwBufLen=0xa0e0 | out: pbData=0x2803418*, pdwDataLen=0x540efd4*=0xa0e0) returned 1
	[0156.241] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x280d504*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x280d504*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.241] CryptDestroyKey (hKey=0x82b100) returned 1
	[0156.241] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.241] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.241] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4", lpFilePart=0x0) returned 0x30
	[0156.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.241] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\cffnjbyncpj1.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.243] GetFileType (hFile=0x47c) returned 0x1
	[0156.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.243] GetFileType (hFile=0x47c) returned 0x1
	[0156.243] WriteFile (in: hFile=0x47c, lpBuffer=0x2803418*, nNumberOfBytesToWrite=0xa0e0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2803418*, lpNumberOfBytesWritten=0x540efc0*=0xa0e0, lpOverlapped=0x0) returned 1
	[0156.244] CloseHandle (hObject=0x47c) returned 1
	[0156.244] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4", lpFilePart=0x0) returned 0x30
	[0156.244] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0156.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.245] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\cffnjbyncpj1.mp4"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9299690, ftCreationTime.dwHighDateTime=0x1d4c961, ftLastAccessTime.dwLowDateTime=0x8275f430, ftLastAccessTime.dwHighDateTime=0x1d4cccc, ftLastWriteTime.dwLowDateTime=0x97745db8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xa0e0)) returned 1
	[0156.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.245] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\cffnjbyncpj1.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\CffnjByNcPJ1.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\cffnjbyncpj1.mp4 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png", lpFilePart=0x0) returned 0x29
	[0156.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.246] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fjpty.png"), fInfoLevelId=0x0, lpFileInformation=0x280d8b8 | out: lpFileInformation=0x280d8b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb4b100, ftCreationTime.dwHighDateTime=0x1d4d292, ftLastAccessTime.dwLowDateTime=0x7a573f60, ftLastAccessTime.dwHighDateTime=0x1d4cc82, ftLastWriteTime.dwLowDateTime=0x7a573f60, ftLastWriteTime.dwHighDateTime=0x1d4cc82, nFileSizeHigh=0x0, nFileSizeLow=0x9050)) returned 1
	[0156.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png", lpFilePart=0x0) returned 0x29
	[0156.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.246] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fjpty.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.246] GetFileType (hFile=0x47c) returned 0x1
	[0156.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.246] GetFileType (hFile=0x47c) returned 0x1
	[0156.246] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x9050
	[0156.246] ReadFile (in: hFile=0x47c, lpBuffer=0x280da90, nNumberOfBytesToRead=0x9050, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x280da90*, lpNumberOfBytesRead=0x540efcc*=0x9050, lpOverlapped=0x0) returned 1
	[0156.247] CloseHandle (hObject=0x47c) returned 1
	[0156.247] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0156.247] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.247] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2816b7c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0156.247] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.247] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.248] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0156.248] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.248] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x2816c34*=0x1, dwFlags=0x0) returned 1
	[0156.248] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x2816c00, dwFlags=0x0) returned 1
	[0156.248] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2816c44*, pdwDataLen=0x540efd4*=0x9060, dwBufLen=0x9060 | out: pbData=0x2816c44*, pdwDataLen=0x540efd4*=0x9060) returned 1
	[0156.248] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x281fcb0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x281fcb0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.248] CryptDestroyKey (hKey=0x82b340) returned 1
	[0156.248] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.248] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.248] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png", lpFilePart=0x0) returned 0x29
	[0156.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.248] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fjpty.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.249] GetFileType (hFile=0x47c) returned 0x1
	[0156.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.250] GetFileType (hFile=0x47c) returned 0x1
	[0156.250] WriteFile (in: hFile=0x47c, lpBuffer=0x2816c44*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2816c44*, lpNumberOfBytesWritten=0x540efc0*=0x9060, lpOverlapped=0x0) returned 1
	[0156.251] CloseHandle (hObject=0x47c) returned 1
	[0156.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png", lpFilePart=0x0) returned 0x29
	[0156.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x58
	[0156.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.252] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fjpty.png"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb4b100, ftCreationTime.dwHighDateTime=0x1d4d292, ftLastAccessTime.dwLowDateTime=0x7a573f60, ftLastAccessTime.dwHighDateTime=0x1d4cc82, ftLastWriteTime.dwLowDateTime=0x9776a20b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9060)) returned 1
	[0156.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.252] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fjpty.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fJptY.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fjpty.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.253] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav", lpFilePart=0x0) returned 0x35
	[0156.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.253] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i2-lw4rn5rnuf5kuj.wav"), fInfoLevelId=0x0, lpFileInformation=0x2820010 | out: lpFileInformation=0x2820010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c94220, ftCreationTime.dwHighDateTime=0x1d4cc98, ftLastAccessTime.dwLowDateTime=0xe9891f60, ftLastAccessTime.dwHighDateTime=0x1d4c800, ftLastWriteTime.dwLowDateTime=0xe9891f60, ftLastWriteTime.dwHighDateTime=0x1d4c800, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1
	[0156.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.253] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav", lpFilePart=0x0) returned 0x35
	[0156.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.253] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i2-lw4rn5rnuf5kuj.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.253] GetFileType (hFile=0x47c) returned 0x1
	[0156.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.254] GetFileType (hFile=0x47c) returned 0x1
	[0156.254] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x8000
	[0156.254] ReadFile (in: hFile=0x47c, lpBuffer=0x2820248, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2820248*, lpNumberOfBytesRead=0x540efcc*=0x8000, lpOverlapped=0x0) returned 1
	[0156.255] CloseHandle (hObject=0x47c) returned 1
	[0156.255] CryptDestroyKey (hKey=0x82b480) returned 1
	[0156.255] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.255] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28282e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0156.255] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.255] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.255] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0156.255] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.255] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x282839c*=0x1, dwFlags=0x0) returned 1
	[0156.255] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2828368, dwFlags=0x0) returned 1
	[0156.255] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28283ac*, pdwDataLen=0x540efd4*=0x8010, dwBufLen=0x8010 | out: pbData=0x28283ac*, pdwDataLen=0x540efd4*=0x8010) returned 1
	[0156.255] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28303c8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x28303c8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.255] CryptDestroyKey (hKey=0x82b440) returned 1
	[0156.255] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.255] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.256] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav", lpFilePart=0x0) returned 0x35
	[0156.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.256] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i2-lw4rn5rnuf5kuj.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.257] GetFileType (hFile=0x47c) returned 0x1
	[0156.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.257] GetFileType (hFile=0x47c) returned 0x1
	[0156.257] WriteFile (in: hFile=0x47c, lpBuffer=0x28283ac*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x28283ac*, lpNumberOfBytesWritten=0x540efc0*=0x8010, lpOverlapped=0x0) returned 1
	[0156.259] CloseHandle (hObject=0x47c) returned 1
	[0156.259] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav", lpFilePart=0x0) returned 0x35
	[0156.259] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0156.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.259] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i2-lw4rn5rnuf5kuj.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c94220, ftCreationTime.dwHighDateTime=0x1d4cc98, ftLastAccessTime.dwLowDateTime=0xe9891f60, ftLastAccessTime.dwHighDateTime=0x1d4c800, ftLastWriteTime.dwLowDateTime=0x9776a20b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8010)) returned 1
	[0156.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.260] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i2-lw4rn5rnuf5kuj.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i2-LW4Rn5rNuf5KUj.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i2-lw4rn5rnuf5kuj.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.261] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf", lpFilePart=0x0) returned 0x37
	[0156.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.261] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ihbd_yp-zcvkqrmur6t.rtf"), fInfoLevelId=0x0, lpFileInformation=0x28307b8 | out: lpFileInformation=0x28307b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc62c5e0, ftCreationTime.dwHighDateTime=0x1d4cd01, ftLastAccessTime.dwLowDateTime=0x427c45e0, ftLastAccessTime.dwHighDateTime=0x1d4c9f8, ftLastWriteTime.dwLowDateTime=0x427c45e0, ftLastWriteTime.dwHighDateTime=0x1d4c9f8, nFileSizeHigh=0x0, nFileSizeLow=0x1274a)) returned 1
	[0156.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.261] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf", lpFilePart=0x0) returned 0x37
	[0156.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.261] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ihbd_yp-zcvkqrmur6t.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.261] GetFileType (hFile=0x47c) returned 0x1
	[0156.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.262] GetFileType (hFile=0x47c) returned 0x1
	[0156.262] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1274a
	[0156.331] ReadFile (in: hFile=0x47c, lpBuffer=0x262da30, nNumberOfBytesToRead=0x1274a, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x262da30*, lpNumberOfBytesRead=0x540efcc*=0x1274a, lpOverlapped=0x0) returned 1
	[0156.333] CloseHandle (hObject=0x47c) returned 1
	[0156.333] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0156.333] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.333] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2640218, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0156.333] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.333] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.333] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0156.333] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.333] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x26402d0*=0x1, dwFlags=0x0) returned 1
	[0156.333] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x264029c, dwFlags=0x0) returned 1
	[0156.333] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26402e0*, pdwDataLen=0x540efd4*=0x12750, dwBufLen=0x12750 | out: pbData=0x26402e0*, pdwDataLen=0x540efd4*=0x12750) returned 1
	[0156.333] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2652a3c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2652a3c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.333] CryptDestroyKey (hKey=0x82b040) returned 1
	[0156.334] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.334] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf", lpFilePart=0x0) returned 0x37
	[0156.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.334] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ihbd_yp-zcvkqrmur6t.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.335] GetFileType (hFile=0x47c) returned 0x1
	[0156.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.335] GetFileType (hFile=0x47c) returned 0x1
	[0156.336] WriteFile (in: hFile=0x47c, lpBuffer=0x26402e0*, nNumberOfBytesToWrite=0x12750, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26402e0*, lpNumberOfBytesWritten=0x540efc0*=0x12750, lpOverlapped=0x0) returned 1
	[0156.338] CloseHandle (hObject=0x47c) returned 1
	[0156.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf", lpFilePart=0x0) returned 0x37
	[0156.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0156.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.338] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ihbd_yp-zcvkqrmur6t.rtf"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc62c5e0, ftCreationTime.dwHighDateTime=0x1d4cd01, ftLastAccessTime.dwLowDateTime=0x427c45e0, ftLastAccessTime.dwHighDateTime=0x1d4c9f8, ftLastWriteTime.dwLowDateTime=0x97828dc2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x12750)) returned 1
	[0156.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.338] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ihbd_yp-zcvkqrmur6t.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Ihbd_YP-zcVKqRmUr6T.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ihbd_yp-zcvkqrmur6t.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png", lpFilePart=0x0) returned 0x36
	[0156.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.339] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\irvatprjoe9wy_ih27.png"), fInfoLevelId=0x0, lpFileInformation=0x2652e44 | out: lpFileInformation=0x2652e44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3c68650, ftCreationTime.dwHighDateTime=0x1d4c596, ftLastAccessTime.dwLowDateTime=0x28e9e30, ftLastAccessTime.dwHighDateTime=0x1d4d298, ftLastWriteTime.dwLowDateTime=0x28e9e30, ftLastWriteTime.dwHighDateTime=0x1d4d298, nFileSizeHigh=0x0, nFileSizeLow=0x67a)) returned 1
	[0156.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png", lpFilePart=0x0) returned 0x36
	[0156.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.340] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\irvatprjoe9wy_ih27.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.340] GetFileType (hFile=0x47c) returned 0x1
	[0156.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.340] GetFileType (hFile=0x47c) returned 0x1
	[0156.340] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x67a
	[0156.340] ReadFile (in: hFile=0x47c, lpBuffer=0x2653714, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2653714*, lpNumberOfBytesRead=0x540efcc*=0x67a, lpOverlapped=0x0) returned 1
	[0156.341] CloseHandle (hObject=0x47c) returned 1
	[0156.341] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0156.341] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.341] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26547b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0156.341] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.341] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.341] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0156.341] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.341] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2654868*=0x1, dwFlags=0x0) returned 1
	[0156.341] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2654834, dwFlags=0x0) returned 1
	[0156.341] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2654878*, pdwDataLen=0x540efd4*=0x680, dwBufLen=0x680 | out: pbData=0x2654878*, pdwDataLen=0x540efd4*=0x680) returned 1
	[0156.341] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2654f04*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2654f04*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.341] CryptDestroyKey (hKey=0x82b200) returned 1
	[0156.341] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.341] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png", lpFilePart=0x0) returned 0x36
	[0156.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.341] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\irvatprjoe9wy_ih27.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.342] GetFileType (hFile=0x47c) returned 0x1
	[0156.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.342] GetFileType (hFile=0x47c) returned 0x1
	[0156.343] WriteFile (in: hFile=0x47c, lpBuffer=0x2655034*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2655034*, lpNumberOfBytesWritten=0x540ef94*=0x680, lpOverlapped=0x0) returned 1
	[0156.343] CloseHandle (hObject=0x47c) returned 1
	[0156.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png", lpFilePart=0x0) returned 0x36
	[0156.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0156.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\irvatprjoe9wy_ih27.png"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3c68650, ftCreationTime.dwHighDateTime=0x1d4c596, ftLastAccessTime.dwLowDateTime=0x28e9e30, ftLastAccessTime.dwHighDateTime=0x1d4d298, ftLastWriteTime.dwLowDateTime=0x9784f019, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x680)) returned 1
	[0156.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.344] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\irvatprjoe9wy_ih27.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IRVAtpRJoe9wy_IH27.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\irvatprjoe9wy_ih27.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp", lpFilePart=0x0) returned 0x2a
	[0156.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.345] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\jahv99.bmp"), fInfoLevelId=0x0, lpFileInformation=0x265630c | out: lpFileInformation=0x265630c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59b3feb0, ftCreationTime.dwHighDateTime=0x1d4d10f, ftLastAccessTime.dwLowDateTime=0xa5b01ec0, ftLastAccessTime.dwHighDateTime=0x1d4d3f8, ftLastWriteTime.dwLowDateTime=0xa5b01ec0, ftLastWriteTime.dwHighDateTime=0x1d4d3f8, nFileSizeHigh=0x0, nFileSizeLow=0x17faf)) returned 1
	[0156.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp", lpFilePart=0x0) returned 0x2a
	[0156.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.345] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\jahv99.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.345] GetFileType (hFile=0x47c) returned 0x1
	[0156.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.345] GetFileType (hFile=0x47c) returned 0x1
	[0156.345] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x17faf
	[0156.346] ReadFile (in: hFile=0x47c, lpBuffer=0x90c8bd8, nNumberOfBytesToRead=0x17faf, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x90c8bd8*, lpNumberOfBytesRead=0x540efcc*=0x17faf, lpOverlapped=0x0) returned 1
	[0156.348] CloseHandle (hObject=0x47c) returned 1
	[0156.348] CryptDestroyKey (hKey=0x82b080) returned 1
	[0156.348] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.349] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2656584, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0156.349] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.349] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.349] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0156.349] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.349] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x265663c*=0x1, dwFlags=0x0) returned 1
	[0156.349] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2656608, dwFlags=0x0) returned 1
	[0156.350] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x90e0ba8*, pdwDataLen=0x540efd4*=0x17fb0, dwBufLen=0x17fb0 | out: pbData=0x90e0ba8*, pdwDataLen=0x540efd4*=0x17fb0) returned 1
	[0156.351] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265664c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x265664c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.351] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0156.351] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.351] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp", lpFilePart=0x0) returned 0x2a
	[0156.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\jahv99.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.353] GetFileType (hFile=0x47c) returned 0x1
	[0156.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.353] GetFileType (hFile=0x47c) returned 0x1
	[0156.353] WriteFile (in: hFile=0x47c, lpBuffer=0x90e0ba8*, nNumberOfBytesToWrite=0x17fb0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x90e0ba8*, lpNumberOfBytesWritten=0x540efc0*=0x17fb0, lpOverlapped=0x0) returned 1
	[0156.355] CloseHandle (hObject=0x47c) returned 1
	[0156.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp", lpFilePart=0x0) returned 0x2a
	[0156.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0156.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.355] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\jahv99.bmp"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59b3feb0, ftCreationTime.dwHighDateTime=0x1d4d10f, ftLastAccessTime.dwLowDateTime=0xa5b01ec0, ftLastAccessTime.dwHighDateTime=0x1d4d3f8, ftLastWriteTime.dwLowDateTime=0x9787524f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x17fb0)) returned 1
	[0156.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.355] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\jahv99.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jAHv99.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\jahv99.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots", lpFilePart=0x0) returned 0x38
	[0156.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.356] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o5fwhnomcs-2qhryzuho.ots"), fInfoLevelId=0x0, lpFileInformation=0x26569b8 | out: lpFileInformation=0x26569b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1547d970, ftCreationTime.dwHighDateTime=0x1d4c9b9, ftLastAccessTime.dwLowDateTime=0xccbf0b30, ftLastAccessTime.dwHighDateTime=0x1d4cbd2, ftLastWriteTime.dwLowDateTime=0xccbf0b30, ftLastWriteTime.dwHighDateTime=0x1d4cbd2, nFileSizeHigh=0x0, nFileSizeLow=0x13fd7)) returned 1
	[0156.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots", lpFilePart=0x0) returned 0x38
	[0156.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.357] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o5fwhnomcs-2qhryzuho.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.357] GetFileType (hFile=0x47c) returned 0x1
	[0156.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.357] GetFileType (hFile=0x47c) returned 0x1
	[0156.357] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x13fd7
	[0156.357] ReadFile (in: hFile=0x47c, lpBuffer=0x2656c10, nNumberOfBytesToRead=0x13fd7, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2656c10*, lpNumberOfBytesRead=0x540efcc*=0x13fd7, lpOverlapped=0x0) returned 1
	[0156.358] CloseHandle (hObject=0x47c) returned 1
	[0156.358] CryptDestroyKey (hKey=0x82b080) returned 1
	[0156.358] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.358] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266ac84, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0156.358] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.358] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.358] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0156.358] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.358] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x266ad3c*=0x1, dwFlags=0x0) returned 1
	[0156.358] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x266ad08, dwFlags=0x0) returned 1
	[0156.358] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266ad4c*, pdwDataLen=0x540efd4*=0x13fe0, dwBufLen=0x13fe0 | out: pbData=0x266ad4c*, pdwDataLen=0x540efd4*=0x13fe0) returned 1
	[0156.358] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267ed38*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x267ed38*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.359] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0156.359] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.359] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.359] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots", lpFilePart=0x0) returned 0x38
	[0156.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.359] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o5fwhnomcs-2qhryzuho.ots"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.360] GetFileType (hFile=0x47c) returned 0x1
	[0156.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.360] GetFileType (hFile=0x47c) returned 0x1
	[0156.360] WriteFile (in: hFile=0x47c, lpBuffer=0x266ad4c*, nNumberOfBytesToWrite=0x13fe0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x266ad4c*, lpNumberOfBytesWritten=0x540efc0*=0x13fe0, lpOverlapped=0x0) returned 1
	[0156.362] CloseHandle (hObject=0x47c) returned 1
	[0156.362] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots", lpFilePart=0x0) returned 0x38
	[0156.362] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0156.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.363] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o5fwhnomcs-2qhryzuho.ots"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1547d970, ftCreationTime.dwHighDateTime=0x1d4c9b9, ftLastAccessTime.dwLowDateTime=0xccbf0b30, ftLastAccessTime.dwHighDateTime=0x1d4cbd2, ftLastWriteTime.dwLowDateTime=0x9787524f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13fe0)) returned 1
	[0156.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.363] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o5fwhnomcs-2qhryzuho.ots"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\o5FwHnOMCs-2qhrYzUHO.ots id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o5fwhnomcs-2qhryzuho.ots id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.363] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv", lpFilePart=0x0) returned 0x28
	[0156.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.364] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ogld.flv"), fInfoLevelId=0x0, lpFileInformation=0x267f14c | out: lpFileInformation=0x267f14c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c926190, ftCreationTime.dwHighDateTime=0x1d4d4c8, ftLastAccessTime.dwLowDateTime=0x5b039220, ftLastAccessTime.dwHighDateTime=0x1d4d0ac, ftLastWriteTime.dwLowDateTime=0x5b039220, ftLastWriteTime.dwHighDateTime=0x1d4d0ac, nFileSizeHigh=0x0, nFileSizeLow=0x93e8)) returned 1
	[0156.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv", lpFilePart=0x0) returned 0x28
	[0156.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ogld.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.364] GetFileType (hFile=0x47c) returned 0x1
	[0156.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.364] GetFileType (hFile=0x47c) returned 0x1
	[0156.364] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x93e8
	[0156.364] ReadFile (in: hFile=0x47c, lpBuffer=0x267f324, nNumberOfBytesToRead=0x93e8, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x267f324*, lpNumberOfBytesRead=0x540efcc*=0x93e8, lpOverlapped=0x0) returned 1
	[0156.365] CloseHandle (hObject=0x47c) returned 1
	[0156.365] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0156.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.365] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26887a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0156.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.365] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0156.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.365] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x2688860*=0x1, dwFlags=0x0) returned 1
	[0156.365] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x268882c, dwFlags=0x0) returned 1
	[0156.366] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2688870*, pdwDataLen=0x540efd4*=0x93f0, dwBufLen=0x93f0 | out: pbData=0x2688870*, pdwDataLen=0x540efd4*=0x93f0) returned 1
	[0156.366] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2691c6c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2691c6c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.366] CryptDestroyKey (hKey=0x82b340) returned 1
	[0156.366] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.366] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.366] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv", lpFilePart=0x0) returned 0x28
	[0156.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.366] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ogld.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.367] GetFileType (hFile=0x47c) returned 0x1
	[0156.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.367] GetFileType (hFile=0x47c) returned 0x1
	[0156.367] WriteFile (in: hFile=0x47c, lpBuffer=0x2688870*, nNumberOfBytesToWrite=0x93f0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2688870*, lpNumberOfBytesWritten=0x540efc0*=0x93f0, lpOverlapped=0x0) returned 1
	[0156.368] CloseHandle (hObject=0x47c) returned 1
	[0156.368] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv", lpFilePart=0x0) returned 0x28
	[0156.368] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0156.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.369] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ogld.flv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c926190, ftCreationTime.dwHighDateTime=0x1d4d4c8, ftLastAccessTime.dwLowDateTime=0x5b039220, ftLastAccessTime.dwHighDateTime=0x1d4d0ac, ftLastWriteTime.dwLowDateTime=0x9787524f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x93f0)) returned 1
	[0156.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.369] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ogld.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OgLd.flv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ogld.flv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.403] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc", lpFilePart=0x0) returned 0x2c
	[0156.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\otfgrc1i.doc"), fInfoLevelId=0x0, lpFileInformation=0x26921b0 | out: lpFileInformation=0x26921b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67a5d80, ftCreationTime.dwHighDateTime=0x1d4cf1f, ftLastAccessTime.dwLowDateTime=0x156aa930, ftLastAccessTime.dwHighDateTime=0x1d4cab5, ftLastWriteTime.dwLowDateTime=0x156aa930, ftLastWriteTime.dwHighDateTime=0x1d4cab5, nFileSizeHigh=0x0, nFileSizeLow=0x13d44)) returned 1
	[0156.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.404] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc", lpFilePart=0x0) returned 0x2c
	[0156.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.404] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\otfgrc1i.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.404] GetFileType (hFile=0x47c) returned 0x1
	[0156.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.404] GetFileType (hFile=0x47c) returned 0x1
	[0156.404] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x13d44
	[0156.404] ReadFile (in: hFile=0x47c, lpBuffer=0x26923a8, nNumberOfBytesToRead=0x13d44, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26923a8*, lpNumberOfBytesRead=0x540efcc*=0x13d44, lpOverlapped=0x0) returned 1
	[0156.405] CloseHandle (hObject=0x47c) returned 1
	[0156.405] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0156.406] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.406] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a6188, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0156.406] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.406] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.406] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0156.406] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.406] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26a6240*=0x1, dwFlags=0x0) returned 1
	[0156.406] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x26a620c, dwFlags=0x0) returned 1
	[0156.406] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a6250*, pdwDataLen=0x540efd4*=0x13d50, dwBufLen=0x13d50 | out: pbData=0x26a6250*, pdwDataLen=0x540efd4*=0x13d50) returned 1
	[0156.406] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b9fac*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b9fac*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.406] CryptDestroyKey (hKey=0x82b100) returned 1
	[0156.406] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.406] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.407] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc", lpFilePart=0x0) returned 0x2c
	[0156.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.407] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\otfgrc1i.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.408] GetFileType (hFile=0x47c) returned 0x1
	[0156.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.409] GetFileType (hFile=0x47c) returned 0x1
	[0156.409] WriteFile (in: hFile=0x47c, lpBuffer=0x26a6250*, nNumberOfBytesToWrite=0x13d50, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26a6250*, lpNumberOfBytesWritten=0x540efc0*=0x13d50, lpOverlapped=0x0) returned 1
	[0156.411] CloseHandle (hObject=0x47c) returned 1
	[0156.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc", lpFilePart=0x0) returned 0x2c
	[0156.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0156.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\otfgrc1i.doc"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67a5d80, ftCreationTime.dwHighDateTime=0x1d4cf1f, ftLastAccessTime.dwLowDateTime=0x156aa930, ftLastAccessTime.dwHighDateTime=0x1d4cab5, ftLastWriteTime.dwLowDateTime=0x978e7a09, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13d50)) returned 1
	[0156.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.411] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\otfgrc1i.doc"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oTfgRC1I.doc id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\otfgrc1i.doc id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.412] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv", lpFilePart=0x0) returned 0x2d
	[0156.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.412] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\pvmi289lw.flv"), fInfoLevelId=0x0, lpFileInformation=0x26ba330 | out: lpFileInformation=0x26ba330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6956e0, ftCreationTime.dwHighDateTime=0x1d4d04c, ftLastAccessTime.dwLowDateTime=0x4a0ae210, ftLastAccessTime.dwHighDateTime=0x1d4d008, ftLastWriteTime.dwLowDateTime=0x4a0ae210, ftLastWriteTime.dwHighDateTime=0x1d4d008, nFileSizeHigh=0x0, nFileSizeLow=0x15628)) returned 1
	[0156.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv", lpFilePart=0x0) returned 0x2d
	[0156.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.413] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\pvmi289lw.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.413] GetFileType (hFile=0x47c) returned 0x1
	[0156.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.413] GetFileType (hFile=0x47c) returned 0x1
	[0156.413] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x15628
	[0156.413] ReadFile (in: hFile=0x47c, lpBuffer=0x90f8b78, nNumberOfBytesToRead=0x15628, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x90f8b78*, lpNumberOfBytesRead=0x540efcc*=0x15628, lpOverlapped=0x0) returned 1
	[0156.416] CloseHandle (hObject=0x47c) returned 1
	[0156.416] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0156.416] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.416] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ba5b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0156.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.416] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0156.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.416] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26ba670*=0x1, dwFlags=0x0) returned 1
	[0156.416] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26ba63c, dwFlags=0x0) returned 1
	[0156.419] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x910e1c0*, pdwDataLen=0x540efd4*=0x15630, dwBufLen=0x15630 | out: pbData=0x910e1c0*, pdwDataLen=0x540efd4*=0x15630) returned 1
	[0156.419] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ba680*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26ba680*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.419] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0156.419] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.419] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv", lpFilePart=0x0) returned 0x2d
	[0156.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.419] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\pvmi289lw.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.421] GetFileType (hFile=0x47c) returned 0x1
	[0156.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.421] GetFileType (hFile=0x47c) returned 0x1
	[0156.421] WriteFile (in: hFile=0x47c, lpBuffer=0x910e1c0*, nNumberOfBytesToWrite=0x15630, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x910e1c0*, lpNumberOfBytesWritten=0x540efc0*=0x15630, lpOverlapped=0x0) returned 1
	[0156.423] CloseHandle (hObject=0x47c) returned 1
	[0156.424] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv", lpFilePart=0x0) returned 0x2d
	[0156.424] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0156.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.424] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\pvmi289lw.flv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6956e0, ftCreationTime.dwHighDateTime=0x1d4d04c, ftLastAccessTime.dwLowDateTime=0x4a0ae210, ftLastAccessTime.dwHighDateTime=0x1d4d008, ftLastWriteTime.dwLowDateTime=0x9790dd01, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x15630)) returned 1
	[0156.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.424] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\pvmi289lw.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\pVmi289lW.flv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\pvmi289lw.flv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.425] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif", lpFilePart=0x0) returned 0x2b
	[0156.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.425] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qqg5c6j.gif"), fInfoLevelId=0x0, lpFileInformation=0x26baa10 | out: lpFileInformation=0x26baa10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14aba580, ftCreationTime.dwHighDateTime=0x1d4cfc4, ftLastAccessTime.dwLowDateTime=0xee24d3b0, ftLastAccessTime.dwHighDateTime=0x1d4c5f4, ftLastWriteTime.dwLowDateTime=0xee24d3b0, ftLastWriteTime.dwHighDateTime=0x1d4c5f4, nFileSizeHigh=0x0, nFileSizeLow=0x122a)) returned 1
	[0156.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.426] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif", lpFilePart=0x0) returned 0x2b
	[0156.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.426] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qqg5c6j.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.426] GetFileType (hFile=0x47c) returned 0x1
	[0156.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.426] GetFileType (hFile=0x47c) returned 0x1
	[0156.426] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x122a
	[0156.426] ReadFile (in: hFile=0x47c, lpBuffer=0x26babf8, nNumberOfBytesToRead=0x122a, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26babf8*, lpNumberOfBytesRead=0x540efcc*=0x122a, lpOverlapped=0x0) returned 1
	[0156.427] CloseHandle (hObject=0x47c) returned 1
	[0156.427] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0156.427] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.427] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bbec0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0156.427] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.427] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.428] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0156.428] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.428] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x26bbf78*=0x1, dwFlags=0x0) returned 1
	[0156.428] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26bbf44, dwFlags=0x0) returned 1
	[0156.428] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bbf88*, pdwDataLen=0x540efd4*=0x1230, dwBufLen=0x1230 | out: pbData=0x26bbf88*, pdwDataLen=0x540efd4*=0x1230) returned 1
	[0156.428] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bd1c4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26bd1c4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.428] CryptDestroyKey (hKey=0x82b400) returned 1
	[0156.428] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.428] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif", lpFilePart=0x0) returned 0x2b
	[0156.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.428] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qqg5c6j.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.430] GetFileType (hFile=0x47c) returned 0x1
	[0156.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.430] GetFileType (hFile=0x47c) returned 0x1
	[0156.430] WriteFile (in: hFile=0x47c, lpBuffer=0x26bbf88*, nNumberOfBytesToWrite=0x1230, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26bbf88*, lpNumberOfBytesWritten=0x540efc0*=0x1230, lpOverlapped=0x0) returned 1
	[0156.431] CloseHandle (hObject=0x47c) returned 1
	[0156.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif", lpFilePart=0x0) returned 0x2b
	[0156.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5a
	[0156.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.431] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qqg5c6j.gif"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14aba580, ftCreationTime.dwHighDateTime=0x1d4cfc4, ftLastAccessTime.dwLowDateTime=0xee24d3b0, ftLastAccessTime.dwHighDateTime=0x1d4c5f4, ftLastWriteTime.dwLowDateTime=0x9790dd01, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1230)) returned 1
	[0156.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.431] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qqg5c6j.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QqG5c6J.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qqg5c6j.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.642] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg", lpFilePart=0x0) returned 0x35
	[0156.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.643] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rffhnrvlffgkp4dzg.jpg"), fInfoLevelId=0x0, lpFileInformation=0x26bd53c | out: lpFileInformation=0x26bd53c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b93610, ftCreationTime.dwHighDateTime=0x1d4d06a, ftLastAccessTime.dwLowDateTime=0x3d751240, ftLastAccessTime.dwHighDateTime=0x1d4c956, ftLastWriteTime.dwLowDateTime=0x3d751240, ftLastWriteTime.dwHighDateTime=0x1d4c956, nFileSizeHigh=0x0, nFileSizeLow=0x17cc8)) returned 1
	[0156.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.643] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg", lpFilePart=0x0) returned 0x35
	[0156.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.643] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rffhnrvlffgkp4dzg.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.644] GetFileType (hFile=0x47c) returned 0x1
	[0156.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.644] GetFileType (hFile=0x47c) returned 0x1
	[0156.644] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x17cc8
	[0156.644] ReadFile (in: hFile=0x47c, lpBuffer=0x9123810, nNumberOfBytesToRead=0x17cc8, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x9123810*, lpNumberOfBytesRead=0x540efcc*=0x17cc8, lpOverlapped=0x0) returned 1
	[0156.702] CloseHandle (hObject=0x47c) returned 1
	[0156.702] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0156.702] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.702] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bd804, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0156.702] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.702] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.702] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0156.703] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.703] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26bd8bc*=0x1, dwFlags=0x0) returned 1
	[0156.703] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26bd888, dwFlags=0x0) returned 1
	[0156.705] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x913b4f8*, pdwDataLen=0x540efd4*=0x17cd0, dwBufLen=0x17cd0 | out: pbData=0x913b4f8*, pdwDataLen=0x540efd4*=0x17cd0) returned 1
	[0156.705] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bd8cc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26bd8cc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.705] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0156.705] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.705] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.705] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg", lpFilePart=0x0) returned 0x35
	[0156.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.705] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rffhnrvlffgkp4dzg.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.707] GetFileType (hFile=0x47c) returned 0x1
	[0156.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.708] GetFileType (hFile=0x47c) returned 0x1
	[0156.708] WriteFile (in: hFile=0x47c, lpBuffer=0x913b4f8*, nNumberOfBytesToWrite=0x17cd0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x913b4f8*, lpNumberOfBytesWritten=0x540efc0*=0x17cd0, lpOverlapped=0x0) returned 1
	[0156.712] CloseHandle (hObject=0x47c) returned 1
	[0156.712] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg", lpFilePart=0x0) returned 0x35
	[0156.712] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0156.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.712] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rffhnrvlffgkp4dzg.jpg"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b93610, ftCreationTime.dwHighDateTime=0x1d4d06a, ftLastAccessTime.dwLowDateTime=0x3d751240, ftLastAccessTime.dwHighDateTime=0x1d4c956, ftLastWriteTime.dwLowDateTime=0x97bde784, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x17cd0)) returned 1
	[0156.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.713] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rffhnrvlffgkp4dzg.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RfFhNrVlffGKp4Dzg.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rffhnrvlffgkp4dzg.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.714] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg", lpFilePart=0x0) returned 0x34
	[0156.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\risyuctc1ugnihrn.jpg"), fInfoLevelId=0x0, lpFileInformation=0x26bdcbc | out: lpFileInformation=0x26bdcbc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf15b7b0, ftCreationTime.dwHighDateTime=0x1d4c6ea, ftLastAccessTime.dwLowDateTime=0xeae09810, ftLastAccessTime.dwHighDateTime=0x1d4d440, ftLastWriteTime.dwLowDateTime=0xeae09810, ftLastWriteTime.dwHighDateTime=0x1d4d440, nFileSizeHigh=0x0, nFileSizeLow=0x11086)) returned 1
	[0156.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg", lpFilePart=0x0) returned 0x34
	[0156.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.715] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\risyuctc1ugnihrn.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.715] GetFileType (hFile=0x47c) returned 0x1
	[0156.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.715] GetFileType (hFile=0x47c) returned 0x1
	[0156.715] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x11086
	[0156.715] ReadFile (in: hFile=0x47c, lpBuffer=0x26bdef4, nNumberOfBytesToRead=0x11086, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26bdef4*, lpNumberOfBytesRead=0x540efcc*=0x11086, lpOverlapped=0x0) returned 1
	[0156.716] CloseHandle (hObject=0x47c) returned 1
	[0156.716] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0156.716] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.717] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26cf018, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0156.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.717] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0156.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.717] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26cf0d0*=0x1, dwFlags=0x0) returned 1
	[0156.717] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26cf09c, dwFlags=0x0) returned 1
	[0156.717] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26cf0e0*, pdwDataLen=0x540efd4*=0x11090, dwBufLen=0x11090 | out: pbData=0x26cf0e0*, pdwDataLen=0x540efd4*=0x11090) returned 1
	[0156.717] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e017c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e017c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.717] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0156.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg", lpFilePart=0x0) returned 0x34
	[0156.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.717] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\risyuctc1ugnihrn.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.719] GetFileType (hFile=0x47c) returned 0x1
	[0156.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.720] GetFileType (hFile=0x47c) returned 0x1
	[0156.720] WriteFile (in: hFile=0x47c, lpBuffer=0x26cf0e0*, nNumberOfBytesToWrite=0x11090, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26cf0e0*, lpNumberOfBytesWritten=0x540efc0*=0x11090, lpOverlapped=0x0) returned 1
	[0156.723] CloseHandle (hObject=0x47c) returned 1
	[0156.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg", lpFilePart=0x0) returned 0x34
	[0156.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x63
	[0156.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.725] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\risyuctc1ugnihrn.jpg"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf15b7b0, ftCreationTime.dwHighDateTime=0x1d4c6ea, ftLastAccessTime.dwLowDateTime=0xeae09810, ftLastAccessTime.dwHighDateTime=0x1d4d440, ftLastWriteTime.dwLowDateTime=0x97bf5b74, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11090)) returned 1
	[0156.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.725] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\risyuctc1ugnihrn.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\RIsYucTC1uGNihRN.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\risyuctc1ugnihrn.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.726] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3", lpFilePart=0x0) returned 0x2c
	[0156.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.726] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rz6asr2d.mp3"), fInfoLevelId=0x0, lpFileInformation=0x26e0560 | out: lpFileInformation=0x26e0560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbf7fb0, ftCreationTime.dwHighDateTime=0x1d4d441, ftLastAccessTime.dwLowDateTime=0x2edacc20, ftLastAccessTime.dwHighDateTime=0x1d4d509, ftLastWriteTime.dwLowDateTime=0x2edacc20, ftLastWriteTime.dwHighDateTime=0x1d4d509, nFileSizeHigh=0x0, nFileSizeLow=0x74f1)) returned 1
	[0156.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.726] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3", lpFilePart=0x0) returned 0x2c
	[0156.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.728] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rz6asr2d.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.728] GetFileType (hFile=0x47c) returned 0x1
	[0156.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.728] GetFileType (hFile=0x47c) returned 0x1
	[0156.728] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x74f1
	[0156.728] ReadFile (in: hFile=0x47c, lpBuffer=0x26e0758, nNumberOfBytesToRead=0x74f1, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e0758*, lpNumberOfBytesRead=0x540efcc*=0x74f1, lpOverlapped=0x0) returned 1
	[0156.729] CloseHandle (hObject=0x47c) returned 1
	[0156.729] CryptDestroyKey (hKey=0x82b300) returned 1
	[0156.729] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.729] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e7ce8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0156.729] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.729] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.729] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0156.729] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.729] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x26e7da0*=0x1, dwFlags=0x0) returned 1
	[0156.730] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x26e7d6c, dwFlags=0x0) returned 1
	[0156.730] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e7db0*, pdwDataLen=0x540efd4*=0x7500, dwBufLen=0x7500 | out: pbData=0x26e7db0*, pdwDataLen=0x540efd4*=0x7500) returned 1
	[0156.730] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ef2bc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26ef2bc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.868] CryptDestroyKey (hKey=0x82b080) returned 1
	[0156.868] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.868] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3", lpFilePart=0x0) returned 0x2c
	[0156.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rz6asr2d.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.870] GetFileType (hFile=0x47c) returned 0x1
	[0156.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.870] GetFileType (hFile=0x47c) returned 0x1
	[0156.870] WriteFile (in: hFile=0x47c, lpBuffer=0x26e7db0*, nNumberOfBytesToWrite=0x7500, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26e7db0*, lpNumberOfBytesWritten=0x540efc0*=0x7500, lpOverlapped=0x0) returned 1
	[0156.871] CloseHandle (hObject=0x47c) returned 1
	[0156.872] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3", lpFilePart=0x0) returned 0x2c
	[0156.872] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0156.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rz6asr2d.mp3"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbf7fb0, ftCreationTime.dwHighDateTime=0x1d4d441, ftLastAccessTime.dwLowDateTime=0x2edacc20, ftLastAccessTime.dwHighDateTime=0x1d4d509, ftLastWriteTime.dwLowDateTime=0x97d4d3a5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7500)) returned 1
	[0156.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.872] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rz6asr2d.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rZ6ASR2d.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rz6asr2d.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.873] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx", lpFilePart=0x0) returned 0x39
	[0156.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\shknwzzedoosg0m13lu5.pptx"), fInfoLevelId=0x0, lpFileInformation=0x26ef640 | out: lpFileInformation=0x26ef640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2590cc20, ftCreationTime.dwHighDateTime=0x1d4d5cf, ftLastAccessTime.dwLowDateTime=0xe75b480, ftLastAccessTime.dwHighDateTime=0x1d4ca01, ftLastWriteTime.dwLowDateTime=0xe75b480, ftLastWriteTime.dwHighDateTime=0x1d4ca01, nFileSizeHigh=0x0, nFileSizeLow=0x1f15)) returned 1
	[0156.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx", lpFilePart=0x0) returned 0x39
	[0156.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\shknwzzedoosg0m13lu5.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.874] GetFileType (hFile=0x47c) returned 0x1
	[0156.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.874] GetFileType (hFile=0x47c) returned 0x1
	[0156.874] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1f15
	[0156.874] ReadFile (in: hFile=0x47c, lpBuffer=0x26ef898, nNumberOfBytesToRead=0x1f15, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ef898*, lpNumberOfBytesRead=0x540efcc*=0x1f15, lpOverlapped=0x0) returned 1
	[0156.875] CloseHandle (hObject=0x47c) returned 1
	[0156.875] CryptDestroyKey (hKey=0x82b340) returned 1
	[0156.875] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.875] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f184c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0156.875] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.875] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.876] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0156.876] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.876] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26f1904*=0x1, dwFlags=0x0) returned 1
	[0156.876] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26f18d0, dwFlags=0x0) returned 1
	[0156.876] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f1914*, pdwDataLen=0x540efd4*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x26f1914*, pdwDataLen=0x540efd4*=0x1f20) returned 1
	[0156.876] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f3840*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f3840*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.876] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0156.876] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.876] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.876] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx", lpFilePart=0x0) returned 0x39
	[0156.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.876] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\shknwzzedoosg0m13lu5.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.989] GetFileType (hFile=0x47c) returned 0x1
	[0156.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.989] GetFileType (hFile=0x47c) returned 0x1
	[0156.989] WriteFile (in: hFile=0x47c, lpBuffer=0x26f1914*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26f1914*, lpNumberOfBytesWritten=0x540efc0*=0x1f20, lpOverlapped=0x0) returned 1
	[0156.990] CloseHandle (hObject=0x47c) returned 1
	[0156.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx", lpFilePart=0x0) returned 0x39
	[0156.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0156.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.991] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\shknwzzedoosg0m13lu5.pptx"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2590cc20, ftCreationTime.dwHighDateTime=0x1d4d5cf, ftLastAccessTime.dwLowDateTime=0xe75b480, ftLastAccessTime.dwHighDateTime=0x1d4ca01, ftLastWriteTime.dwLowDateTime=0x97e7e67c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f20)) returned 1
	[0156.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.991] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\shknwzzedoosg0m13lu5.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SHknWzZEDOOsg0m13LU5.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\shknwzzedoosg0m13lu5.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png", lpFilePart=0x0) returned 0x35
	[0156.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0156.992] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\trng3jueby-3n8lan.png"), fInfoLevelId=0x0, lpFileInformation=0x26f3c60 | out: lpFileInformation=0x26f3c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa038720, ftCreationTime.dwHighDateTime=0x1d4ce15, ftLastAccessTime.dwLowDateTime=0xc5c93370, ftLastAccessTime.dwHighDateTime=0x1d4c96e, ftLastWriteTime.dwLowDateTime=0xc5c93370, ftLastWriteTime.dwHighDateTime=0x1d4c96e, nFileSizeHigh=0x0, nFileSizeLow=0x910c)) returned 1
	[0156.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0156.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png", lpFilePart=0x0) returned 0x35
	[0156.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0156.993] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\trng3jueby-3n8lan.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.993] GetFileType (hFile=0x47c) returned 0x1
	[0156.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0156.993] GetFileType (hFile=0x47c) returned 0x1
	[0156.993] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x910c
	[0156.993] ReadFile (in: hFile=0x47c, lpBuffer=0x26f3e98, nNumberOfBytesToRead=0x910c, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f3e98*, lpNumberOfBytesRead=0x540efcc*=0x910c, lpOverlapped=0x0) returned 1
	[0156.994] CloseHandle (hObject=0x47c) returned 1
	[0156.994] CryptDestroyKey (hKey=0x82b200) returned 1
	[0156.994] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.994] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fd040, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0156.994] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.994] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.994] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0156.994] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0156.994] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26fd0f8*=0x1, dwFlags=0x0) returned 1
	[0156.994] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26fd0c4, dwFlags=0x0) returned 1
	[0156.995] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fd108*, pdwDataLen=0x540efd4*=0x9110, dwBufLen=0x9110 | out: pbData=0x26fd108*, pdwDataLen=0x540efd4*=0x9110) returned 1
	[0156.995] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2706224*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2706224*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0156.995] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0156.995] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.995] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0156.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png", lpFilePart=0x0) returned 0x35
	[0156.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0156.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\trng3jueby-3n8lan.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0156.997] GetFileType (hFile=0x47c) returned 0x1
	[0156.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0156.997] GetFileType (hFile=0x47c) returned 0x1
	[0156.997] WriteFile (in: hFile=0x47c, lpBuffer=0x26fd108*, nNumberOfBytesToWrite=0x9110, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26fd108*, lpNumberOfBytesWritten=0x540efc0*=0x9110, lpOverlapped=0x0) returned 1
	[0156.998] CloseHandle (hObject=0x47c) returned 1
	[0156.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png", lpFilePart=0x0) returned 0x35
	[0156.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0156.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0156.999] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\trng3jueby-3n8lan.png"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa038720, ftCreationTime.dwHighDateTime=0x1d4ce15, ftLastAccessTime.dwLowDateTime=0xc5c93370, ftLastAccessTime.dwHighDateTime=0x1d4c96e, ftLastWriteTime.dwLowDateTime=0x97e7e67c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9110)) returned 1
	[0156.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0156.999] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\trng3jueby-3n8lan.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TRnG3JuEby-3n8lan.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\trng3jueby-3n8lan.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0156.999] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv", lpFilePart=0x0) returned 0x32
	[0156.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0157.000] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ubjf8dlfkrjbzf.mkv"), fInfoLevelId=0x0, lpFileInformation=0x2706614 | out: lpFileInformation=0x2706614*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6746e470, ftCreationTime.dwHighDateTime=0x1d4ce03, ftLastAccessTime.dwLowDateTime=0xffff52a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ca, ftLastWriteTime.dwLowDateTime=0xffff52a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ca, nFileSizeHigh=0x0, nFileSizeLow=0x10081)) returned 1
	[0157.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0157.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv", lpFilePart=0x0) returned 0x32
	[0157.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0157.000] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ubjf8dlfkrjbzf.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.000] GetFileType (hFile=0x47c) returned 0x1
	[0157.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0157.000] GetFileType (hFile=0x47c) returned 0x1
	[0157.000] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10081
	[0157.000] ReadFile (in: hFile=0x47c, lpBuffer=0x270683c, nNumberOfBytesToRead=0x10081, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x270683c*, lpNumberOfBytesRead=0x540efcc*=0x10081, lpOverlapped=0x0) returned 1
	[0157.001] CloseHandle (hObject=0x47c) returned 1
	[0157.001] CryptDestroyKey (hKey=0x82b540) returned 1
	[0157.001] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.002] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271695c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0157.002] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.002] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.002] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0157.002] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.002] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2716a14*=0x1, dwFlags=0x0) returned 1
	[0157.002] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27169e0, dwFlags=0x0) returned 1
	[0157.002] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2716a24*, pdwDataLen=0x540efd4*=0x10090, dwBufLen=0x10090 | out: pbData=0x2716a24*, pdwDataLen=0x540efd4*=0x10090) returned 1
	[0157.002] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2726ac0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2726ac0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0157.002] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0157.002] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.002] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.002] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv", lpFilePart=0x0) returned 0x32
	[0157.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0157.003] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ubjf8dlfkrjbzf.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.005] GetFileType (hFile=0x47c) returned 0x1
	[0157.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0157.005] GetFileType (hFile=0x47c) returned 0x1
	[0157.005] WriteFile (in: hFile=0x47c, lpBuffer=0x2716a24*, nNumberOfBytesToWrite=0x10090, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2716a24*, lpNumberOfBytesWritten=0x540efc0*=0x10090, lpOverlapped=0x0) returned 1
	[0157.017] CloseHandle (hObject=0x47c) returned 1
	[0157.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv", lpFilePart=0x0) returned 0x32
	[0157.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0157.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0157.017] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ubjf8dlfkrjbzf.mkv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6746e470, ftCreationTime.dwHighDateTime=0x1d4ce03, ftLastAccessTime.dwLowDateTime=0xffff52a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ca, ftLastWriteTime.dwLowDateTime=0x97ea4a07, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10090)) returned 1
	[0157.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0157.017] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ubjf8dlfkrjbzf.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\UBJf8dlFkRJbZF.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ubjf8dlfkrjbzf.mkv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0157.019] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp", lpFilePart=0x0) returned 0x2c
	[0157.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0157.019] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\uhqpvkpg.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2726e8c | out: lpFileInformation=0x2726e8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cac0700, ftCreationTime.dwHighDateTime=0x1d4ccb8, ftLastAccessTime.dwLowDateTime=0x43c668d0, ftLastAccessTime.dwHighDateTime=0x1d4d0ed, ftLastWriteTime.dwLowDateTime=0x43c668d0, ftLastWriteTime.dwHighDateTime=0x1d4d0ed, nFileSizeHigh=0x0, nFileSizeLow=0x4806)) returned 1
	[0157.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0157.019] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp", lpFilePart=0x0) returned 0x2c
	[0157.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0157.019] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\uhqpvkpg.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.020] GetFileType (hFile=0x47c) returned 0x1
	[0157.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0157.020] GetFileType (hFile=0x47c) returned 0x1
	[0157.020] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x4806
	[0157.020] ReadFile (in: hFile=0x47c, lpBuffer=0x2727084, nNumberOfBytesToRead=0x4806, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2727084*, lpNumberOfBytesRead=0x540efcc*=0x4806, lpOverlapped=0x0) returned 1
	[0157.021] CloseHandle (hObject=0x47c) returned 1
	[0157.021] CryptDestroyKey (hKey=0x82b480) returned 1
	[0157.021] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.021] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272b928, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0157.021] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.021] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.021] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0157.021] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.021] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x272b9e0*=0x1, dwFlags=0x0) returned 1
	[0157.021] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x272b9ac, dwFlags=0x0) returned 1
	[0157.021] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272b9f0*, pdwDataLen=0x540efd4*=0x4810, dwBufLen=0x4810 | out: pbData=0x272b9f0*, pdwDataLen=0x540efd4*=0x4810) returned 1
	[0157.022] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273020c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x273020c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0157.022] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0157.022] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.022] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp", lpFilePart=0x0) returned 0x2c
	[0157.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0157.022] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\uhqpvkpg.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.023] GetFileType (hFile=0x47c) returned 0x1
	[0157.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0157.023] GetFileType (hFile=0x47c) returned 0x1
	[0157.023] WriteFile (in: hFile=0x47c, lpBuffer=0x272b9f0*, nNumberOfBytesToWrite=0x4810, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x272b9f0*, lpNumberOfBytesWritten=0x540efc0*=0x4810, lpOverlapped=0x0) returned 1
	[0157.024] CloseHandle (hObject=0x47c) returned 1
	[0157.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp", lpFilePart=0x0) returned 0x2c
	[0157.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0157.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0157.025] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\uhqpvkpg.bmp"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cac0700, ftCreationTime.dwHighDateTime=0x1d4ccb8, ftLastAccessTime.dwLowDateTime=0x43c668d0, ftLastAccessTime.dwHighDateTime=0x1d4d0ed, ftLastWriteTime.dwLowDateTime=0x97ecac17, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4810)) returned 1
	[0157.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0157.025] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\uhqpvkpg.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uhqpVKPg.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\uhqpvkpg.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0157.026] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a", lpFilePart=0x0) returned 0x28
	[0157.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0157.026] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wkga.m4a"), fInfoLevelId=0x0, lpFileInformation=0x2730590 | out: lpFileInformation=0x2730590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd10b2e90, ftCreationTime.dwHighDateTime=0x1d4d18a, ftLastAccessTime.dwLowDateTime=0xf0b2ba20, ftLastAccessTime.dwHighDateTime=0x1d4c76b, ftLastWriteTime.dwLowDateTime=0xf0b2ba20, ftLastWriteTime.dwHighDateTime=0x1d4c76b, nFileSizeHigh=0x0, nFileSizeLow=0xda2b)) returned 1
	[0157.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0157.026] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a", lpFilePart=0x0) returned 0x28
	[0157.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0157.026] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wkga.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.026] GetFileType (hFile=0x47c) returned 0x1
	[0157.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0157.026] GetFileType (hFile=0x47c) returned 0x1
	[0157.026] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xda2b
	[0157.027] ReadFile (in: hFile=0x47c, lpBuffer=0x2730768, nNumberOfBytesToRead=0xda2b, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2730768*, lpNumberOfBytesRead=0x540efcc*=0xda2b, lpOverlapped=0x0) returned 1
	[0157.027] CloseHandle (hObject=0x47c) returned 1
	[0157.028] CryptDestroyKey (hKey=0x82b540) returned 1
	[0157.028] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.028] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273e230, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0157.028] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.028] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.028] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0157.028] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.028] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x273e2e8*=0x1, dwFlags=0x0) returned 1
	[0157.028] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x273e2b4, dwFlags=0x0) returned 1
	[0157.028] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273e2f8*, pdwDataLen=0x540efd4*=0xda30, dwBufLen=0xda30 | out: pbData=0x273e2f8*, pdwDataLen=0x540efd4*=0xda30) returned 1
	[0157.028] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274bd34*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x274bd34*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0157.028] CryptDestroyKey (hKey=0x82b100) returned 1
	[0157.028] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.029] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.029] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a", lpFilePart=0x0) returned 0x28
	[0157.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0157.029] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wkga.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.030] GetFileType (hFile=0x47c) returned 0x1
	[0157.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0157.030] GetFileType (hFile=0x47c) returned 0x1
	[0157.030] WriteFile (in: hFile=0x47c, lpBuffer=0x273e2f8*, nNumberOfBytesToWrite=0xda30, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x273e2f8*, lpNumberOfBytesWritten=0x540efc0*=0xda30, lpOverlapped=0x0) returned 1
	[0157.032] CloseHandle (hObject=0x47c) returned 1
	[0157.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a", lpFilePart=0x0) returned 0x28
	[0157.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0157.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0157.032] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wkga.m4a"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd10b2e90, ftCreationTime.dwHighDateTime=0x1d4d18a, ftLastAccessTime.dwLowDateTime=0xf0b2ba20, ftLastAccessTime.dwHighDateTime=0x1d4c76b, ftLastWriteTime.dwLowDateTime=0x97ecac17, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xda30)) returned 1
	[0157.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0157.033] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wkga.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wkgA.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wkga.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0157.033] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx", lpFilePart=0x0) returned 0x39
	[0157.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0157.033] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xgn92eaznnlviwxtrzgc.pptx"), fInfoLevelId=0x0, lpFileInformation=0x274c088 | out: lpFileInformation=0x274c088*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9f4980, ftCreationTime.dwHighDateTime=0x1d4c99a, ftLastAccessTime.dwLowDateTime=0x777d2600, ftLastAccessTime.dwHighDateTime=0x1d4cd82, ftLastWriteTime.dwLowDateTime=0x777d2600, ftLastWriteTime.dwHighDateTime=0x1d4cd82, nFileSizeHigh=0x0, nFileSizeLow=0xaa4b)) returned 1
	[0157.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0157.034] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx", lpFilePart=0x0) returned 0x39
	[0157.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0157.034] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xgn92eaznnlviwxtrzgc.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.082] GetFileType (hFile=0x47c) returned 0x1
	[0157.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0157.082] GetFileType (hFile=0x47c) returned 0x1
	[0157.082] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xaa4b
	[0157.082] ReadFile (in: hFile=0x47c, lpBuffer=0x274c2e0, nNumberOfBytesToRead=0xaa4b, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x274c2e0*, lpNumberOfBytesRead=0x540efcc*=0xaa4b, lpOverlapped=0x0) returned 1
	[0157.083] CloseHandle (hObject=0x47c) returned 1
	[0157.083] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0157.083] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.084] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2756dc8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0157.084] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.084] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.084] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0157.084] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.084] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2756e80*=0x1, dwFlags=0x0) returned 1
	[0157.084] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2756e4c, dwFlags=0x0) returned 1
	[0157.084] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2756e90*, pdwDataLen=0x540efd4*=0xaa50, dwBufLen=0xaa50 | out: pbData=0x2756e90*, pdwDataLen=0x540efd4*=0xaa50) returned 1
	[0157.084] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27618ec*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27618ec*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0157.084] CryptDestroyKey (hKey=0x82b000) returned 1
	[0157.084] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.084] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.084] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx", lpFilePart=0x0) returned 0x39
	[0157.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0157.085] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xgn92eaznnlviwxtrzgc.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.086] GetFileType (hFile=0x47c) returned 0x1
	[0157.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0157.086] GetFileType (hFile=0x47c) returned 0x1
	[0157.086] WriteFile (in: hFile=0x47c, lpBuffer=0x2756e90*, nNumberOfBytesToWrite=0xaa50, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2756e90*, lpNumberOfBytesWritten=0x540efc0*=0xaa50, lpOverlapped=0x0) returned 1
	[0157.088] CloseHandle (hObject=0x47c) returned 1
	[0157.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx", lpFilePart=0x0) returned 0x39
	[0157.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0157.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0157.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xgn92eaznnlviwxtrzgc.pptx"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9f4980, ftCreationTime.dwHighDateTime=0x1d4c99a, ftLastAccessTime.dwLowDateTime=0x777d2600, ftLastAccessTime.dwHighDateTime=0x1d4cd82, ftLastWriteTime.dwLowDateTime=0x97f63579, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xaa50)) returned 1
	[0157.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0157.088] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xgn92eaznnlviwxtrzgc.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Xgn92eAznnLviwxTrZgc.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xgn92eaznnlviwxtrzgc.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0157.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt", lpFilePart=0x0) returned 0x38
	[0157.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0157.089] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xguwmsdy8czxlsgkjkhz.odt"), fInfoLevelId=0x0, lpFileInformation=0x2761d0c | out: lpFileInformation=0x2761d0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba988c0, ftCreationTime.dwHighDateTime=0x1d4cf91, ftLastAccessTime.dwLowDateTime=0x62b19c10, ftLastAccessTime.dwHighDateTime=0x1d4ce8b, ftLastWriteTime.dwLowDateTime=0x62b19c10, ftLastWriteTime.dwHighDateTime=0x1d4ce8b, nFileSizeHigh=0x0, nFileSizeLow=0x11fd2)) returned 1
	[0157.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0160.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp", lpFilePart=0x0) returned 0x2c
	[0160.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0160.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\tdh5gw.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.817] GetFileType (hFile=0x47c) returned 0x1
	[0160.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0160.817] GetFileType (hFile=0x47c) returned 0x1
	[0160.817] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x16245
	[0160.818] ReadFile (in: hFile=0x47c, lpBuffer=0x9262100, nNumberOfBytesToRead=0x16245, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x9262100*, lpNumberOfBytesRead=0x540efcc*=0x16245, lpOverlapped=0x0) returned 1
	[0160.820] CloseHandle (hObject=0x47c) returned 1
	[0160.820] CryptDestroyKey (hKey=0x82b400) returned 1
	[0160.820] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.820] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b23d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0160.820] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.820] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.821] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0160.821] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.821] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26b2490*=0x1, dwFlags=0x0) returned 1
	[0160.821] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26b245c, dwFlags=0x0) returned 1
	[0160.822] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9278368*, pdwDataLen=0x540efd4*=0x16250, dwBufLen=0x16250 | out: pbData=0x9278368*, pdwDataLen=0x540efd4*=0x16250) returned 1
	[0160.823] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b24a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b24a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0160.823] CryptDestroyKey (hKey=0x82b540) returned 1
	[0160.823] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.823] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.823] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp", lpFilePart=0x0) returned 0x2c
	[0160.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0160.823] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\tdh5gw.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.825] GetFileType (hFile=0x47c) returned 0x1
	[0160.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0160.825] GetFileType (hFile=0x47c) returned 0x1
	[0160.825] WriteFile (in: hFile=0x47c, lpBuffer=0x9278368*, nNumberOfBytesToWrite=0x16250, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x9278368*, lpNumberOfBytesWritten=0x540efc0*=0x16250, lpOverlapped=0x0) returned 1
	[0160.827] CloseHandle (hObject=0x47c) returned 1
	[0160.828] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp", lpFilePart=0x0) returned 0x2c
	[0160.828] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0160.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0160.828] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\tdh5gw.odp"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21310e0, ftCreationTime.dwHighDateTime=0x1d4d4da, ftLastAccessTime.dwLowDateTime=0xf93222c0, ftLastAccessTime.dwHighDateTime=0x1d4c5d7, ftLastWriteTime.dwLowDateTime=0x9a3006eb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1
	[0160.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0160.828] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\tdh5gw.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\tdh5gw.odp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.829] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps", lpFilePart=0x0) returned 0x32
	[0160.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0160.829] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\vuvpg _uecxm.pps"), fInfoLevelId=0x0, lpFileInformation=0x26b2820 | out: lpFileInformation=0x26b2820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1495410, ftCreationTime.dwHighDateTime=0x1d4c662, ftLastAccessTime.dwLowDateTime=0x4c984670, ftLastAccessTime.dwHighDateTime=0x1d4d2f7, ftLastWriteTime.dwLowDateTime=0x4c984670, ftLastWriteTime.dwHighDateTime=0x1d4d2f7, nFileSizeHigh=0x0, nFileSizeLow=0x1493a)) returned 1
	[0160.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0160.829] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps", lpFilePart=0x0) returned 0x32
	[0160.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0160.829] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\vuvpg _uecxm.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.829] GetFileType (hFile=0x47c) returned 0x1
	[0160.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0160.829] GetFileType (hFile=0x47c) returned 0x1
	[0160.829] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1493a
	[0160.830] ReadFile (in: hFile=0x47c, lpBuffer=0x26b2a40, nNumberOfBytesToRead=0x1493a, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26b2a40*, lpNumberOfBytesRead=0x540efcc*=0x1493a, lpOverlapped=0x0) returned 1
	[0160.831] CloseHandle (hObject=0x47c) returned 1
	[0160.845] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0160.845] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.845] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c7418, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0160.845] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.845] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.845] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0160.845] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.845] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26c74d0*=0x1, dwFlags=0x0) returned 1
	[0160.845] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26c749c, dwFlags=0x0) returned 1
	[0160.845] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c74e0*, pdwDataLen=0x540efd4*=0x14940, dwBufLen=0x14940 | out: pbData=0x26c74e0*, pdwDataLen=0x540efd4*=0x14940) returned 1
	[0160.845] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dbe2c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26dbe2c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0160.845] CryptDestroyKey (hKey=0x82b280) returned 1
	[0160.845] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.845] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps", lpFilePart=0x0) returned 0x32
	[0160.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0160.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\vuvpg _uecxm.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.848] GetFileType (hFile=0x47c) returned 0x1
	[0160.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0160.849] GetFileType (hFile=0x47c) returned 0x1
	[0160.849] WriteFile (in: hFile=0x47c, lpBuffer=0x26c74e0*, nNumberOfBytesToWrite=0x14940, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26c74e0*, lpNumberOfBytesWritten=0x540efc0*=0x14940, lpOverlapped=0x0) returned 1
	[0160.851] CloseHandle (hObject=0x47c) returned 1
	[0160.851] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps", lpFilePart=0x0) returned 0x32
	[0160.851] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0160.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0160.851] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\vuvpg _uecxm.pps"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1495410, ftCreationTime.dwHighDateTime=0x1d4c662, ftLastAccessTime.dwLowDateTime=0x4c984670, ftLastAccessTime.dwHighDateTime=0x1d4d2f7, ftLastWriteTime.dwLowDateTime=0x9a34cb81, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x14940)) returned 1
	[0160.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0160.852] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\vuvpg _uecxm.pps"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\vUVPg _uEcXm.pps id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\vuvpg _uecxm.pps id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.856] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp", lpFilePart=0x0) returned 0x33
	[0160.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0160.856] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\w22xron4tbcdy.odp"), fInfoLevelId=0x0, lpFileInformation=0x26dc1f4 | out: lpFileInformation=0x26dc1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ad83d0, ftCreationTime.dwHighDateTime=0x1d4c688, ftLastAccessTime.dwLowDateTime=0xd01e2090, ftLastAccessTime.dwHighDateTime=0x1d4d1b8, ftLastWriteTime.dwLowDateTime=0xd01e2090, ftLastWriteTime.dwHighDateTime=0x1d4d1b8, nFileSizeHigh=0x0, nFileSizeLow=0xad20)) returned 1
	[0160.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0160.857] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp", lpFilePart=0x0) returned 0x33
	[0160.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0160.857] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\w22xron4tbcdy.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.857] GetFileType (hFile=0x47c) returned 0x1
	[0160.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0160.857] GetFileType (hFile=0x47c) returned 0x1
	[0160.857] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xad20
	[0160.857] ReadFile (in: hFile=0x47c, lpBuffer=0x26dc414, nNumberOfBytesToRead=0xad20, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26dc414*, lpNumberOfBytesRead=0x540efcc*=0xad20, lpOverlapped=0x0) returned 1
	[0160.858] CloseHandle (hObject=0x47c) returned 1
	[0160.858] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0160.858] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.858] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e71d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0160.859] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.859] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.859] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0160.859] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.859] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26e7288*=0x1, dwFlags=0x0) returned 1
	[0160.859] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26e7254, dwFlags=0x0) returned 1
	[0160.859] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e7298*, pdwDataLen=0x540efd4*=0xad30, dwBufLen=0xad30 | out: pbData=0x26e7298*, pdwDataLen=0x540efd4*=0xad30) returned 1
	[0160.859] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f1fd4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f1fd4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0160.859] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0160.859] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.859] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.859] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp", lpFilePart=0x0) returned 0x33
	[0160.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0160.859] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\w22xron4tbcdy.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.861] GetFileType (hFile=0x47c) returned 0x1
	[0160.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0160.861] GetFileType (hFile=0x47c) returned 0x1
	[0160.861] WriteFile (in: hFile=0x47c, lpBuffer=0x26e7298*, nNumberOfBytesToWrite=0xad30, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26e7298*, lpNumberOfBytesWritten=0x540efc0*=0xad30, lpOverlapped=0x0) returned 1
	[0160.864] CloseHandle (hObject=0x47c) returned 1
	[0160.864] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp", lpFilePart=0x0) returned 0x33
	[0160.864] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x62
	[0160.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0160.864] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\w22xron4tbcdy.odp"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ad83d0, ftCreationTime.dwHighDateTime=0x1d4c688, ftLastAccessTime.dwLowDateTime=0xd01e2090, ftLastAccessTime.dwHighDateTime=0x1d4d1b8, ftLastWriteTime.dwLowDateTime=0x9a372e46, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xad30)) returned 1
	[0160.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0160.865] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\w22xron4tbcdy.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\W22XRON4TBCDy.odp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\w22xron4tbcdy.odp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.865] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", lpFilePart=0x0) returned 0x2b
	[0160.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0160.865] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26f23a8 | out: lpFileInformation=0x26f23a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1
	[0160.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0160.866] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", lpFilePart=0x0) returned 0x2b
	[0160.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0160.866] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.866] GetFileType (hFile=0x47c) returned 0x1
	[0160.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0160.866] GetFileType (hFile=0x47c) returned 0x1
	[0160.866] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x50
	[0160.866] ReadFile (in: hFile=0x47c, lpBuffer=0x26f25ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f25ec*, lpNumberOfBytesRead=0x540efcc*=0x50, lpOverlapped=0x0) returned 1
	[0160.925] CloseHandle (hObject=0x47c) returned 1
	[0160.925] CryptDestroyKey (hKey=0x82b540) returned 1
	[0160.925] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.926] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f3688, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0160.926] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.926] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.926] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0160.926] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.926] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26f3740*=0x1, dwFlags=0x0) returned 1
	[0160.926] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26f370c, dwFlags=0x0) returned 1
	[0160.926] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f3750*, pdwDataLen=0x540efd4*=0x60, dwBufLen=0x60 | out: pbData=0x26f3750*, pdwDataLen=0x540efd4*=0x60) returned 1
	[0160.926] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f37bc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f37bc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0160.926] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0160.926] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.926] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.926] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", lpFilePart=0x0) returned 0x2b
	[0160.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0160.926] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0160.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0160.928] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3", lpFilePart=0x0) returned 0x3a
	[0160.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0160.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\5e6eznulgqvyhz.mp3"), fInfoLevelId=0x0, lpFileInformation=0x26f3cd8 | out: lpFileInformation=0x26f3cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323a6500, ftCreationTime.dwHighDateTime=0x1d4ccbd, ftLastAccessTime.dwLowDateTime=0x57897d50, ftLastAccessTime.dwHighDateTime=0x1d4cf3d, ftLastWriteTime.dwLowDateTime=0x57897d50, ftLastWriteTime.dwHighDateTime=0x1d4cf3d, nFileSizeHigh=0x0, nFileSizeLow=0x935)) returned 1
	[0160.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0160.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3", lpFilePart=0x0) returned 0x3a
	[0160.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0160.929] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\5e6eznulgqvyhz.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.929] GetFileType (hFile=0x47c) returned 0x1
	[0160.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0160.929] GetFileType (hFile=0x47c) returned 0x1
	[0160.929] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x935
	[0160.929] ReadFile (in: hFile=0x47c, lpBuffer=0x26f4864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f4864*, lpNumberOfBytesRead=0x540efcc*=0x935, lpOverlapped=0x0) returned 1
	[0160.930] CloseHandle (hObject=0x47c) returned 1
	[0160.930] CryptDestroyKey (hKey=0x82b440) returned 1
	[0160.930] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.930] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f5900, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0160.930] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.930] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.930] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0160.931] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.931] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x26f59b8*=0x1, dwFlags=0x0) returned 1
	[0160.931] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26f5984, dwFlags=0x0) returned 1
	[0160.931] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f59c8*, pdwDataLen=0x540efd4*=0x940, dwBufLen=0x940 | out: pbData=0x26f59c8*, pdwDataLen=0x540efd4*=0x940) returned 1
	[0160.931] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f6314*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f6314*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0160.931] CryptDestroyKey (hKey=0x82b400) returned 1
	[0160.931] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.931] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.931] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3", lpFilePart=0x0) returned 0x3a
	[0160.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0160.931] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\5e6eznulgqvyhz.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.933] GetFileType (hFile=0x47c) returned 0x1
	[0160.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0160.933] GetFileType (hFile=0x47c) returned 0x1
	[0160.933] WriteFile (in: hFile=0x47c, lpBuffer=0x26f6444*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26f6444*, lpNumberOfBytesWritten=0x540ef94*=0x940, lpOverlapped=0x0) returned 1
	[0160.934] CloseHandle (hObject=0x47c) returned 1
	[0160.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3", lpFilePart=0x0) returned 0x3a
	[0160.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0160.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0160.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\5e6eznulgqvyhz.mp3"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323a6500, ftCreationTime.dwHighDateTime=0x1d4ccbd, ftLastAccessTime.dwLowDateTime=0x57897d50, ftLastAccessTime.dwHighDateTime=0x1d4cf3d, ftLastWriteTime.dwLowDateTime=0x9a40b76d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x940)) returned 1
	[0160.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0160.935] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\5e6eznulgqvyhz.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\5E6eznUlgQvyhz.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\5e6eznulgqvyhz.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.935] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav", lpFilePart=0x0) returned 0x37
	[0160.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0160.936] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\ku1ia7l1snb.wav"), fInfoLevelId=0x0, lpFileInformation=0x26f773c | out: lpFileInformation=0x26f773c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1292f0, ftCreationTime.dwHighDateTime=0x1d4ca2a, ftLastAccessTime.dwLowDateTime=0x4ffe1570, ftLastAccessTime.dwHighDateTime=0x1d4d080, ftLastWriteTime.dwLowDateTime=0x4ffe1570, ftLastWriteTime.dwHighDateTime=0x1d4d080, nFileSizeHigh=0x0, nFileSizeLow=0xe123)) returned 1
	[0160.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0160.936] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav", lpFilePart=0x0) returned 0x37
	[0160.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0160.936] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\ku1ia7l1snb.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.936] GetFileType (hFile=0x47c) returned 0x1
	[0160.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0160.936] GetFileType (hFile=0x47c) returned 0x1
	[0160.936] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xe123
	[0160.936] ReadFile (in: hFile=0x47c, lpBuffer=0x26f7964, nNumberOfBytesToRead=0xe123, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f7964*, lpNumberOfBytesRead=0x540efcc*=0xe123, lpOverlapped=0x0) returned 1
	[0160.937] CloseHandle (hObject=0x47c) returned 1
	[0160.937] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0160.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.937] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2705b24, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0160.938] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.938] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.938] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0160.938] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.938] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2705bdc*=0x1, dwFlags=0x0) returned 1
	[0160.938] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2705ba8, dwFlags=0x0) returned 1
	[0160.938] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2705bec*, pdwDataLen=0x540efd4*=0xe130, dwBufLen=0xe130 | out: pbData=0x2705bec*, pdwDataLen=0x540efd4*=0xe130) returned 1
	[0160.938] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2713d28*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2713d28*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0160.938] CryptDestroyKey (hKey=0x82b300) returned 1
	[0160.938] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.938] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.938] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav", lpFilePart=0x0) returned 0x37
	[0160.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0160.938] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\ku1ia7l1snb.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.940] GetFileType (hFile=0x47c) returned 0x1
	[0160.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0160.940] GetFileType (hFile=0x47c) returned 0x1
	[0160.940] WriteFile (in: hFile=0x47c, lpBuffer=0x2705bec*, nNumberOfBytesToWrite=0xe130, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2705bec*, lpNumberOfBytesWritten=0x540efc0*=0xe130, lpOverlapped=0x0) returned 1
	[0160.942] CloseHandle (hObject=0x47c) returned 1
	[0160.942] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav", lpFilePart=0x0) returned 0x37
	[0160.942] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0160.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0160.942] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\ku1ia7l1snb.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1292f0, ftCreationTime.dwHighDateTime=0x1d4ca2a, ftLastAccessTime.dwLowDateTime=0x4ffe1570, ftLastAccessTime.dwHighDateTime=0x1d4d080, ftLastWriteTime.dwLowDateTime=0x9a431979, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xe130)) returned 1
	[0160.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0160.943] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\ku1ia7l1snb.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\ku1ia7l1SnB.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\ku1ia7l1snb.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3", lpFilePart=0x0) returned 0x35
	[0160.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0160.944] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\wweaoylkv.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2714120 | out: lpFileInformation=0x2714120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751173a0, ftCreationTime.dwHighDateTime=0x1d4d4c9, ftLastAccessTime.dwLowDateTime=0xe4063990, ftLastAccessTime.dwHighDateTime=0x1d4c591, ftLastWriteTime.dwLowDateTime=0xe4063990, ftLastWriteTime.dwHighDateTime=0x1d4c591, nFileSizeHigh=0x0, nFileSizeLow=0x16d3c)) returned 1
	[0160.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0160.944] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3", lpFilePart=0x0) returned 0x35
	[0160.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0160.944] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\wweaoylkv.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.944] GetFileType (hFile=0x47c) returned 0x1
	[0160.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0160.944] GetFileType (hFile=0x47c) returned 0x1
	[0160.944] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x16d3c
	[0160.945] ReadFile (in: hFile=0x47c, lpBuffer=0x928e5d8, nNumberOfBytesToRead=0x16d3c, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x928e5d8*, lpNumberOfBytesRead=0x540efcc*=0x16d3c, lpOverlapped=0x0) returned 1
	[0160.947] CloseHandle (hObject=0x47c) returned 1
	[0160.947] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0160.947] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.947] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27143c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0160.947] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.947] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.947] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0160.947] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.947] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2714480*=0x1, dwFlags=0x0) returned 1
	[0160.947] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x271444c, dwFlags=0x0) returned 1
	[0160.949] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92a5330*, pdwDataLen=0x540efd4*=0x16d40, dwBufLen=0x16d40 | out: pbData=0x92a5330*, pdwDataLen=0x540efd4*=0x16d40) returned 1
	[0160.949] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2714490*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2714490*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0160.949] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0160.949] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.949] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3", lpFilePart=0x0) returned 0x35
	[0160.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0160.949] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\wweaoylkv.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.951] GetFileType (hFile=0x47c) returned 0x1
	[0160.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0160.951] GetFileType (hFile=0x47c) returned 0x1
	[0160.951] WriteFile (in: hFile=0x47c, lpBuffer=0x92a5330*, nNumberOfBytesToWrite=0x16d40, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x92a5330*, lpNumberOfBytesWritten=0x540efc0*=0x16d40, lpOverlapped=0x0) returned 1
	[0160.953] CloseHandle (hObject=0x47c) returned 1
	[0160.954] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3", lpFilePart=0x0) returned 0x35
	[0160.954] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0160.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0160.954] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\wweaoylkv.mp3"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751173a0, ftCreationTime.dwHighDateTime=0x1d4d4c9, ftLastAccessTime.dwLowDateTime=0xe4063990, ftLastAccessTime.dwHighDateTime=0x1d4c591, ftLastWriteTime.dwLowDateTime=0x9a431979, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x16d40)) returned 1
	[0160.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0160.954] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\wweaoylkv.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\nCaY_RHIYTRM2m91L\\wwEaoYlkV.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\ncay_rhiytrm2m91l\\wweaoylkv.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav", lpFilePart=0x0) returned 0x2d
	[0160.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0160.955] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\d vreuj9g.wav"), fInfoLevelId=0x0, lpFileInformation=0x2714870 | out: lpFileInformation=0x2714870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3440c090, ftCreationTime.dwHighDateTime=0x1d4d5b6, ftLastAccessTime.dwLowDateTime=0x612b4470, ftLastAccessTime.dwHighDateTime=0x1d4d09f, ftLastWriteTime.dwLowDateTime=0x612b4470, ftLastWriteTime.dwHighDateTime=0x1d4d09f, nFileSizeHigh=0x0, nFileSizeLow=0x3972)) returned 1
	[0160.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0160.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav", lpFilePart=0x0) returned 0x2d
	[0160.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0160.955] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\d vreuj9g.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.955] GetFileType (hFile=0x47c) returned 0x1
	[0160.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0160.955] GetFileType (hFile=0x47c) returned 0x1
	[0160.956] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3972
	[0160.956] ReadFile (in: hFile=0x47c, lpBuffer=0x2714a68, nNumberOfBytesToRead=0x3972, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2714a68*, lpNumberOfBytesRead=0x540efcc*=0x3972, lpOverlapped=0x0) returned 1
	[0160.957] CloseHandle (hObject=0x47c) returned 1
	[0160.957] CryptDestroyKey (hKey=0x82b280) returned 1
	[0160.957] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.957] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2718478, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0160.957] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.957] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.957] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0160.957] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.957] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2718530*=0x1, dwFlags=0x0) returned 1
	[0160.957] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27184fc, dwFlags=0x0) returned 1
	[0160.957] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2718540*, pdwDataLen=0x540efd4*=0x3980, dwBufLen=0x3980 | out: pbData=0x2718540*, pdwDataLen=0x540efd4*=0x3980) returned 1
	[0160.957] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271becc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271becc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0160.957] CryptDestroyKey (hKey=0x82b380) returned 1
	[0160.957] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.957] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav", lpFilePart=0x0) returned 0x2d
	[0160.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0160.958] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\d vreuj9g.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.959] GetFileType (hFile=0x47c) returned 0x1
	[0160.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0160.959] GetFileType (hFile=0x47c) returned 0x1
	[0160.959] WriteFile (in: hFile=0x47c, lpBuffer=0x2718540*, nNumberOfBytesToWrite=0x3980, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2718540*, lpNumberOfBytesWritten=0x540efc0*=0x3980, lpOverlapped=0x0) returned 1
	[0160.960] CloseHandle (hObject=0x47c) returned 1
	[0160.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav", lpFilePart=0x0) returned 0x2d
	[0160.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0160.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0160.960] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\d vreuj9g.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3440c090, ftCreationTime.dwHighDateTime=0x1d4d5b6, ftLastAccessTime.dwLowDateTime=0x612b4470, ftLastAccessTime.dwHighDateTime=0x1d4d09f, ftLastWriteTime.dwLowDateTime=0x9a457cd4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3980)) returned 1
	[0160.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0160.961] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\d vreuj9g.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\d VrEuJ9G.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\d vreuj9g.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.961] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav", lpFilePart=0x0) returned 0x2a
	[0160.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0160.961] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\d-ze1l.wav"), fInfoLevelId=0x0, lpFileInformation=0x271c25c | out: lpFileInformation=0x271c25c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48594fc0, ftCreationTime.dwHighDateTime=0x1d4cb4d, ftLastAccessTime.dwLowDateTime=0x55b722f0, ftLastAccessTime.dwHighDateTime=0x1d4c5a8, ftLastWriteTime.dwLowDateTime=0x55b722f0, ftLastWriteTime.dwHighDateTime=0x1d4c5a8, nFileSizeHigh=0x0, nFileSizeLow=0x16ed8)) returned 1
	[0160.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0160.962] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav", lpFilePart=0x0) returned 0x2a
	[0160.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0160.962] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\d-ze1l.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.962] GetFileType (hFile=0x47c) returned 0x1
	[0160.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0160.962] GetFileType (hFile=0x47c) returned 0x1
	[0160.962] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x16ed8
	[0160.963] ReadFile (in: hFile=0x47c, lpBuffer=0x92bc090, nNumberOfBytesToRead=0x16ed8, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x92bc090*, lpNumberOfBytesRead=0x540efcc*=0x16ed8, lpOverlapped=0x0) returned 1
	[0160.965] CloseHandle (hObject=0x47c) returned 1
	[0160.965] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0160.965] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.965] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271c4d4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0160.965] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.965] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.965] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0160.965] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.965] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x271c58c*=0x1, dwFlags=0x0) returned 1
	[0160.965] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x271c558, dwFlags=0x0) returned 1
	[0160.967] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92d2f88*, pdwDataLen=0x540efd4*=0x16ee0, dwBufLen=0x16ee0 | out: pbData=0x92d2f88*, pdwDataLen=0x540efd4*=0x16ee0) returned 1
	[0160.967] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271c59c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271c59c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0160.967] CryptDestroyKey (hKey=0x82b280) returned 1
	[0160.967] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.967] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.967] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav", lpFilePart=0x0) returned 0x2a
	[0160.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0160.967] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\d-ze1l.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.969] GetFileType (hFile=0x47c) returned 0x1
	[0160.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0160.969] GetFileType (hFile=0x47c) returned 0x1
	[0160.969] WriteFile (in: hFile=0x47c, lpBuffer=0x92d2f88*, nNumberOfBytesToWrite=0x16ee0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x92d2f88*, lpNumberOfBytesWritten=0x540efc0*=0x16ee0, lpOverlapped=0x0) returned 1
	[0161.019] CloseHandle (hObject=0x47c) returned 1
	[0161.019] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav", lpFilePart=0x0) returned 0x2a
	[0161.019] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0161.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.019] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\d-ze1l.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48594fc0, ftCreationTime.dwHighDateTime=0x1d4cb4d, ftLastAccessTime.dwLowDateTime=0x55b722f0, ftLastAccessTime.dwHighDateTime=0x1d4c5a8, ftLastWriteTime.dwLowDateTime=0x9a4f05ab, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x16ee0)) returned 1
	[0161.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.019] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\d-ze1l.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\D-zE1l.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\d-ze1l.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.020] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav", lpFilePart=0x0) returned 0x33
	[0161.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.020] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\eywnixdud4hy76g.wav"), fInfoLevelId=0x0, lpFileInformation=0x271c908 | out: lpFileInformation=0x271c908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b8ada0, ftCreationTime.dwHighDateTime=0x1d4ce97, ftLastAccessTime.dwLowDateTime=0x405b49a0, ftLastAccessTime.dwHighDateTime=0x1d4c6e2, ftLastWriteTime.dwLowDateTime=0x405b49a0, ftLastWriteTime.dwHighDateTime=0x1d4c6e2, nFileSizeHigh=0x0, nFileSizeLow=0x68d)) returned 1
	[0161.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.021] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav", lpFilePart=0x0) returned 0x33
	[0161.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.021] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\eywnixdud4hy76g.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.021] GetFileType (hFile=0x47c) returned 0x1
	[0161.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.021] GetFileType (hFile=0x47c) returned 0x1
	[0161.021] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x68d
	[0161.021] ReadFile (in: hFile=0x47c, lpBuffer=0x271d1cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271d1cc*, lpNumberOfBytesRead=0x540efcc*=0x68d, lpOverlapped=0x0) returned 1
	[0161.022] CloseHandle (hObject=0x47c) returned 1
	[0161.022] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0161.022] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.022] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271e268, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0161.022] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.022] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.022] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0161.022] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.022] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x271e320*=0x1, dwFlags=0x0) returned 1
	[0161.023] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x271e2ec, dwFlags=0x0) returned 1
	[0161.023] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271e330*, pdwDataLen=0x540efd4*=0x690, dwBufLen=0x690 | out: pbData=0x271e330*, pdwDataLen=0x540efd4*=0x690) returned 1
	[0161.023] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271e9cc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271e9cc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.023] CryptDestroyKey (hKey=0x82b280) returned 1
	[0161.023] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.023] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav", lpFilePart=0x0) returned 0x33
	[0161.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.023] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\eywnixdud4hy76g.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.024] GetFileType (hFile=0x47c) returned 0x1
	[0161.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.024] GetFileType (hFile=0x47c) returned 0x1
	[0161.024] WriteFile (in: hFile=0x47c, lpBuffer=0x271eaec*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x271eaec*, lpNumberOfBytesWritten=0x540ef94*=0x690, lpOverlapped=0x0) returned 1
	[0161.025] CloseHandle (hObject=0x47c) returned 1
	[0161.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav", lpFilePart=0x0) returned 0x33
	[0161.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x62
	[0161.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.026] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\eywnixdud4hy76g.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b8ada0, ftCreationTime.dwHighDateTime=0x1d4ce97, ftLastAccessTime.dwLowDateTime=0x405b49a0, ftLastAccessTime.dwHighDateTime=0x1d4c6e2, ftLastWriteTime.dwLowDateTime=0x9a4f05ab, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x690)) returned 1
	[0161.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.026] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\eywnixdud4hy76g.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\eYwNIxDud4HY76g.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\eywnixdud4hy76g.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a", lpFilePart=0x0) returned 0x30
	[0161.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.027] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\i177xleaa77y.m4a"), fInfoLevelId=0x0, lpFileInformation=0x271fdb0 | out: lpFileInformation=0x271fdb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fe9d00, ftCreationTime.dwHighDateTime=0x1d4c9f3, ftLastAccessTime.dwLowDateTime=0x2d210330, ftLastAccessTime.dwHighDateTime=0x1d4c94d, ftLastWriteTime.dwLowDateTime=0x2d210330, ftLastWriteTime.dwHighDateTime=0x1d4c94d, nFileSizeHigh=0x0, nFileSizeLow=0x15a87)) returned 1
	[0161.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a", lpFilePart=0x0) returned 0x30
	[0161.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.027] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\i177xleaa77y.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.027] GetFileType (hFile=0x47c) returned 0x1
	[0161.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.027] GetFileType (hFile=0x47c) returned 0x1
	[0161.027] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x15a87
	[0161.028] ReadFile (in: hFile=0x47c, lpBuffer=0x92e9e88, nNumberOfBytesToRead=0x15a87, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x92e9e88*, lpNumberOfBytesRead=0x540efcc*=0x15a87, lpOverlapped=0x0) returned 1
	[0161.030] CloseHandle (hObject=0x47c) returned 1
	[0161.030] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0161.030] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.030] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2720058, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0161.030] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.030] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.030] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0161.030] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.030] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2720110*=0x1, dwFlags=0x0) returned 1
	[0161.030] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27200dc, dwFlags=0x0) returned 1
	[0161.032] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92ff930*, pdwDataLen=0x540efd4*=0x15a90, dwBufLen=0x15a90 | out: pbData=0x92ff930*, pdwDataLen=0x540efd4*=0x15a90) returned 1
	[0161.032] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2720120*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2720120*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.032] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0161.032] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.032] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a", lpFilePart=0x0) returned 0x30
	[0161.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.032] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\i177xleaa77y.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.034] GetFileType (hFile=0x47c) returned 0x1
	[0161.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.034] GetFileType (hFile=0x47c) returned 0x1
	[0161.034] WriteFile (in: hFile=0x47c, lpBuffer=0x92ff930*, nNumberOfBytesToWrite=0x15a90, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x92ff930*, lpNumberOfBytesWritten=0x540efc0*=0x15a90, lpOverlapped=0x0) returned 1
	[0161.037] CloseHandle (hObject=0x47c) returned 1
	[0161.037] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a", lpFilePart=0x0) returned 0x30
	[0161.037] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0161.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.037] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\i177xleaa77y.m4a"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fe9d00, ftCreationTime.dwHighDateTime=0x1d4c9f3, ftLastAccessTime.dwLowDateTime=0x2d210330, ftLastAccessTime.dwHighDateTime=0x1d4c94d, ftLastWriteTime.dwLowDateTime=0x9a5168f5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x15a90)) returned 1
	[0161.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.037] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\i177xleaa77y.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\I177xLEAA77Y.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\i177xleaa77y.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a", lpFilePart=0x0) returned 0x2a
	[0161.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.038] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\mx5rnn.m4a"), fInfoLevelId=0x0, lpFileInformation=0x27204d4 | out: lpFileInformation=0x27204d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb9c58d0, ftCreationTime.dwHighDateTime=0x1d4d21c, ftLastAccessTime.dwLowDateTime=0x10bc8610, ftLastAccessTime.dwHighDateTime=0x1d4c826, ftLastWriteTime.dwLowDateTime=0x10bc8610, ftLastWriteTime.dwHighDateTime=0x1d4c826, nFileSizeHigh=0x0, nFileSizeLow=0xa8dd)) returned 1
	[0161.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a", lpFilePart=0x0) returned 0x2a
	[0161.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\mx5rnn.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.039] GetFileType (hFile=0x47c) returned 0x1
	[0161.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.039] GetFileType (hFile=0x47c) returned 0x1
	[0161.039] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xa8dd
	[0161.039] ReadFile (in: hFile=0x47c, lpBuffer=0x27206bc, nNumberOfBytesToRead=0xa8dd, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27206bc*, lpNumberOfBytesRead=0x540efcc*=0xa8dd, lpOverlapped=0x0) returned 1
	[0161.040] CloseHandle (hObject=0x47c) returned 1
	[0161.040] CryptDestroyKey (hKey=0x82b300) returned 1
	[0161.040] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.040] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272b038, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0161.040] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.040] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.040] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0161.040] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.040] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x272b0f0*=0x1, dwFlags=0x0) returned 1
	[0161.040] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x272b0bc, dwFlags=0x0) returned 1
	[0161.040] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272b100*, pdwDataLen=0x540efd4*=0xa8e0, dwBufLen=0xa8e0 | out: pbData=0x272b100*, pdwDataLen=0x540efd4*=0xa8e0) returned 1
	[0161.041] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27359ec*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27359ec*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.041] CryptDestroyKey (hKey=0x82b380) returned 1
	[0161.041] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.041] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.041] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a", lpFilePart=0x0) returned 0x2a
	[0161.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\mx5rnn.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.042] GetFileType (hFile=0x47c) returned 0x1
	[0161.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.042] GetFileType (hFile=0x47c) returned 0x1
	[0161.042] WriteFile (in: hFile=0x47c, lpBuffer=0x272b100*, nNumberOfBytesToWrite=0xa8e0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x272b100*, lpNumberOfBytesWritten=0x540efc0*=0xa8e0, lpOverlapped=0x0) returned 1
	[0161.044] CloseHandle (hObject=0x47c) returned 1
	[0161.044] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a", lpFilePart=0x0) returned 0x2a
	[0161.044] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0161.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.044] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\mx5rnn.m4a"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb9c58d0, ftCreationTime.dwHighDateTime=0x1d4d21c, ftLastAccessTime.dwLowDateTime=0x10bc8610, ftLastAccessTime.dwHighDateTime=0x1d4c826, ftLastWriteTime.dwLowDateTime=0x9a5168f5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xa8e0)) returned 1
	[0161.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.044] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\mx5rnn.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\mX5Rnn.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\mx5rnn.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav", lpFilePart=0x0) returned 0x33
	[0161.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.045] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\r5xsldxporn_7ep.wav"), fInfoLevelId=0x0, lpFileInformation=0x2735d58 | out: lpFileInformation=0x2735d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d9c710, ftCreationTime.dwHighDateTime=0x1d4c978, ftLastAccessTime.dwLowDateTime=0x88204070, ftLastAccessTime.dwHighDateTime=0x1d4d4d3, ftLastWriteTime.dwLowDateTime=0x88204070, ftLastWriteTime.dwHighDateTime=0x1d4d4d3, nFileSizeHigh=0x0, nFileSizeLow=0x3e43)) returned 1
	[0161.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav", lpFilePart=0x0) returned 0x33
	[0161.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.046] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\r5xsldxporn_7ep.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.046] GetFileType (hFile=0x47c) returned 0x1
	[0161.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.046] GetFileType (hFile=0x47c) returned 0x1
	[0161.046] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3e43
	[0161.046] ReadFile (in: hFile=0x47c, lpBuffer=0x2735f80, nNumberOfBytesToRead=0x3e43, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2735f80*, lpNumberOfBytesRead=0x540efcc*=0x3e43, lpOverlapped=0x0) returned 1
	[0161.047] CloseHandle (hObject=0x47c) returned 1
	[0161.047] CryptDestroyKey (hKey=0x82b340) returned 1
	[0161.047] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.047] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2739e60, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0161.047] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.047] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.047] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0161.047] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.047] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2739f18*=0x1, dwFlags=0x0) returned 1
	[0161.047] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2739ee4, dwFlags=0x0) returned 1
	[0161.047] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2739f28*, pdwDataLen=0x540efd4*=0x3e50, dwBufLen=0x3e50 | out: pbData=0x2739f28*, pdwDataLen=0x540efd4*=0x3e50) returned 1
	[0161.047] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273dd84*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x273dd84*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.048] CryptDestroyKey (hKey=0x82b080) returned 1
	[0161.048] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.048] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.048] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav", lpFilePart=0x0) returned 0x33
	[0161.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.048] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\r5xsldxporn_7ep.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.049] GetFileType (hFile=0x47c) returned 0x1
	[0161.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.049] GetFileType (hFile=0x47c) returned 0x1
	[0161.049] WriteFile (in: hFile=0x47c, lpBuffer=0x2739f28*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2739f28*, lpNumberOfBytesWritten=0x540efc0*=0x3e50, lpOverlapped=0x0) returned 1
	[0161.050] CloseHandle (hObject=0x47c) returned 1
	[0161.050] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav", lpFilePart=0x0) returned 0x33
	[0161.050] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x62
	[0161.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.051] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\r5xsldxporn_7ep.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d9c710, ftCreationTime.dwHighDateTime=0x1d4c978, ftLastAccessTime.dwLowDateTime=0x88204070, ftLastAccessTime.dwHighDateTime=0x1d4d4d3, ftLastWriteTime.dwLowDateTime=0x9a53ca7e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3e50)) returned 1
	[0161.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.051] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\r5xsldxporn_7ep.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\r5xsLdxporn_7EP.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\r5xsldxporn_7ep.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.051] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav", lpFilePart=0x0) returned 0x2e
	[0161.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.052] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\0dga.wav"), fInfoLevelId=0x0, lpFileInformation=0x273e15c | out: lpFileInformation=0x273e15c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681ad170, ftCreationTime.dwHighDateTime=0x1d4d341, ftLastAccessTime.dwLowDateTime=0xf32f9d90, ftLastAccessTime.dwHighDateTime=0x1d4cf59, ftLastWriteTime.dwLowDateTime=0xf32f9d90, ftLastWriteTime.dwHighDateTime=0x1d4cf59, nFileSizeHigh=0x0, nFileSizeLow=0x1635c)) returned 1
	[0161.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.052] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav", lpFilePart=0x0) returned 0x2e
	[0161.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.052] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\0dga.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.052] GetFileType (hFile=0x47c) returned 0x1
	[0161.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.052] GetFileType (hFile=0x47c) returned 0x1
	[0161.053] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1635c
	[0161.053] ReadFile (in: hFile=0x47c, lpBuffer=0x93153e0, nNumberOfBytesToRead=0x1635c, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x93153e0*, lpNumberOfBytesRead=0x540efcc*=0x1635c, lpOverlapped=0x0) returned 1
	[0161.055] CloseHandle (hObject=0x47c) returned 1
	[0161.055] CryptDestroyKey (hKey=0x82b540) returned 1
	[0161.055] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.055] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273e3dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0161.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.055] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0161.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.055] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x273e494*=0x1, dwFlags=0x0) returned 1
	[0161.056] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x273e460, dwFlags=0x0) returned 1
	[0161.057] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x932b758*, pdwDataLen=0x540efd4*=0x16360, dwBufLen=0x16360 | out: pbData=0x932b758*, pdwDataLen=0x540efd4*=0x16360) returned 1
	[0161.057] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273e4a4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x273e4a4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.057] CryptDestroyKey (hKey=0x82b200) returned 1
	[0161.057] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.057] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.057] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav", lpFilePart=0x0) returned 0x2e
	[0161.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.057] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\0dga.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.059] GetFileType (hFile=0x47c) returned 0x1
	[0161.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.059] GetFileType (hFile=0x47c) returned 0x1
	[0161.059] WriteFile (in: hFile=0x47c, lpBuffer=0x932b758*, nNumberOfBytesToWrite=0x16360, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x932b758*, lpNumberOfBytesWritten=0x540efc0*=0x16360, lpOverlapped=0x0) returned 1
	[0161.062] CloseHandle (hObject=0x47c) returned 1
	[0161.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav", lpFilePart=0x0) returned 0x2e
	[0161.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0161.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.062] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\0dga.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681ad170, ftCreationTime.dwHighDateTime=0x1d4d341, ftLastAccessTime.dwLowDateTime=0xf32f9d90, ftLastAccessTime.dwHighDateTime=0x1d4cf59, ftLastWriteTime.dwLowDateTime=0x9a53ca7e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x16360)) returned 1
	[0161.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.062] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\0dga.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\0dgA.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\0dga.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.063] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav", lpFilePart=0x0) returned 0x37
	[0161.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.063] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\b ntwverz3 -d.wav"), fInfoLevelId=0x0, lpFileInformation=0x273e834 | out: lpFileInformation=0x273e834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa991fec0, ftCreationTime.dwHighDateTime=0x1d4d3f6, ftLastAccessTime.dwLowDateTime=0xb2a0370, ftLastAccessTime.dwHighDateTime=0x1d4d2ea, ftLastWriteTime.dwLowDateTime=0xb2a0370, ftLastWriteTime.dwHighDateTime=0x1d4d2ea, nFileSizeHigh=0x0, nFileSizeLow=0x14d5d)) returned 1
	[0161.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.063] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav", lpFilePart=0x0) returned 0x37
	[0161.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.063] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\b ntwverz3 -d.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.063] GetFileType (hFile=0x47c) returned 0x1
	[0161.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.064] GetFileType (hFile=0x47c) returned 0x1
	[0161.064] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x14d5d
	[0161.064] ReadFile (in: hFile=0x47c, lpBuffer=0x9341ad8, nNumberOfBytesToRead=0x14d5d, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x9341ad8*, lpNumberOfBytesRead=0x540efcc*=0x14d5d, lpOverlapped=0x0) returned 1
	[0161.066] CloseHandle (hObject=0x47c) returned 1
	[0161.066] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0161.066] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.066] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273eaf4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0161.066] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.066] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.067] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0161.067] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.067] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x273ebac*=0x1, dwFlags=0x0) returned 1
	[0161.067] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x273eb78, dwFlags=0x0) returned 1
	[0161.160] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9356858*, pdwDataLen=0x540efd4*=0x14d60, dwBufLen=0x14d60 | out: pbData=0x9356858*, pdwDataLen=0x540efd4*=0x14d60) returned 1
	[0161.160] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273ebbc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x273ebbc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.160] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0161.161] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.161] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.161] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav", lpFilePart=0x0) returned 0x37
	[0161.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\b ntwverz3 -d.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.163] GetFileType (hFile=0x47c) returned 0x1
	[0161.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.163] GetFileType (hFile=0x47c) returned 0x1
	[0161.163] WriteFile (in: hFile=0x47c, lpBuffer=0x9356858*, nNumberOfBytesToWrite=0x14d60, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x9356858*, lpNumberOfBytesWritten=0x540efc0*=0x14d60, lpOverlapped=0x0) returned 1
	[0161.165] CloseHandle (hObject=0x47c) returned 1
	[0161.165] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav", lpFilePart=0x0) returned 0x37
	[0161.165] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0161.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.165] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\b ntwverz3 -d.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa991fec0, ftCreationTime.dwHighDateTime=0x1d4d3f6, ftLastAccessTime.dwLowDateTime=0xb2a0370, ftLastAccessTime.dwHighDateTime=0x1d4d2ea, ftLastWriteTime.dwLowDateTime=0x9a647af2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x14d60)) returned 1
	[0161.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.165] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\b ntwverz3 -d.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\B NtwVErZ3 -d.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\b ntwverz3 -d.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.166] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3", lpFilePart=0x0) returned 0x3a
	[0161.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.166] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\baybvg9w7krdsnfw.mp3"), fInfoLevelId=0x0, lpFileInformation=0x273efb8 | out: lpFileInformation=0x273efb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32cd91c0, ftCreationTime.dwHighDateTime=0x1d4d1f6, ftLastAccessTime.dwLowDateTime=0xb84dcd70, ftLastAccessTime.dwHighDateTime=0x1d4cd63, ftLastWriteTime.dwLowDateTime=0xb84dcd70, ftLastWriteTime.dwHighDateTime=0x1d4cd63, nFileSizeHigh=0x0, nFileSizeLow=0x5a16)) returned 1
	[0161.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3", lpFilePart=0x0) returned 0x3a
	[0161.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.167] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\baybvg9w7krdsnfw.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.167] GetFileType (hFile=0x47c) returned 0x1
	[0161.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.167] GetFileType (hFile=0x47c) returned 0x1
	[0161.167] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x5a16
	[0161.167] ReadFile (in: hFile=0x47c, lpBuffer=0x273f208, nNumberOfBytesToRead=0x5a16, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x273f208*, lpNumberOfBytesRead=0x540efcc*=0x5a16, lpOverlapped=0x0) returned 1
	[0161.168] CloseHandle (hObject=0x47c) returned 1
	[0161.168] CryptDestroyKey (hKey=0x82b440) returned 1
	[0161.168] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.168] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2744cbc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0161.168] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.168] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.168] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0161.169] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.169] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2744d74*=0x1, dwFlags=0x0) returned 1
	[0161.169] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2744d40, dwFlags=0x0) returned 1
	[0161.169] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2744d84*, pdwDataLen=0x540efd4*=0x5a20, dwBufLen=0x5a20 | out: pbData=0x2744d84*, pdwDataLen=0x540efd4*=0x5a20) returned 1
	[0161.169] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274a7b0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x274a7b0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.169] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0161.169] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.169] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3", lpFilePart=0x0) returned 0x3a
	[0161.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.169] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\baybvg9w7krdsnfw.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.170] GetFileType (hFile=0x47c) returned 0x1
	[0161.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.170] GetFileType (hFile=0x47c) returned 0x1
	[0161.171] WriteFile (in: hFile=0x47c, lpBuffer=0x2744d84*, nNumberOfBytesToWrite=0x5a20, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2744d84*, lpNumberOfBytesWritten=0x540efc0*=0x5a20, lpOverlapped=0x0) returned 1
	[0161.172] CloseHandle (hObject=0x47c) returned 1
	[0161.172] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3", lpFilePart=0x0) returned 0x3a
	[0161.172] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0161.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.172] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\baybvg9w7krdsnfw.mp3"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32cd91c0, ftCreationTime.dwHighDateTime=0x1d4d1f6, ftLastAccessTime.dwLowDateTime=0xb84dcd70, ftLastAccessTime.dwHighDateTime=0x1d4cd63, ftLastWriteTime.dwLowDateTime=0x9a647af2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5a20)) returned 1
	[0161.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.172] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\baybvg9w7krdsnfw.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\uI54EJtX8q8Aq9o\\BAYBVg9W7kRdsNFw.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\ui54ejtx8q8aq9o\\baybvg9w7krdsnfw.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.173] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav", lpFilePart=0x0) returned 0x32
	[0161.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.173] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\andzxb0oomf hudygx.wav"), fInfoLevelId=0x0, lpFileInformation=0x274abd0 | out: lpFileInformation=0x274abd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x959d9cc0, ftCreationTime.dwHighDateTime=0x1d4d4c4, ftLastAccessTime.dwLowDateTime=0xf32c7c00, ftLastAccessTime.dwHighDateTime=0x1d4d409, ftLastWriteTime.dwLowDateTime=0xf32c7c00, ftLastWriteTime.dwHighDateTime=0x1d4d409, nFileSizeHigh=0x0, nFileSizeLow=0x1a35)) returned 1
	[0161.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav", lpFilePart=0x0) returned 0x32
	[0161.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\andzxb0oomf hudygx.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.174] GetFileType (hFile=0x47c) returned 0x1
	[0161.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.174] GetFileType (hFile=0x47c) returned 0x1
	[0161.174] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1a35
	[0161.174] ReadFile (in: hFile=0x47c, lpBuffer=0x274ae08, nNumberOfBytesToRead=0x1a35, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x274ae08*, lpNumberOfBytesRead=0x540efcc*=0x1a35, lpOverlapped=0x0) returned 1
	[0161.175] CloseHandle (hObject=0x47c) returned 1
	[0161.175] CryptDestroyKey (hKey=0x82b280) returned 1
	[0161.175] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.175] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274c8dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0161.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.175] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0161.176] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.176] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x274c994*=0x1, dwFlags=0x0) returned 1
	[0161.176] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x274c960, dwFlags=0x0) returned 1
	[0161.176] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274c9a4*, pdwDataLen=0x540efd4*=0x1a40, dwBufLen=0x1a40 | out: pbData=0x274c9a4*, pdwDataLen=0x540efd4*=0x1a40) returned 1
	[0161.176] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274e3f0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x274e3f0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.176] CryptDestroyKey (hKey=0x82b440) returned 1
	[0161.176] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.176] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.176] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav", lpFilePart=0x0) returned 0x32
	[0161.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.176] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\andzxb0oomf hudygx.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.177] GetFileType (hFile=0x47c) returned 0x1
	[0161.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.177] GetFileType (hFile=0x47c) returned 0x1
	[0161.177] WriteFile (in: hFile=0x47c, lpBuffer=0x274c9a4*, nNumberOfBytesToWrite=0x1a40, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x274c9a4*, lpNumberOfBytesWritten=0x540efc0*=0x1a40, lpOverlapped=0x0) returned 1
	[0161.178] CloseHandle (hObject=0x47c) returned 1
	[0161.178] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav", lpFilePart=0x0) returned 0x32
	[0161.179] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0161.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.179] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\andzxb0oomf hudygx.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x959d9cc0, ftCreationTime.dwHighDateTime=0x1d4d4c4, ftLastAccessTime.dwLowDateTime=0xf32c7c00, ftLastAccessTime.dwHighDateTime=0x1d4d409, ftLastWriteTime.dwLowDateTime=0x9a66dd69, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1a40)) returned 1
	[0161.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.179] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\andzxb0oomf hudygx.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\ANdzXb0OomF HudYgx.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\andzxb0oomf hudygx.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav", lpFilePart=0x0) returned 0x29
	[0161.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\b-q7cjhva.wav"), fInfoLevelId=0x0, lpFileInformation=0x274e7c4 | out: lpFileInformation=0x274e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde2afd50, ftCreationTime.dwHighDateTime=0x1d4d246, ftLastAccessTime.dwLowDateTime=0xb3423bd0, ftLastAccessTime.dwHighDateTime=0x1d4c715, ftLastWriteTime.dwLowDateTime=0xb3423bd0, ftLastWriteTime.dwHighDateTime=0x1d4c715, nFileSizeHigh=0x0, nFileSizeLow=0x178da)) returned 1
	[0161.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav", lpFilePart=0x0) returned 0x29
	[0161.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.180] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\b-q7cjhva.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.180] GetFileType (hFile=0x47c) returned 0x1
	[0161.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.180] GetFileType (hFile=0x47c) returned 0x1
	[0161.181] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x178da
	[0161.181] ReadFile (in: hFile=0x47c, lpBuffer=0x936b5d8, nNumberOfBytesToRead=0x178da, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x936b5d8*, lpNumberOfBytesRead=0x540efcc*=0x178da, lpOverlapped=0x0) returned 1
	[0161.183] CloseHandle (hObject=0x47c) returned 1
	[0161.183] CryptDestroyKey (hKey=0x82b100) returned 1
	[0161.183] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.183] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274ea3c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0161.183] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.184] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.184] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0161.184] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.184] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x274eaf4*=0x1, dwFlags=0x0) returned 1
	[0161.184] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x274eac0, dwFlags=0x0) returned 1
	[0161.185] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9382ed0*, pdwDataLen=0x540efd4*=0x178e0, dwBufLen=0x178e0 | out: pbData=0x9382ed0*, pdwDataLen=0x540efd4*=0x178e0) returned 1
	[0161.186] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274eb04*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x274eb04*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.186] CryptDestroyKey (hKey=0x82b300) returned 1
	[0161.186] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.186] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav", lpFilePart=0x0) returned 0x29
	[0161.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.186] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\b-q7cjhva.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.188] GetFileType (hFile=0x47c) returned 0x1
	[0161.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.188] GetFileType (hFile=0x47c) returned 0x1
	[0161.188] WriteFile (in: hFile=0x47c, lpBuffer=0x9382ed0*, nNumberOfBytesToWrite=0x178e0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x9382ed0*, lpNumberOfBytesWritten=0x540efc0*=0x178e0, lpOverlapped=0x0) returned 1
	[0161.190] CloseHandle (hObject=0x47c) returned 1
	[0161.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav", lpFilePart=0x0) returned 0x29
	[0161.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x58
	[0161.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.191] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\b-q7cjhva.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde2afd50, ftCreationTime.dwHighDateTime=0x1d4d246, ftLastAccessTime.dwLowDateTime=0xb3423bd0, ftLastAccessTime.dwHighDateTime=0x1d4c715, ftLastWriteTime.dwLowDateTime=0x9a693faf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x178e0)) returned 1
	[0161.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.191] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\b-q7cjhva.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\b-Q7CjhvA.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\b-q7cjhva.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.191] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav", lpFilePart=0x0) returned 0x26
	[0161.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.192] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\jikdac.wav"), fInfoLevelId=0x0, lpFileInformation=0x274ee6c | out: lpFileInformation=0x274ee6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf747c60, ftCreationTime.dwHighDateTime=0x1d4cd5a, ftLastAccessTime.dwLowDateTime=0x15dfdf10, ftLastAccessTime.dwHighDateTime=0x1d4cbfb, ftLastWriteTime.dwLowDateTime=0x15dfdf10, ftLastWriteTime.dwHighDateTime=0x1d4cbfb, nFileSizeHigh=0x0, nFileSizeLow=0xacf5)) returned 1
	[0161.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.192] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav", lpFilePart=0x0) returned 0x26
	[0161.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.192] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\jikdac.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.192] GetFileType (hFile=0x47c) returned 0x1
	[0161.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.192] GetFileType (hFile=0x47c) returned 0x1
	[0161.192] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xacf5
	[0161.193] ReadFile (in: hFile=0x47c, lpBuffer=0x274f044, nNumberOfBytesToRead=0xacf5, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x274f044*, lpNumberOfBytesRead=0x540efcc*=0xacf5, lpOverlapped=0x0) returned 1
	[0161.193] CloseHandle (hObject=0x47c) returned 1
	[0161.194] CryptDestroyKey (hKey=0x82b400) returned 1
	[0161.194] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.194] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2759dd8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0161.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.194] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0161.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.194] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2759e90*=0x1, dwFlags=0x0) returned 1
	[0161.194] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2759e5c, dwFlags=0x0) returned 1
	[0161.194] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2759ea0*, pdwDataLen=0x540efd4*=0xad00, dwBufLen=0xad00 | out: pbData=0x2759ea0*, pdwDataLen=0x540efd4*=0xad00) returned 1
	[0161.194] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2764bac*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2764bac*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.194] CryptDestroyKey (hKey=0x82b000) returned 1
	[0161.194] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.194] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.194] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav", lpFilePart=0x0) returned 0x26
	[0161.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.194] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\jikdac.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.196] GetFileType (hFile=0x47c) returned 0x1
	[0161.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.196] GetFileType (hFile=0x47c) returned 0x1
	[0161.196] WriteFile (in: hFile=0x47c, lpBuffer=0x2759ea0*, nNumberOfBytesToWrite=0xad00, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2759ea0*, lpNumberOfBytesWritten=0x540efc0*=0xad00, lpOverlapped=0x0) returned 1
	[0161.198] CloseHandle (hObject=0x47c) returned 1
	[0161.198] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav", lpFilePart=0x0) returned 0x26
	[0161.198] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0161.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.198] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\jikdac.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf747c60, ftCreationTime.dwHighDateTime=0x1d4cd5a, ftLastAccessTime.dwLowDateTime=0x15dfdf10, ftLastAccessTime.dwHighDateTime=0x1d4cbfb, ftLastWriteTime.dwLowDateTime=0x9a693faf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xad00)) returned 1
	[0161.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.198] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\jikdac.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\jIkdAC.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\jikdac.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.199] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav", lpFilePart=0x0) returned 0x25
	[0161.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.199] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\m750s.wav"), fInfoLevelId=0x0, lpFileInformation=0x2764ef0 | out: lpFileInformation=0x2764ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed9ffb0, ftCreationTime.dwHighDateTime=0x1d4ce1a, ftLastAccessTime.dwLowDateTime=0x4c9ae360, ftLastAccessTime.dwHighDateTime=0x1d4d1d7, ftLastWriteTime.dwLowDateTime=0x4c9ae360, ftLastWriteTime.dwHighDateTime=0x1d4d1d7, nFileSizeHigh=0x0, nFileSizeLow=0xb52f)) returned 1
	[0161.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.199] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav", lpFilePart=0x0) returned 0x25
	[0161.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\m750s.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.199] GetFileType (hFile=0x47c) returned 0x1
	[0161.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.199] GetFileType (hFile=0x47c) returned 0x1
	[0161.200] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb52f
	[0161.200] ReadFile (in: hFile=0x47c, lpBuffer=0x27650b8, nNumberOfBytesToRead=0xb52f, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27650b8*, lpNumberOfBytesRead=0x540efcc*=0xb52f, lpOverlapped=0x0) returned 1
	[0161.201] CloseHandle (hObject=0x47c) returned 1
	[0161.201] CryptDestroyKey (hKey=0x82b280) returned 1
	[0161.201] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.201] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2770684, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0161.201] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.201] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.201] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0161.201] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.201] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x277073c*=0x1, dwFlags=0x0) returned 1
	[0161.201] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2770708, dwFlags=0x0) returned 1
	[0161.201] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277074c*, pdwDataLen=0x540efd4*=0xb530, dwBufLen=0xb530 | out: pbData=0x277074c*, pdwDataLen=0x540efd4*=0xb530) returned 1
	[0161.201] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277bc88*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x277bc88*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.201] CryptDestroyKey (hKey=0x82b100) returned 1
	[0161.201] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.201] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.201] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav", lpFilePart=0x0) returned 0x25
	[0161.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\m750s.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.203] GetFileType (hFile=0x47c) returned 0x1
	[0161.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.203] GetFileType (hFile=0x47c) returned 0x1
	[0161.203] WriteFile (in: hFile=0x47c, lpBuffer=0x277074c*, nNumberOfBytesToWrite=0xb530, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x277074c*, lpNumberOfBytesWritten=0x540efc0*=0xb530, lpOverlapped=0x0) returned 1
	[0161.205] CloseHandle (hObject=0x47c) returned 1
	[0161.205] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav", lpFilePart=0x0) returned 0x25
	[0161.205] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x54
	[0161.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.205] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\m750s.wav"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed9ffb0, ftCreationTime.dwHighDateTime=0x1d4ce1a, ftLastAccessTime.dwLowDateTime=0x4c9ae360, ftLastAccessTime.dwHighDateTime=0x1d4d1d7, ftLastWriteTime.dwLowDateTime=0x9a693faf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xb530)) returned 1
	[0161.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.205] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\m750s.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\M750S.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\m750s.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.295] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", lpFilePart=0x0) returned 0x30
	[0161.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.295] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x277bfc0 | out: lpFileInformation=0x277bfc0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe)) returned 1
	[0161.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.296] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", lpFilePart=0x0) returned 0x30
	[0161.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.296] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.296] GetFileType (hFile=0x47c) returned 0x1
	[0161.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.296] GetFileType (hFile=0x47c) returned 0x1
	[0161.296] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xbe
	[0161.296] ReadFile (in: hFile=0x47c, lpBuffer=0x277c28c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x277c28c*, lpNumberOfBytesRead=0x540efcc*=0xbe, lpOverlapped=0x0) returned 1
	[0161.297] CloseHandle (hObject=0x47c) returned 1
	[0161.297] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0161.297] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.298] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277d328, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0161.298] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.298] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.298] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0161.298] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.298] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x277d3e0*=0x1, dwFlags=0x0) returned 1
	[0161.298] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x277d3ac, dwFlags=0x0) returned 1
	[0161.298] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277d3f0*, pdwDataLen=0x540efd4*=0xc0, dwBufLen=0xc0 | out: pbData=0x277d3f0*, pdwDataLen=0x540efd4*=0xc0) returned 1
	[0161.298] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277d4bc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x277d4bc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.298] CryptDestroyKey (hKey=0x82b540) returned 1
	[0161.298] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.298] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", lpFilePart=0x0) returned 0x30
	[0161.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.298] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0161.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0161.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", lpFilePart=0x0) returned 0x33
	[0161.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.300] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x277da04 | out: lpFileInformation=0x277da04*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe)) returned 1
	[0161.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.301] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", lpFilePart=0x0) returned 0x33
	[0161.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.301] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.301] GetFileType (hFile=0x47c) returned 0x1
	[0161.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.301] GetFileType (hFile=0x47c) returned 0x1
	[0161.301] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xbe
	[0161.301] ReadFile (in: hFile=0x47c, lpBuffer=0x277dcd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x277dcd8*, lpNumberOfBytesRead=0x540efcc*=0xbe, lpOverlapped=0x0) returned 1
	[0161.302] CloseHandle (hObject=0x47c) returned 1
	[0161.303] CryptDestroyKey (hKey=0x82b280) returned 1
	[0161.303] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.303] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277ed74, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0161.303] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.303] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.303] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0161.303] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.303] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x277ee2c*=0x1, dwFlags=0x0) returned 1
	[0161.303] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x277edf8, dwFlags=0x0) returned 1
	[0161.303] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277ee3c*, pdwDataLen=0x540efd4*=0xc0, dwBufLen=0xc0 | out: pbData=0x277ee3c*, pdwDataLen=0x540efd4*=0xc0) returned 1
	[0161.303] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277ef08*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x277ef08*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.303] CryptDestroyKey (hKey=0x82b300) returned 1
	[0161.303] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.303] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.303] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", lpFilePart=0x0) returned 0x33
	[0161.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.303] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0161.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0161.305] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4", lpFilePart=0x0) returned 0x30
	[0161.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.305] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\4rystpj.mp4"), fInfoLevelId=0x0, lpFileInformation=0x277f464 | out: lpFileInformation=0x277f464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81aacb90, ftCreationTime.dwHighDateTime=0x1d4d067, ftLastAccessTime.dwLowDateTime=0xd29c3320, ftLastAccessTime.dwHighDateTime=0x1d4d26c, ftLastWriteTime.dwLowDateTime=0xd29c3320, ftLastWriteTime.dwHighDateTime=0x1d4d26c, nFileSizeHigh=0x0, nFileSizeLow=0x161c0)) returned 1
	[0161.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.305] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4", lpFilePart=0x0) returned 0x30
	[0161.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.306] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\4rystpj.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.306] GetFileType (hFile=0x47c) returned 0x1
	[0161.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.306] GetFileType (hFile=0x47c) returned 0x1
	[0161.306] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x161c0
	[0161.306] ReadFile (in: hFile=0x47c, lpBuffer=0x939a7d0, nNumberOfBytesToRead=0x161c0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x939a7d0*, lpNumberOfBytesRead=0x540efcc*=0x161c0, lpOverlapped=0x0) returned 1
	[0161.308] CloseHandle (hObject=0x47c) returned 1
	[0161.308] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0161.308] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.308] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277f6f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0161.308] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.308] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.309] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0161.309] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.309] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x277f7ac*=0x1, dwFlags=0x0) returned 1
	[0161.309] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x277f778, dwFlags=0x0) returned 1
	[0161.310] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x93b09b0*, pdwDataLen=0x540efd4*=0x161d0, dwBufLen=0x161d0 | out: pbData=0x93b09b0*, pdwDataLen=0x540efd4*=0x161d0) returned 1
	[0161.310] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277f7bc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x277f7bc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.310] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0161.310] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.310] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.310] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4", lpFilePart=0x0) returned 0x30
	[0161.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\4rystpj.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.312] GetFileType (hFile=0x47c) returned 0x1
	[0161.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.312] GetFileType (hFile=0x47c) returned 0x1
	[0161.312] WriteFile (in: hFile=0x47c, lpBuffer=0x93b09b0*, nNumberOfBytesToWrite=0x161d0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x93b09b0*, lpNumberOfBytesWritten=0x540efc0*=0x161d0, lpOverlapped=0x0) returned 1
	[0161.315] CloseHandle (hObject=0x47c) returned 1
	[0161.315] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4", lpFilePart=0x0) returned 0x30
	[0161.315] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0161.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.315] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\4rystpj.mp4"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81aacb90, ftCreationTime.dwHighDateTime=0x1d4d067, ftLastAccessTime.dwLowDateTime=0xd29c3320, ftLastAccessTime.dwHighDateTime=0x1d4d26c, ftLastWriteTime.dwLowDateTime=0x9a79f09b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x161d0)) returned 1
	[0161.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.315] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\4rystpj.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\4RysTpj.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\4rystpj.mp4 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.316] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv", lpFilePart=0x0) returned 0x39
	[0161.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.316] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\a8xhhaaaf7gogpdd.mkv"), fInfoLevelId=0x0, lpFileInformation=0x277fb64 | out: lpFileInformation=0x277fb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3329320, ftCreationTime.dwHighDateTime=0x1d4d31d, ftLastAccessTime.dwLowDateTime=0x8cfd1a90, ftLastAccessTime.dwHighDateTime=0x1d4d3c6, ftLastWriteTime.dwLowDateTime=0x8cfd1a90, ftLastWriteTime.dwHighDateTime=0x1d4d3c6, nFileSizeHigh=0x0, nFileSizeLow=0xf9a)) returned 1
	[0161.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.317] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv", lpFilePart=0x0) returned 0x39
	[0161.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.317] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\a8xhhaaaf7gogpdd.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.317] GetFileType (hFile=0x47c) returned 0x1
	[0161.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.317] GetFileType (hFile=0x47c) returned 0x1
	[0161.317] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xf9a
	[0161.317] ReadFile (in: hFile=0x47c, lpBuffer=0x2780d54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2780d54*, lpNumberOfBytesRead=0x540efcc*=0xf9a, lpOverlapped=0x0) returned 1
	[0161.318] CloseHandle (hObject=0x47c) returned 1
	[0161.318] CryptDestroyKey (hKey=0x82b200) returned 1
	[0161.318] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.318] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2781df0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0161.318] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.318] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.318] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0161.319] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.319] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2781ea8*=0x1, dwFlags=0x0) returned 1
	[0161.319] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2781e74, dwFlags=0x0) returned 1
	[0161.319] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2781eb8*, pdwDataLen=0x540efd4*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x2781eb8*, pdwDataLen=0x540efd4*=0xfa0) returned 1
	[0161.319] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2782e64*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2782e64*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.319] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0161.319] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.319] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv", lpFilePart=0x0) returned 0x39
	[0161.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\a8xhhaaaf7gogpdd.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.320] GetFileType (hFile=0x47c) returned 0x1
	[0161.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.320] GetFileType (hFile=0x47c) returned 0x1
	[0161.320] WriteFile (in: hFile=0x47c, lpBuffer=0x2782f94*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2782f94*, lpNumberOfBytesWritten=0x540ef94*=0xfa0, lpOverlapped=0x0) returned 1
	[0161.321] CloseHandle (hObject=0x47c) returned 1
	[0161.321] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv", lpFilePart=0x0) returned 0x39
	[0161.321] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0161.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.322] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\a8xhhaaaf7gogpdd.mkv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3329320, ftCreationTime.dwHighDateTime=0x1d4d31d, ftLastAccessTime.dwLowDateTime=0x8cfd1a90, ftLastAccessTime.dwHighDateTime=0x1d4d3c6, ftLastWriteTime.dwLowDateTime=0x9a7c529b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xfa0)) returned 1
	[0161.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.322] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\a8xhhaaaf7gogpdd.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\A8XHHAAAf7gogPDd.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\a8xhhaaaf7gogpdd.mkv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.322] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi", lpFilePart=0x0) returned 0x3d
	[0161.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.323] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\bsgcnztrmztyraw7o4vh.avi"), fInfoLevelId=0x0, lpFileInformation=0x2784288 | out: lpFileInformation=0x2784288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818e83f0, ftCreationTime.dwHighDateTime=0x1d4c585, ftLastAccessTime.dwLowDateTime=0x33e2b4a0, ftLastAccessTime.dwHighDateTime=0x1d4ccfb, ftLastWriteTime.dwLowDateTime=0x33e2b4a0, ftLastWriteTime.dwHighDateTime=0x1d4ccfb, nFileSizeHigh=0x0, nFileSizeLow=0x16f31)) returned 1
	[0161.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.323] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi", lpFilePart=0x0) returned 0x3d
	[0161.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.323] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\bsgcnztrmztyraw7o4vh.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.323] GetFileType (hFile=0x47c) returned 0x1
	[0161.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.323] GetFileType (hFile=0x47c) returned 0x1
	[0161.323] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x16f31
	[0161.324] ReadFile (in: hFile=0x47c, lpBuffer=0x93c6ba0, nNumberOfBytesToRead=0x16f31, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x93c6ba0*, lpNumberOfBytesRead=0x540efcc*=0x16f31, lpOverlapped=0x0) returned 1
	[0161.326] CloseHandle (hObject=0x47c) returned 1
	[0161.326] CryptDestroyKey (hKey=0x82b280) returned 1
	[0161.326] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.326] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2784580, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0161.326] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.326] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.326] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0161.326] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.326] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2784638*=0x1, dwFlags=0x0) returned 1
	[0161.326] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2784604, dwFlags=0x0) returned 1
	[0161.327] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x93ddaf0*, pdwDataLen=0x540efd4*=0x16f40, dwBufLen=0x16f40 | out: pbData=0x93ddaf0*, pdwDataLen=0x540efd4*=0x16f40) returned 1
	[0161.328] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2784648*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2784648*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.328] CryptDestroyKey (hKey=0x82b300) returned 1
	[0161.328] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.328] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.328] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi", lpFilePart=0x0) returned 0x3d
	[0161.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.328] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\bsgcnztrmztyraw7o4vh.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.330] GetFileType (hFile=0x47c) returned 0x1
	[0161.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.330] GetFileType (hFile=0x47c) returned 0x1
	[0161.330] WriteFile (in: hFile=0x47c, lpBuffer=0x93ddaf0*, nNumberOfBytesToWrite=0x16f40, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x93ddaf0*, lpNumberOfBytesWritten=0x540efc0*=0x16f40, lpOverlapped=0x0) returned 1
	[0161.379] CloseHandle (hObject=0x47c) returned 1
	[0161.379] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi", lpFilePart=0x0) returned 0x3d
	[0161.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6c
	[0161.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\bsgcnztrmztyraw7o4vh.avi"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818e83f0, ftCreationTime.dwHighDateTime=0x1d4c585, ftLastAccessTime.dwLowDateTime=0x33e2b4a0, ftLastAccessTime.dwHighDateTime=0x1d4ccfb, ftLastWriteTime.dwLowDateTime=0x9a85dbdf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x16f40)) returned 1
	[0161.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.380] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\bsgcnztrmztyraw7o4vh.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\bSgcnZtRMZtyrAw7o4Vh.avi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\bsgcnztrmztyraw7o4vh.avi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4", lpFilePart=0x0) returned 0x2e
	[0161.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.381] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\ermy3.mp4"), fInfoLevelId=0x0, lpFileInformation=0x2784a90 | out: lpFileInformation=0x2784a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7f0470, ftCreationTime.dwHighDateTime=0x1d4d44d, ftLastAccessTime.dwLowDateTime=0x99e97a50, ftLastAccessTime.dwHighDateTime=0x1d4cefd, ftLastWriteTime.dwLowDateTime=0x99e97a50, ftLastWriteTime.dwHighDateTime=0x1d4cefd, nFileSizeHigh=0x0, nFileSizeLow=0x17c7a)) returned 1
	[0161.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4", lpFilePart=0x0) returned 0x2e
	[0161.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.381] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\ermy3.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.381] GetFileType (hFile=0x47c) returned 0x1
	[0161.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.382] GetFileType (hFile=0x47c) returned 0x1
	[0161.382] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x17c7a
	[0161.382] ReadFile (in: hFile=0x47c, lpBuffer=0x93f4a50, nNumberOfBytesToRead=0x17c7a, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x93f4a50*, lpNumberOfBytesRead=0x540efcc*=0x17c7a, lpOverlapped=0x0) returned 1
	[0161.384] CloseHandle (hObject=0x47c) returned 1
	[0161.384] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0161.384] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.384] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2784d10, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0161.385] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.385] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.385] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0161.385] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.385] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2784dc8*=0x1, dwFlags=0x0) returned 1
	[0161.385] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2784d94, dwFlags=0x0) returned 1
	[0161.386] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x940c6e8*, pdwDataLen=0x540efd4*=0x17c80, dwBufLen=0x17c80 | out: pbData=0x940c6e8*, pdwDataLen=0x540efd4*=0x17c80) returned 1
	[0161.387] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2784dd8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2784dd8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.387] CryptDestroyKey (hKey=0x82b540) returned 1
	[0161.387] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.387] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4", lpFilePart=0x0) returned 0x2e
	[0161.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.387] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\ermy3.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.389] GetFileType (hFile=0x47c) returned 0x1
	[0161.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.389] GetFileType (hFile=0x47c) returned 0x1
	[0161.389] WriteFile (in: hFile=0x47c, lpBuffer=0x940c6e8*, nNumberOfBytesToWrite=0x17c80, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x940c6e8*, lpNumberOfBytesWritten=0x540efc0*=0x17c80, lpOverlapped=0x0) returned 1
	[0161.391] CloseHandle (hObject=0x47c) returned 1
	[0161.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4", lpFilePart=0x0) returned 0x2e
	[0161.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0161.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.392] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\ermy3.mp4"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7f0470, ftCreationTime.dwHighDateTime=0x1d4d44d, ftLastAccessTime.dwLowDateTime=0x99e97a50, ftLastAccessTime.dwHighDateTime=0x1d4cefd, ftLastWriteTime.dwLowDateTime=0x9a85dbdf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x17c80)) returned 1
	[0161.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.392] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\ermy3.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\ERMY3.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\ermy3.mp4 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4", lpFilePart=0x0) returned 0x36
	[0161.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.393] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\lnjd5uqllnaey.mp4"), fInfoLevelId=0x0, lpFileInformation=0x2785168 | out: lpFileInformation=0x2785168*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb7fe920, ftCreationTime.dwHighDateTime=0x1d4d3a1, ftLastAccessTime.dwLowDateTime=0x9a40ec90, ftLastAccessTime.dwHighDateTime=0x1d4ce62, ftLastWriteTime.dwLowDateTime=0x9a40ec90, ftLastWriteTime.dwHighDateTime=0x1d4ce62, nFileSizeHigh=0x0, nFileSizeLow=0x108c0)) returned 1
	[0161.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4", lpFilePart=0x0) returned 0x36
	[0161.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.393] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\lnjd5uqllnaey.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.393] GetFileType (hFile=0x47c) returned 0x1
	[0161.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.394] GetFileType (hFile=0x47c) returned 0x1
	[0161.394] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x108c0
	[0161.394] ReadFile (in: hFile=0x47c, lpBuffer=0x2785398, nNumberOfBytesToRead=0x108c0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2785398*, lpNumberOfBytesRead=0x540efcc*=0x108c0, lpOverlapped=0x0) returned 1
	[0161.395] CloseHandle (hObject=0x47c) returned 1
	[0161.395] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0161.395] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.395] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2795cf4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0161.395] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.395] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.395] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0161.395] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.395] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2795dac*=0x1, dwFlags=0x0) returned 1
	[0161.395] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2795d78, dwFlags=0x0) returned 1
	[0161.396] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2795dbc*, pdwDataLen=0x540efd4*=0x108d0, dwBufLen=0x108d0 | out: pbData=0x2795dbc*, pdwDataLen=0x540efd4*=0x108d0) returned 1
	[0161.396] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a6698*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a6698*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.396] CryptDestroyKey (hKey=0x82b540) returned 1
	[0161.396] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.396] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.396] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4", lpFilePart=0x0) returned 0x36
	[0161.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.396] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\lnjd5uqllnaey.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.398] GetFileType (hFile=0x47c) returned 0x1
	[0161.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.398] GetFileType (hFile=0x47c) returned 0x1
	[0161.398] WriteFile (in: hFile=0x47c, lpBuffer=0x2795dbc*, nNumberOfBytesToWrite=0x108d0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2795dbc*, lpNumberOfBytesWritten=0x540efc0*=0x108d0, lpOverlapped=0x0) returned 1
	[0161.400] CloseHandle (hObject=0x47c) returned 1
	[0161.400] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4", lpFilePart=0x0) returned 0x36
	[0161.400] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0161.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.400] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\lnjd5uqllnaey.mp4"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb7fe920, ftCreationTime.dwHighDateTime=0x1d4d3a1, ftLastAccessTime.dwLowDateTime=0x9a40ec90, ftLastAccessTime.dwHighDateTime=0x1d4ce62, ftLastWriteTime.dwLowDateTime=0x9a883dda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x108d0)) returned 1
	[0161.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.400] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\lnjd5uqllnaey.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\lnJd5UQLlnAEy.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\lnjd5uqllnaey.mp4 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.401] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi", lpFilePart=0x0) returned 0x2e
	[0161.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\ppdm4.avi"), fInfoLevelId=0x0, lpFileInformation=0x27a6a88 | out: lpFileInformation=0x27a6a88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278976a0, ftCreationTime.dwHighDateTime=0x1d4d023, ftLastAccessTime.dwLowDateTime=0xb7266070, ftLastAccessTime.dwHighDateTime=0x1d4cd8f, ftLastWriteTime.dwLowDateTime=0xb7266070, ftLastWriteTime.dwHighDateTime=0x1d4cd8f, nFileSizeHigh=0x0, nFileSizeLow=0x14ccb)) returned 1
	[0161.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.402] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi", lpFilePart=0x0) returned 0x2e
	[0161.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.402] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\ppdm4.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.402] GetFileType (hFile=0x47c) returned 0x1
	[0161.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.402] GetFileType (hFile=0x47c) returned 0x1
	[0161.402] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x14ccb
	[0161.402] ReadFile (in: hFile=0x47c, lpBuffer=0x9424388, nNumberOfBytesToRead=0x14ccb, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x9424388*, lpNumberOfBytesRead=0x540efcc*=0x14ccb, lpOverlapped=0x0) returned 1
	[0161.404] CloseHandle (hObject=0x47c) returned 1
	[0161.404] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0161.404] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.405] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a6d08, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b000) returned 1
	[0161.405] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.405] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.405] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0161.405] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.405] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27a6dc0*=0x1, dwFlags=0x0) returned 1
	[0161.405] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27a6d8c, dwFlags=0x0) returned 1
	[0161.406] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9439070*, pdwDataLen=0x540efd4*=0x14cd0, dwBufLen=0x14cd0 | out: pbData=0x9439070*, pdwDataLen=0x540efd4*=0x14cd0) returned 1
	[0161.406] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a6dd0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a6dd0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.406] CryptDestroyKey (hKey=0x82b280) returned 1
	[0161.406] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.406] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.406] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi", lpFilePart=0x0) returned 0x2e
	[0161.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.407] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\ppdm4.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.408] GetFileType (hFile=0x47c) returned 0x1
	[0161.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.408] GetFileType (hFile=0x47c) returned 0x1
	[0161.408] WriteFile (in: hFile=0x47c, lpBuffer=0x9439070*, nNumberOfBytesToWrite=0x14cd0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x9439070*, lpNumberOfBytesWritten=0x540efc0*=0x14cd0, lpOverlapped=0x0) returned 1
	[0161.411] CloseHandle (hObject=0x47c) returned 1
	[0161.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi", lpFilePart=0x0) returned 0x2e
	[0161.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0161.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\ppdm4.avi"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278976a0, ftCreationTime.dwHighDateTime=0x1d4d023, ftLastAccessTime.dwLowDateTime=0xb7266070, ftLastAccessTime.dwHighDateTime=0x1d4cd8f, ftLastWriteTime.dwLowDateTime=0x9a8aa068, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x14cd0)) returned 1
	[0161.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.412] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\ppdm4.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\PPDM4.avi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\ppdm4.avi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.412] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv", lpFilePart=0x0) returned 0x2e
	[0161.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.412] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\xwnfi.mkv"), fInfoLevelId=0x0, lpFileInformation=0x27a7160 | out: lpFileInformation=0x27a7160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb632d40, ftCreationTime.dwHighDateTime=0x1d4cecf, ftLastAccessTime.dwLowDateTime=0x982f9870, ftLastAccessTime.dwHighDateTime=0x1d4cae3, ftLastWriteTime.dwLowDateTime=0x982f9870, ftLastWriteTime.dwHighDateTime=0x1d4cae3, nFileSizeHigh=0x0, nFileSizeLow=0x167ed)) returned 1
	[0161.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv", lpFilePart=0x0) returned 0x2e
	[0161.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.413] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\xwnfi.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.413] GetFileType (hFile=0x47c) returned 0x1
	[0161.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.413] GetFileType (hFile=0x47c) returned 0x1
	[0161.413] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x167ed
	[0161.414] ReadFile (in: hFile=0x47c, lpBuffer=0x944dd60, nNumberOfBytesToRead=0x167ed, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x944dd60*, lpNumberOfBytesRead=0x540efcc*=0x167ed, lpOverlapped=0x0) returned 1
	[0161.416] CloseHandle (hObject=0x47c) returned 1
	[0161.416] CryptDestroyKey (hKey=0x82b000) returned 1
	[0161.416] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.416] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a73e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0161.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.416] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0161.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.416] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27a7498*=0x1, dwFlags=0x0) returned 1
	[0161.416] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27a7464, dwFlags=0x0) returned 1
	[0161.418] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9464570*, pdwDataLen=0x540efd4*=0x167f0, dwBufLen=0x167f0 | out: pbData=0x9464570*, pdwDataLen=0x540efd4*=0x167f0) returned 1
	[0161.418] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a74a8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a74a8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.418] CryptDestroyKey (hKey=0x82b280) returned 1
	[0161.418] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.418] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.418] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv", lpFilePart=0x0) returned 0x2e
	[0161.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.418] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\xwnfi.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.420] GetFileType (hFile=0x47c) returned 0x1
	[0161.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.420] GetFileType (hFile=0x47c) returned 0x1
	[0161.420] WriteFile (in: hFile=0x47c, lpBuffer=0x9464570*, nNumberOfBytesToWrite=0x167f0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x9464570*, lpNumberOfBytesWritten=0x540efc0*=0x167f0, lpOverlapped=0x0) returned 1
	[0161.423] CloseHandle (hObject=0x47c) returned 1
	[0161.423] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv", lpFilePart=0x0) returned 0x2e
	[0161.423] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0161.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.423] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\xwnfi.mkv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb632d40, ftCreationTime.dwHighDateTime=0x1d4cecf, ftLastAccessTime.dwLowDateTime=0x982f9870, ftLastAccessTime.dwHighDateTime=0x1d4cae3, ftLastWriteTime.dwLowDateTime=0x9a8aa068, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x167f0)) returned 1
	[0161.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.423] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\xwnfi.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\XwNfi.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\xwnfi.mkv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.424] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x6c
	[0161.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.424] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x27a7838 | out: lpFileInformation=0x27a7838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f)) returned 1
	[0161.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.472] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x6c
	[0161.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.472] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.473] GetFileType (hFile=0x47c) returned 0x1
	[0161.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.473] GetFileType (hFile=0x47c) returned 0x1
	[0161.473] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x564f
	[0161.473] ReadFile (in: hFile=0x47c, lpBuffer=0x27a7b68, nNumberOfBytesToRead=0x564f, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a7b68*, lpNumberOfBytesRead=0x540efcc*=0x564f, lpOverlapped=0x0) returned 1
	[0161.595] CloseHandle (hObject=0x47c) returned 1
	[0161.595] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0161.595] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.595] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ad254, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0161.596] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.596] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.596] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0161.596] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.596] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27ad30c*=0x1, dwFlags=0x0) returned 1
	[0161.596] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27ad2d8, dwFlags=0x0) returned 1
	[0161.596] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ad31c*, pdwDataLen=0x540efd4*=0x5650, dwBufLen=0x5650 | out: pbData=0x27ad31c*, pdwDataLen=0x540efd4*=0x5650) returned 1
	[0161.596] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b2978*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b2978*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.596] CryptDestroyKey (hKey=0x82b280) returned 1
	[0161.596] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.596] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x6c
	[0161.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.596] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.598] GetFileType (hFile=0x47c) returned 0x1
	[0161.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.598] GetFileType (hFile=0x47c) returned 0x1
	[0161.598] WriteFile (in: hFile=0x47c, lpBuffer=0x27ad31c*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27ad31c*, lpNumberOfBytesWritten=0x540efc0*=0x5650, lpOverlapped=0x0) returned 1
	[0161.599] CloseHandle (hObject=0x47c) returned 1
	[0161.599] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x6c
	[0161.599] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9b
	[0161.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.599] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x9aa73c9f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5650)) returned 1
	[0161.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.599] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash", lpFilePart=0x0) returned 0x5e
	[0161.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.600] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash"), fInfoLevelId=0x0, lpFileInformation=0x27b2f98 | out: lpFileInformation=0x27b2f98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66)) returned 1
	[0161.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash", lpFilePart=0x0) returned 0x5e
	[0161.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.601] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.601] GetFileType (hFile=0x47c) returned 0x1
	[0161.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.602] GetFileType (hFile=0x47c) returned 0x1
	[0161.602] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x66
	[0161.602] ReadFile (in: hFile=0x47c, lpBuffer=0x27b32cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b32cc*, lpNumberOfBytesRead=0x540efcc*=0x66, lpOverlapped=0x0) returned 1
	[0161.602] CloseHandle (hObject=0x47c) returned 1
	[0161.603] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0161.603] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.603] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b4368, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0161.603] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.603] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.603] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0161.603] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.603] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27b4420*=0x1, dwFlags=0x0) returned 1
	[0161.603] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27b43ec, dwFlags=0x0) returned 1
	[0161.603] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b4430*, pdwDataLen=0x540efd4*=0x70, dwBufLen=0x70 | out: pbData=0x27b4430*, pdwDataLen=0x540efd4*=0x70) returned 1
	[0161.603] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b44ac*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b44ac*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.603] CryptDestroyKey (hKey=0x82b340) returned 1
	[0161.603] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.603] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.603] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash", lpFilePart=0x0) returned 0x5e
	[0161.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.603] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.604] GetFileType (hFile=0x47c) returned 0x1
	[0161.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.604] GetFileType (hFile=0x47c) returned 0x1
	[0161.604] WriteFile (in: hFile=0x47c, lpBuffer=0x27b4618*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27b4618*, lpNumberOfBytesWritten=0x540ef94*=0x70, lpOverlapped=0x0) returned 1
	[0161.605] CloseHandle (hObject=0x47c) returned 1
	[0161.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash", lpFilePart=0x0) returned 0x5e
	[0161.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8d
	[0161.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0161.606] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x9aa73c9f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
	[0161.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0161.606] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0161.606] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a
	[0161.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0161.606] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x27b5a30 | out: lpFileInformation=0x27b5a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4)) returned 1
	[0161.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0161.607] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a
	[0161.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0161.607] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.607] GetFileType (hFile=0x47c) returned 0x1
	[0161.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0161.607] GetFileType (hFile=0x47c) returned 0x1
	[0161.607] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xd77c4
	[0161.609] ReadFile (in: hFile=0x47c, lpBuffer=0x947ad80, nNumberOfBytesToRead=0xd77c4, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x947ad80*, lpNumberOfBytesRead=0x540efcc*=0xd77c4, lpOverlapped=0x0) returned 1
	[0161.928] CloseHandle (hObject=0x47c) returned 1
	[0161.929] CryptDestroyKey (hKey=0x82b300) returned 1
	[0161.929] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.929] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b5de0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0161.929] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.929] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.929] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0161.929] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0161.929] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27b5e98*=0x1, dwFlags=0x0) returned 1
	[0161.929] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27b5e64, dwFlags=0x0) returned 1
	[0161.942] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9552560*, pdwDataLen=0x540efd4*=0xd77d0, dwBufLen=0xd77d0 | out: pbData=0x9552560*, pdwDataLen=0x540efd4*=0xd77d0) returned 1
	[0161.943] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b5ea8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b5ea8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0161.943] CryptDestroyKey (hKey=0x82b280) returned 1
	[0161.943] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.943] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0161.943] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a
	[0161.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0161.943] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0161.951] GetFileType (hFile=0x47c) returned 0x1
	[0161.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0161.951] GetFileType (hFile=0x47c) returned 0x1
	[0161.951] WriteFile (in: hFile=0x47c, lpBuffer=0x9552560*, nNumberOfBytesToWrite=0xd77d0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x9552560*, lpNumberOfBytesWritten=0x540efc0*=0xd77d0, lpOverlapped=0x0) returned 1
	[0161.999] CloseHandle (hObject=0x47c) returned 1
	[0162.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a
	[0162.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x99
	[0162.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0162.000] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x9ae345aa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xd77d0)) returned 1
	[0162.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0162.000] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0162.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x6e
	[0162.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0162.001] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x27b64b0 | out: lpFileInformation=0x27b64b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211)) returned 1
	[0162.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0162.002] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x6e
	[0162.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0162.002] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0162.002] GetFileType (hFile=0x47c) returned 0x1
	[0162.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0162.002] GetFileType (hFile=0x47c) returned 0x1
	[0162.002] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x5211
	[0162.002] ReadFile (in: hFile=0x47c, lpBuffer=0x27b67e8, nNumberOfBytesToRead=0x5211, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b67e8*, lpNumberOfBytesRead=0x540efcc*=0x5211, lpOverlapped=0x0) returned 1
	[0162.065] CloseHandle (hObject=0x47c) returned 1
	[0162.065] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0162.065] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0162.065] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27bba98, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0162.065] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0162.065] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0162.065] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0162.065] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0162.065] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27bbb50*=0x1, dwFlags=0x0) returned 1
	[0162.065] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27bbb1c, dwFlags=0x0) returned 1
	[0162.066] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27bbb60*, pdwDataLen=0x540efd4*=0x5220, dwBufLen=0x5220 | out: pbData=0x27bbb60*, pdwDataLen=0x540efd4*=0x5220) returned 1
	[0162.066] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c0d8c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c0d8c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0162.066] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0162.066] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0162.066] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0162.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x6e
	[0162.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0162.066] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0162.068] GetFileType (hFile=0x47c) returned 0x1
	[0162.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0162.068] GetFileType (hFile=0x47c) returned 0x1
	[0162.068] WriteFile (in: hFile=0x47c, lpBuffer=0x27bbb60*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x27bbb60*, lpNumberOfBytesWritten=0x540efc0*=0x5220, lpOverlapped=0x0) returned 1
	[0162.069] CloseHandle (hObject=0x47c) returned 1
	[0162.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x6e
	[0162.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9d
	[0162.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0162.069] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x9aeeed47, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5220)) returned 1
	[0162.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0162.070] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0162.070] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash", lpFilePart=0x0) returned 0x5c
	[0162.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0162.071] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash"), fInfoLevelId=0x0, lpFileInformation=0x27c13c0 | out: lpFileInformation=0x27c13c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66)) returned 1
	[0162.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0162.072] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash", lpFilePart=0x0) returned 0x5c
	[0162.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0162.073] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0162.073] GetFileType (hFile=0x47c) returned 0x1
	[0162.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0162.073] GetFileType (hFile=0x47c) returned 0x1
	[0162.073] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x66
	[0162.073] ReadFile (in: hFile=0x47c, lpBuffer=0x27c16dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c16dc*, lpNumberOfBytesRead=0x540efcc*=0x66, lpOverlapped=0x0) returned 1
	[0162.074] CloseHandle (hObject=0x47c) returned 1
	[0162.074] CryptDestroyKey (hKey=0x82b400) returned 1
	[0162.074] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0162.074] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c2778, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0162.074] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0162.074] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0162.074] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0162.075] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0162.075] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27c2830*=0x1, dwFlags=0x0) returned 1
	[0162.075] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27c27fc, dwFlags=0x0) returned 1
	[0162.075] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c2840*, pdwDataLen=0x540efd4*=0x70, dwBufLen=0x70 | out: pbData=0x27c2840*, pdwDataLen=0x540efd4*=0x70) returned 1
	[0162.075] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c28bc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c28bc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0162.075] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0162.075] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0162.075] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0162.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash", lpFilePart=0x0) returned 0x5c
	[0162.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0162.075] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0162.076] GetFileType (hFile=0x47c) returned 0x1
	[0162.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0162.076] GetFileType (hFile=0x47c) returned 0x1
	[0162.076] WriteFile (in: hFile=0x47c, lpBuffer=0x27c2a1c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27c2a1c*, lpNumberOfBytesWritten=0x540ef94*=0x70, lpOverlapped=0x0) returned 1
	[0162.077] CloseHandle (hObject=0x47c) returned 1
	[0162.078] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash", lpFilePart=0x0) returned 0x5c
	[0162.078] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8b
	[0162.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0162.078] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x9aeeed47, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
	[0162.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0162.078] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0162.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c
	[0162.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0162.095] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x27c3e24 | out: lpFileInformation=0x27c3e24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a)) returned 1
	[0162.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0162.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c
	[0162.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0162.096] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0162.096] GetFileType (hFile=0x47c) returned 0x1
	[0162.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0162.096] GetFileType (hFile=0x47c) returned 0x1
	[0162.096] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x38480a
	[0162.109] ReadFile (in: hFile=0x47c, lpBuffer=0x9629d50, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x9629d50*, lpNumberOfBytesRead=0x540efcc*=0x38480a, lpOverlapped=0x0) returned 1
	[0163.966] CloseHandle (hObject=0x47c) returned 1
	[0163.966] CryptDestroyKey (hKey=0x82b440) returned 1
	[0163.966] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0163.966] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c41dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0163.966] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0163.967] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0163.967] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0163.967] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0163.967] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27c4294*=0x1, dwFlags=0x0) returned 1
	[0163.967] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27c4260, dwFlags=0x0) returned 1
	[0166.470] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8ea1018*, pdwDataLen=0x540efd4*=0x384810, dwBufLen=0x384810 | out: pbData=0x8ea1018*, pdwDataLen=0x540efd4*=0x384810) returned 1
	[0166.473] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2600f5c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2600f5c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0166.473] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0166.473] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0166.473] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0166.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c
	[0166.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0166.473] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0166.474] GetFileType (hFile=0x318) returned 0x1
	[0166.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0166.474] GetFileType (hFile=0x318) returned 0x1
	[0166.474] WriteFile (in: hFile=0x318, lpBuffer=0x8ea1018*, nNumberOfBytesToWrite=0x384810, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x8ea1018*, lpNumberOfBytesWritten=0x540efc0*=0x384810, lpOverlapped=0x0) returned 1
	[0166.562] CloseHandle (hObject=0x318) returned 1
	[0166.563] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c
	[0166.563] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9b
	[0166.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0166.563] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x9d9c60c0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x384810)) returned 1
	[0166.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0166.563] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0166.564] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x6c
	[0166.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0166.564] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x260259c | out: lpFileInformation=0x260259c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f)) returned 1
	[0166.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0166.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.575] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.526] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.624] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.660] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.661] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.679] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.680] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.694] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.695] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.711] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.716] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.719] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.720] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.722] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.724] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.729] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.731] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.732] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.825] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.827] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.830] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.832] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.834] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.835] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.836] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.838] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.839] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.850] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.852] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.853] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.855] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.856] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.858] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.859] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.904] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.946] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.949] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.950] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.961] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.377] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.394] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.396] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.397] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.560] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.588] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.715] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", lpFilePart=0x0) returned 0x3e
	[0176.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.715] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.715] GetFileType (hFile=0x318) returned 0x1
	[0176.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.715] GetFileType (hFile=0x318) returned 0x1
	[0176.715] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10000
	[0176.716] ReadFile (in: hFile=0x318, lpBuffer=0x26d1b64, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d1b64*, lpNumberOfBytesRead=0x540efcc*=0x10000, lpOverlapped=0x0) returned 1
	[0176.717] CloseHandle (hObject=0x318) returned 1
	[0176.717] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0176.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.717] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e1c00, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0176.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.717] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0176.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.717] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26e1cb8*=0x1, dwFlags=0x0) returned 1
	[0176.717] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26e1c84, dwFlags=0x0) returned 1
	[0176.717] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e1cc8*, pdwDataLen=0x540efd4*=0x10010, dwBufLen=0x10010 | out: pbData=0x26e1cc8*, pdwDataLen=0x540efd4*=0x10010) returned 1
	[0176.718] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f1ce4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f1ce4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.718] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0176.718] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.718] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.718] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", lpFilePart=0x0) returned 0x3e
	[0176.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.718] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.720] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", lpFilePart=0x0) returned 0x48
	[0176.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.720] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), fInfoLevelId=0x0, lpFileInformation=0x26f229c | out: lpFileInformation=0x26f229c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd973cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd973cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b74fcb1, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x30000)) returned 1
	[0176.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.720] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", lpFilePart=0x0) returned 0x48
	[0176.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.720] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.721] GetFileType (hFile=0x318) returned 0x1
	[0176.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.721] GetFileType (hFile=0x318) returned 0x1
	[0176.721] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x30000
	[0176.721] ReadFile (in: hFile=0x318, lpBuffer=0x4011180, nNumberOfBytesToRead=0x30000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x4011180*, lpNumberOfBytesRead=0x540efcc*=0x30000, lpOverlapped=0x0) returned 1
	[0176.725] CloseHandle (hObject=0x318) returned 1
	[0176.725] CryptDestroyKey (hKey=0x82b100) returned 1
	[0176.725] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.725] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f25b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0176.725] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.725] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.725] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0176.725] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.725] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26f266c*=0x1, dwFlags=0x0) returned 1
	[0176.725] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26f2638, dwFlags=0x0) returned 1
	[0176.728] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40411a0*, pdwDataLen=0x540efd4*=0x30010, dwBufLen=0x30010 | out: pbData=0x40411a0*, pdwDataLen=0x540efd4*=0x30010) returned 1
	[0176.728] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f267c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f267c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.728] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0176.728] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.728] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.729] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", lpFilePart=0x0) returned 0x48
	[0176.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.729] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.731] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", lpFilePart=0x0) returned 0x49
	[0176.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm"), fInfoLevelId=0x0, lpFileInformation=0x26f2c98 | out: lpFileInformation=0x26f2c98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd7110f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd7110f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b74fcb1, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
	[0176.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.731] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", lpFilePart=0x0) returned 0x49
	[0176.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.732] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.732] GetFileType (hFile=0x318) returned 0x1
	[0176.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.732] GetFileType (hFile=0x318) returned 0x1
	[0176.732] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x4000
	[0176.732] ReadFile (in: hFile=0x318, lpBuffer=0x26f2f20, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f2f20*, lpNumberOfBytesRead=0x540efcc*=0x4000, lpOverlapped=0x0) returned 1
	[0176.733] CloseHandle (hObject=0x318) returned 1
	[0176.733] CryptDestroyKey (hKey=0x82b340) returned 1
	[0176.733] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.733] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f6fbc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0176.733] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.733] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.733] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0176.733] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.733] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26f7074*=0x1, dwFlags=0x0) returned 1
	[0176.733] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26f7040, dwFlags=0x0) returned 1
	[0176.733] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f7084*, pdwDataLen=0x540efd4*=0x4010, dwBufLen=0x4010 | out: pbData=0x26f7084*, pdwDataLen=0x540efd4*=0x4010) returned 1
	[0176.734] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fb0a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26fb0a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.734] CryptDestroyKey (hKey=0x82b440) returned 1
	[0176.734] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.734] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.734] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", lpFilePart=0x0) returned 0x49
	[0176.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.734] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.736] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", lpFilePart=0x0) returned 0x47
	[0176.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.736] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), fInfoLevelId=0x0, lpFileInformation=0x26fb6c0 | out: lpFileInformation=0x26fb6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4771)) returned 1
	[0176.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.736] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", lpFilePart=0x0) returned 0x47
	[0176.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.736] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.736] GetFileType (hFile=0x318) returned 0x1
	[0176.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.736] GetFileType (hFile=0x318) returned 0x1
	[0176.736] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x4771
	[0176.737] ReadFile (in: hFile=0x318, lpBuffer=0x26fb948, nNumberOfBytesToRead=0x4771, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26fb948*, lpNumberOfBytesRead=0x540efcc*=0x4771, lpOverlapped=0x0) returned 1
	[0176.737] CloseHandle (hObject=0x318) returned 1
	[0176.738] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0176.738] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.738] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2700158, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0176.738] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.738] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.738] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0176.738] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.738] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2700210*=0x1, dwFlags=0x0) returned 1
	[0176.738] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27001dc, dwFlags=0x0) returned 1
	[0176.738] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2700220*, pdwDataLen=0x540efd4*=0x4780, dwBufLen=0x4780 | out: pbData=0x2700220*, pdwDataLen=0x540efd4*=0x4780) returned 1
	[0176.738] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27049ac*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27049ac*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.738] CryptDestroyKey (hKey=0x82b300) returned 1
	[0176.738] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.739] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.739] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", lpFilePart=0x0) returned 0x47
	[0176.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.739] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.741] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", lpFilePart=0x0) returned 0x4c
	[0176.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.741] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), fInfoLevelId=0x0, lpFileInformation=0x2704fc0 | out: lpFileInformation=0x2704fc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x173d)) returned 1
	[0176.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.741] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", lpFilePart=0x0) returned 0x4c
	[0176.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.741] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.741] GetFileType (hFile=0x318) returned 0x1
	[0176.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.742] GetFileType (hFile=0x318) returned 0x1
	[0176.742] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x173d
	[0176.742] ReadFile (in: hFile=0x318, lpBuffer=0x2705278, nNumberOfBytesToRead=0x173d, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2705278*, lpNumberOfBytesRead=0x540efcc*=0x173d, lpOverlapped=0x0) returned 1
	[0176.743] CloseHandle (hObject=0x318) returned 1
	[0176.743] CryptDestroyKey (hKey=0x82b340) returned 1
	[0176.743] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.743] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2706a54, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0176.743] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.743] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.743] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0176.743] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.743] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2706b0c*=0x1, dwFlags=0x0) returned 1
	[0176.743] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2706ad8, dwFlags=0x0) returned 1
	[0176.743] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2706b1c*, pdwDataLen=0x540efd4*=0x1740, dwBufLen=0x1740 | out: pbData=0x2706b1c*, pdwDataLen=0x540efd4*=0x1740) returned 1
	[0176.743] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2708268*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2708268*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.743] CryptDestroyKey (hKey=0x82b000) returned 1
	[0176.743] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.743] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.743] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", lpFilePart=0x0) returned 0x4c
	[0176.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.744] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.745] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", lpFilePart=0x0) returned 0x51
	[0176.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.746] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), fInfoLevelId=0x0, lpFileInformation=0x27088b4 | out: lpFileInformation=0x27088b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc27)) returned 1
	[0176.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.746] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", lpFilePart=0x0) returned 0x51
	[0176.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.746] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.747] GetFileType (hFile=0x318) returned 0x1
	[0176.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.747] GetFileType (hFile=0x318) returned 0x1
	[0176.747] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xc27
	[0176.747] ReadFile (in: hFile=0x318, lpBuffer=0x27097c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27097c0*, lpNumberOfBytesRead=0x540efcc*=0xc27, lpOverlapped=0x0) returned 1
	[0176.748] CloseHandle (hObject=0x318) returned 1
	[0176.748] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0176.748] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.748] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270a85c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0176.748] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.748] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.748] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0176.748] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.748] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x270a914*=0x1, dwFlags=0x0) returned 1
	[0176.748] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x270a8e0, dwFlags=0x0) returned 1
	[0176.748] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270a924*, pdwDataLen=0x540efd4*=0xc30, dwBufLen=0xc30 | out: pbData=0x270a924*, pdwDataLen=0x540efd4*=0xc30) returned 1
	[0176.749] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270b560*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x270b560*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.749] CryptDestroyKey (hKey=0x82b280) returned 1
	[0176.749] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.749] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.749] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", lpFilePart=0x0) returned 0x51
	[0176.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.749] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.751] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", lpFilePart=0x0) returned 0x57
	[0176.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.751] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), fInfoLevelId=0x0, lpFileInformation=0x270bbd8 | out: lpFileInformation=0x270bbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb)) returned 1
	[0176.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.751] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", lpFilePart=0x0) returned 0x57
	[0176.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.752] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.752] GetFileType (hFile=0x318) returned 0x1
	[0176.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.752] GetFileType (hFile=0x318) returned 0x1
	[0176.752] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x9eb
	[0176.752] ReadFile (in: hFile=0x318, lpBuffer=0x270c8d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x270c8d8*, lpNumberOfBytesRead=0x540efcc*=0x9eb, lpOverlapped=0x0) returned 1
	[0176.753] CloseHandle (hObject=0x318) returned 1
	[0176.753] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0176.753] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.753] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270d974, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0176.753] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.753] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.753] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0176.753] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.754] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x270da2c*=0x1, dwFlags=0x0) returned 1
	[0176.754] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x270d9f8, dwFlags=0x0) returned 1
	[0176.754] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270da3c*, pdwDataLen=0x540efd4*=0x9f0, dwBufLen=0x9f0 | out: pbData=0x270da3c*, pdwDataLen=0x540efd4*=0x9f0) returned 1
	[0176.754] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270e438*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x270e438*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.754] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0176.754] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.754] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.754] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", lpFilePart=0x0) returned 0x57
	[0176.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.754] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.756] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", lpFilePart=0x0) returned 0x45
	[0176.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.756] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), fInfoLevelId=0x0, lpFileInformation=0x270eaec | out: lpFileInformation=0x270eaec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf80)) returned 1
	[0176.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.757] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", lpFilePart=0x0) returned 0x45
	[0176.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.757] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.757] GetFileType (hFile=0x318) returned 0x1
	[0176.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.757] GetFileType (hFile=0x318) returned 0x1
	[0176.757] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xf80
	[0176.757] ReadFile (in: hFile=0x318, lpBuffer=0x270fcf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x270fcf0*, lpNumberOfBytesRead=0x540efcc*=0xf80, lpOverlapped=0x0) returned 1
	[0176.758] CloseHandle (hObject=0x318) returned 1
	[0176.758] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0176.758] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.758] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2710d8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0176.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.758] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0176.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.759] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2710e44*=0x1, dwFlags=0x0) returned 1
	[0176.759] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2710e10, dwFlags=0x0) returned 1
	[0176.759] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2710e54*, pdwDataLen=0x540efd4*=0xf90, dwBufLen=0xf90 | out: pbData=0x2710e54*, pdwDataLen=0x540efd4*=0xf90) returned 1
	[0176.759] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2711df0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2711df0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.759] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0176.759] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.759] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.759] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", lpFilePart=0x0) returned 0x45
	[0176.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.759] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.761] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", lpFilePart=0x0) returned 0x4a
	[0176.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), fInfoLevelId=0x0, lpFileInformation=0x27123f0 | out: lpFileInformation=0x27123f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31)) returned 1
	[0176.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.796] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", lpFilePart=0x0) returned 0x4a
	[0176.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.796] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.796] GetFileType (hFile=0x318) returned 0x1
	[0176.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.796] GetFileType (hFile=0x318) returned 0x1
	[0176.796] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb31
	[0176.796] ReadFile (in: hFile=0x318, lpBuffer=0x27131d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27131d8*, lpNumberOfBytesRead=0x540efcc*=0xb31, lpOverlapped=0x0) returned 1
	[0176.797] CloseHandle (hObject=0x318) returned 1
	[0176.797] CryptDestroyKey (hKey=0x82b200) returned 1
	[0176.797] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.797] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2714274, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0176.798] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.798] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.798] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0176.798] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.798] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x271432c*=0x1, dwFlags=0x0) returned 1
	[0176.798] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x27142f8, dwFlags=0x0) returned 1
	[0176.798] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271433c*, pdwDataLen=0x540efd4*=0xb40, dwBufLen=0xb40 | out: pbData=0x271433c*, pdwDataLen=0x540efd4*=0xb40) returned 1
	[0176.798] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2714e88*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2714e88*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.798] CryptDestroyKey (hKey=0x82b400) returned 1
	[0176.798] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.798] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.798] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", lpFilePart=0x0) returned 0x4a
	[0176.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.798] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.800] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", lpFilePart=0x0) returned 0x4a
	[0176.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), fInfoLevelId=0x0, lpFileInformation=0x27154c0 | out: lpFileInformation=0x27154c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31)) returned 1
	[0176.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.801] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", lpFilePart=0x0) returned 0x4a
	[0176.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.801] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.801] GetFileType (hFile=0x318) returned 0x1
	[0176.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.801] GetFileType (hFile=0x318) returned 0x1
	[0176.801] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb31
	[0176.801] ReadFile (in: hFile=0x318, lpBuffer=0x27162a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27162a8*, lpNumberOfBytesRead=0x540efcc*=0xb31, lpOverlapped=0x0) returned 1
	[0176.802] CloseHandle (hObject=0x318) returned 1
	[0176.802] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0176.802] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.803] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2717344, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0176.803] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.803] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.803] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0176.803] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.803] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x27173fc*=0x1, dwFlags=0x0) returned 1
	[0176.803] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x27173c8, dwFlags=0x0) returned 1
	[0176.803] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271740c*, pdwDataLen=0x540efd4*=0xb40, dwBufLen=0xb40 | out: pbData=0x271740c*, pdwDataLen=0x540efd4*=0xb40) returned 1
	[0176.803] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2717f58*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2717f58*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.803] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0176.803] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.803] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.803] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", lpFilePart=0x0) returned 0x4a
	[0176.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.803] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.805] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", lpFilePart=0x0) returned 0x44
	[0176.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.806] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), fInfoLevelId=0x0, lpFileInformation=0x2718590 | out: lpFileInformation=0x2718590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd)) returned 1
	[0176.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.806] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", lpFilePart=0x0) returned 0x44
	[0176.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.806] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.806] GetFileType (hFile=0x318) returned 0x1
	[0176.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.807] GetFileType (hFile=0x318) returned 0x1
	[0176.807] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3bd
	[0176.807] ReadFile (in: hFile=0x318, lpBuffer=0x2718bd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2718bd4*, lpNumberOfBytesRead=0x540efcc*=0x3bd, lpOverlapped=0x0) returned 1
	[0176.807] CloseHandle (hObject=0x318) returned 1
	[0176.808] CryptDestroyKey (hKey=0x82b480) returned 1
	[0176.808] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.808] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2719c70, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0176.808] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.808] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.808] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0176.808] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.808] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2719d28*=0x1, dwFlags=0x0) returned 1
	[0176.809] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2719cf4, dwFlags=0x0) returned 1
	[0176.809] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2719d38*, pdwDataLen=0x540efd4*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x2719d38*, pdwDataLen=0x540efd4*=0x3c0) returned 1
	[0176.809] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271a104*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271a104*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.809] CryptDestroyKey (hKey=0x82b100) returned 1
	[0176.809] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.809] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.809] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", lpFilePart=0x0) returned 0x44
	[0176.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.809] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.811] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", lpFilePart=0x0) returned 0x4c
	[0176.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.811] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), fInfoLevelId=0x0, lpFileInformation=0x271a700 | out: lpFileInformation=0x271a700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51)) returned 1
	[0176.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.812] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", lpFilePart=0x0) returned 0x4c
	[0176.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.812] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.812] GetFileType (hFile=0x318) returned 0x1
	[0176.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.812] GetFileType (hFile=0x318) returned 0x1
	[0176.812] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x11c51
	[0176.812] ReadFile (in: hFile=0x318, lpBuffer=0x271a9b8, nNumberOfBytesToRead=0x11c51, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271a9b8*, lpNumberOfBytesRead=0x540efcc*=0x11c51, lpOverlapped=0x0) returned 1
	[0176.813] CloseHandle (hObject=0x318) returned 1
	[0176.813] CryptDestroyKey (hKey=0x82b400) returned 1
	[0176.813] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.813] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272c6a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0176.813] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.814] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.814] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0176.814] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.814] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x272c760*=0x1, dwFlags=0x0) returned 1
	[0176.814] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x272c72c, dwFlags=0x0) returned 1
	[0176.814] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272c770*, pdwDataLen=0x540efd4*=0x11c60, dwBufLen=0x11c60 | out: pbData=0x272c770*, pdwDataLen=0x540efd4*=0x11c60) returned 1
	[0176.814] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273e3dc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x273e3dc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.814] CryptDestroyKey (hKey=0x82b480) returned 1
	[0176.814] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.814] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.814] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", lpFilePart=0x0) returned 0x4c
	[0176.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.814] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.816] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", lpFilePart=0x0) returned 0x4c
	[0176.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.816] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), fInfoLevelId=0x0, lpFileInformation=0x273ea28 | out: lpFileInformation=0x273ea28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51)) returned 1
	[0176.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.817] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", lpFilePart=0x0) returned 0x4c
	[0176.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.817] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.817] GetFileType (hFile=0x318) returned 0x1
	[0176.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.817] GetFileType (hFile=0x318) returned 0x1
	[0176.817] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x11c51
	[0176.817] ReadFile (in: hFile=0x318, lpBuffer=0x273ece0, nNumberOfBytesToRead=0x11c51, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x273ece0*, lpNumberOfBytesRead=0x540efcc*=0x11c51, lpOverlapped=0x0) returned 1
	[0176.818] CloseHandle (hObject=0x318) returned 1
	[0176.818] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0176.818] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.818] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27509d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0176.818] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.818] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.818] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0176.818] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.818] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2750a88*=0x1, dwFlags=0x0) returned 1
	[0176.819] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2750a54, dwFlags=0x0) returned 1
	[0176.819] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2750a98*, pdwDataLen=0x540efd4*=0x11c60, dwBufLen=0x11c60 | out: pbData=0x2750a98*, pdwDataLen=0x540efd4*=0x11c60) returned 1
	[0176.819] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2762704*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2762704*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.819] CryptDestroyKey (hKey=0x82b380) returned 1
	[0176.819] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.819] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.819] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", lpFilePart=0x0) returned 0x4c
	[0176.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.819] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.821] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", lpFilePart=0x0) returned 0x52
	[0176.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.821] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), fInfoLevelId=0x0, lpFileInformation=0x2762d50 | out: lpFileInformation=0x2762d50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368)) returned 1
	[0176.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.821] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", lpFilePart=0x0) returned 0x52
	[0176.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.821] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.821] GetFileType (hFile=0x318) returned 0x1
	[0176.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.822] GetFileType (hFile=0x318) returned 0x1
	[0176.822] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3368
	[0176.822] ReadFile (in: hFile=0x318, lpBuffer=0x2763038, nNumberOfBytesToRead=0x3368, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2763038*, lpNumberOfBytesRead=0x540efcc*=0x3368, lpOverlapped=0x0) returned 1
	[0176.823] CloseHandle (hObject=0x318) returned 1
	[0176.823] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0176.823] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.823] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276643c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0176.823] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.823] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.823] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0176.823] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.823] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27664f4*=0x1, dwFlags=0x0) returned 1
	[0176.823] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27664c0, dwFlags=0x0) returned 1
	[0176.823] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2766504*, pdwDataLen=0x540efd4*=0x3370, dwBufLen=0x3370 | out: pbData=0x2766504*, pdwDataLen=0x540efd4*=0x3370) returned 1
	[0176.823] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2769880*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2769880*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.824] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0176.824] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.824] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.824] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", lpFilePart=0x0) returned 0x52
	[0176.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.854] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.856] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", lpFilePart=0x0) returned 0x52
	[0176.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.856] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), fInfoLevelId=0x0, lpFileInformation=0x2769f08 | out: lpFileInformation=0x2769f08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368)) returned 1
	[0176.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.857] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", lpFilePart=0x0) returned 0x52
	[0176.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.857] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.857] GetFileType (hFile=0x318) returned 0x1
	[0176.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.857] GetFileType (hFile=0x318) returned 0x1
	[0176.857] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3368
	[0176.913] ReadFile (in: hFile=0x318, lpBuffer=0x276a1f0, nNumberOfBytesToRead=0x3368, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x276a1f0*, lpNumberOfBytesRead=0x540efcc*=0x3368, lpOverlapped=0x0) returned 1
	[0176.914] CloseHandle (hObject=0x318) returned 1
	[0176.914] CryptDestroyKey (hKey=0x82b280) returned 1
	[0176.914] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.914] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276d5f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0176.914] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.914] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.914] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0176.914] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.914] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x276d6ac*=0x1, dwFlags=0x0) returned 1
	[0176.915] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x276d678, dwFlags=0x0) returned 1
	[0176.915] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276d6bc*, pdwDataLen=0x540efd4*=0x3370, dwBufLen=0x3370 | out: pbData=0x276d6bc*, pdwDataLen=0x540efd4*=0x3370) returned 1
	[0176.915] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2770a38*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2770a38*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.915] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0176.915] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.915] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.915] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", lpFilePart=0x0) returned 0x52
	[0176.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.915] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.917] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", lpFilePart=0x0) returned 0x55
	[0176.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.917] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), fInfoLevelId=0x0, lpFileInformation=0x27710c0 | out: lpFileInformation=0x27710c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964)) returned 1
	[0176.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.917] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", lpFilePart=0x0) returned 0x55
	[0176.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.917] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.917] GetFileType (hFile=0x318) returned 0x1
	[0176.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.918] GetFileType (hFile=0x318) returned 0x1
	[0176.918] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2964
	[0176.918] ReadFile (in: hFile=0x318, lpBuffer=0x27713b8, nNumberOfBytesToRead=0x2964, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27713b8*, lpNumberOfBytesRead=0x540efcc*=0x2964, lpOverlapped=0x0) returned 1
	[0176.918] CloseHandle (hObject=0x318) returned 1
	[0176.919] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0176.919] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.919] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2773db8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0176.919] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.919] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.919] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0176.919] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.919] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2773e70*=0x1, dwFlags=0x0) returned 1
	[0176.919] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2773e3c, dwFlags=0x0) returned 1
	[0176.919] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2773e80*, pdwDataLen=0x540efd4*=0x2970, dwBufLen=0x2970 | out: pbData=0x2773e80*, pdwDataLen=0x540efd4*=0x2970) returned 1
	[0176.919] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27767fc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27767fc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.919] CryptDestroyKey (hKey=0x82b300) returned 1
	[0176.919] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.919] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.919] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", lpFilePart=0x0) returned 0x55
	[0176.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.919] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.921] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", lpFilePart=0x0) returned 0x55
	[0176.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.921] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), fInfoLevelId=0x0, lpFileInformation=0x2776e9c | out: lpFileInformation=0x2776e9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964)) returned 1
	[0176.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.921] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", lpFilePart=0x0) returned 0x55
	[0176.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.922] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.922] GetFileType (hFile=0x318) returned 0x1
	[0176.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.922] GetFileType (hFile=0x318) returned 0x1
	[0176.922] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2964
	[0176.922] ReadFile (in: hFile=0x318, lpBuffer=0x2777194, nNumberOfBytesToRead=0x2964, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2777194*, lpNumberOfBytesRead=0x540efcc*=0x2964, lpOverlapped=0x0) returned 1
	[0176.923] CloseHandle (hObject=0x318) returned 1
	[0176.923] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0176.923] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.923] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2779b94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0176.923] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.923] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.923] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0176.923] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.923] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2779c4c*=0x1, dwFlags=0x0) returned 1
	[0176.923] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2779c18, dwFlags=0x0) returned 1
	[0176.923] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2779c5c*, pdwDataLen=0x540efd4*=0x2970, dwBufLen=0x2970 | out: pbData=0x2779c5c*, pdwDataLen=0x540efd4*=0x2970) returned 1
	[0176.923] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277c5d8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x277c5d8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.924] CryptDestroyKey (hKey=0x82b380) returned 1
	[0176.924] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.924] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.924] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", lpFilePart=0x0) returned 0x55
	[0176.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.924] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.925] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", lpFilePart=0x0) returned 0x4c
	[0176.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.926] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), fInfoLevelId=0x0, lpFileInformation=0x277cc78 | out: lpFileInformation=0x277cc78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f)) returned 1
	[0176.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.926] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", lpFilePart=0x0) returned 0x4c
	[0176.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.926] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.926] GetFileType (hFile=0x318) returned 0x1
	[0176.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.926] GetFileType (hFile=0x318) returned 0x1
	[0176.926] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10b0f
	[0176.926] ReadFile (in: hFile=0x318, lpBuffer=0x277cf30, nNumberOfBytesToRead=0x10b0f, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x277cf30*, lpNumberOfBytesRead=0x540efcc*=0x10b0f, lpOverlapped=0x0) returned 1
	[0176.927] CloseHandle (hObject=0x318) returned 1
	[0176.928] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0176.928] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.928] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278dadc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0176.928] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.928] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.928] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0176.928] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.928] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x278db94*=0x1, dwFlags=0x0) returned 1
	[0176.928] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x278db60, dwFlags=0x0) returned 1
	[0176.928] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278dba4*, pdwDataLen=0x540efd4*=0x10b10, dwBufLen=0x10b10 | out: pbData=0x278dba4*, pdwDataLen=0x540efd4*=0x10b10) returned 1
	[0176.928] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279e6c0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x279e6c0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.928] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0176.928] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.928] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.929] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", lpFilePart=0x0) returned 0x4c
	[0176.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.929] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.930] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", lpFilePart=0x0) returned 0x4c
	[0176.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.930] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), fInfoLevelId=0x0, lpFileInformation=0x279ed0c | out: lpFileInformation=0x279ed0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f)) returned 1
	[0176.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.931] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", lpFilePart=0x0) returned 0x4c
	[0176.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.931] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.931] GetFileType (hFile=0x318) returned 0x1
	[0176.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.931] GetFileType (hFile=0x318) returned 0x1
	[0176.931] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x10b0f
	[0176.931] ReadFile (in: hFile=0x318, lpBuffer=0x279efc4, nNumberOfBytesToRead=0x10b0f, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x279efc4*, lpNumberOfBytesRead=0x540efcc*=0x10b0f, lpOverlapped=0x0) returned 1
	[0176.932] CloseHandle (hObject=0x318) returned 1
	[0176.932] CryptDestroyKey (hKey=0x82b100) returned 1
	[0176.932] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.932] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27afb70, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0176.932] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.932] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.933] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0176.933] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.933] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27afc28*=0x1, dwFlags=0x0) returned 1
	[0176.933] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27afbf4, dwFlags=0x0) returned 1
	[0176.933] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27afc38*, pdwDataLen=0x540efd4*=0x10b10, dwBufLen=0x10b10 | out: pbData=0x27afc38*, pdwDataLen=0x540efd4*=0x10b10) returned 1
	[0176.933] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c0754*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c0754*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.933] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0176.933] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.933] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.933] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", lpFilePart=0x0) returned 0x4c
	[0176.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.933] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.935] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", lpFilePart=0x0) returned 0x52
	[0176.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.935] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), fInfoLevelId=0x0, lpFileInformation=0x27c0da0 | out: lpFileInformation=0x27c0da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368)) returned 1
	[0176.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.935] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", lpFilePart=0x0) returned 0x52
	[0176.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.935] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.935] GetFileType (hFile=0x318) returned 0x1
	[0176.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.936] GetFileType (hFile=0x318) returned 0x1
	[0176.936] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3368
	[0176.936] ReadFile (in: hFile=0x318, lpBuffer=0x27c1088, nNumberOfBytesToRead=0x3368, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c1088*, lpNumberOfBytesRead=0x540efcc*=0x3368, lpOverlapped=0x0) returned 1
	[0176.937] CloseHandle (hObject=0x318) returned 1
	[0176.937] CryptDestroyKey (hKey=0x82b400) returned 1
	[0176.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.937] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c448c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0176.937] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.937] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.937] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0176.937] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.937] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27c4544*=0x1, dwFlags=0x0) returned 1
	[0176.937] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27c4510, dwFlags=0x0) returned 1
	[0176.937] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c4554*, pdwDataLen=0x540efd4*=0x3370, dwBufLen=0x3370 | out: pbData=0x27c4554*, pdwDataLen=0x540efd4*=0x3370) returned 1
	[0176.937] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c78d0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c78d0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.937] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0176.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.937] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", lpFilePart=0x0) returned 0x52
	[0176.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.938] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.939] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", lpFilePart=0x0) returned 0x52
	[0176.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), fInfoLevelId=0x0, lpFileInformation=0x27c7f58 | out: lpFileInformation=0x27c7f58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368)) returned 1
	[0176.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.940] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", lpFilePart=0x0) returned 0x52
	[0176.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.940] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.940] GetFileType (hFile=0x318) returned 0x1
	[0176.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.940] GetFileType (hFile=0x318) returned 0x1
	[0176.940] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3368
	[0176.940] ReadFile (in: hFile=0x318, lpBuffer=0x27c8240, nNumberOfBytesToRead=0x3368, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c8240*, lpNumberOfBytesRead=0x540efcc*=0x3368, lpOverlapped=0x0) returned 1
	[0176.941] CloseHandle (hObject=0x318) returned 1
	[0176.941] CryptDestroyKey (hKey=0x82b200) returned 1
	[0176.941] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.941] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27cb644, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0176.941] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.941] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.941] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0176.941] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.941] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27cb6fc*=0x1, dwFlags=0x0) returned 1
	[0176.941] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27cb6c8, dwFlags=0x0) returned 1
	[0176.941] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27cb70c*, pdwDataLen=0x540efd4*=0x3370, dwBufLen=0x3370 | out: pbData=0x27cb70c*, pdwDataLen=0x540efd4*=0x3370) returned 1
	[0176.942] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cea88*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27cea88*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.942] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0176.942] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.942] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.942] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", lpFilePart=0x0) returned 0x52
	[0176.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.942] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.944] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", lpFilePart=0x0) returned 0x4c
	[0176.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.944] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), fInfoLevelId=0x0, lpFileInformation=0x27cf110 | out: lpFileInformation=0x27cf110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c3)) returned 1
	[0176.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.944] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", lpFilePart=0x0) returned 0x4c
	[0176.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.944] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.944] GetFileType (hFile=0x318) returned 0x1
	[0176.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.944] GetFileType (hFile=0x318) returned 0x1
	[0176.945] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x100c3
	[0176.945] ReadFile (in: hFile=0x318, lpBuffer=0x27cf3c8, nNumberOfBytesToRead=0x100c3, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27cf3c8*, lpNumberOfBytesRead=0x540efcc*=0x100c3, lpOverlapped=0x0) returned 1
	[0176.946] CloseHandle (hObject=0x318) returned 1
	[0176.946] CryptDestroyKey (hKey=0x82b440) returned 1
	[0176.946] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.946] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27df528, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0176.946] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.946] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.946] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0176.946] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.946] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27df5e0*=0x1, dwFlags=0x0) returned 1
	[0176.946] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27df5ac, dwFlags=0x0) returned 1
	[0176.946] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27df5f0*, pdwDataLen=0x540efd4*=0x100d0, dwBufLen=0x100d0 | out: pbData=0x27df5f0*, pdwDataLen=0x540efd4*=0x100d0) returned 1
	[0176.946] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ef6cc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27ef6cc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.946] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0176.946] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.946] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.946] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", lpFilePart=0x0) returned 0x4c
	[0176.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.947] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.948] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", lpFilePart=0x0) returned 0x4c
	[0176.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.948] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), fInfoLevelId=0x0, lpFileInformation=0x27efd18 | out: lpFileInformation=0x27efd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c6)) returned 1
	[0176.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.949] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", lpFilePart=0x0) returned 0x4c
	[0176.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.949] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.949] GetFileType (hFile=0x318) returned 0x1
	[0176.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.949] GetFileType (hFile=0x318) returned 0x1
	[0176.949] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x100c6
	[0176.949] ReadFile (in: hFile=0x318, lpBuffer=0x27effd0, nNumberOfBytesToRead=0x100c6, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27effd0*, lpNumberOfBytesRead=0x540efcc*=0x100c6, lpOverlapped=0x0) returned 1
	[0176.950] CloseHandle (hObject=0x318) returned 1
	[0176.950] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0176.950] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.950] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2800134, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0176.950] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.950] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.950] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0176.950] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.950] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x28001ec*=0x1, dwFlags=0x0) returned 1
	[0176.950] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x28001b8, dwFlags=0x0) returned 1
	[0176.980] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2614d44*, pdwDataLen=0x540efd4*=0x100d0, dwBufLen=0x100d0 | out: pbData=0x2614d44*, pdwDataLen=0x540efd4*=0x100d0) returned 1
	[0176.980] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2624e20*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2624e20*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.980] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0176.980] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.980] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.980] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", lpFilePart=0x0) returned 0x4c
	[0176.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.980] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.982] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", lpFilePart=0x0) returned 0x4f
	[0176.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.982] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), fInfoLevelId=0x0, lpFileInformation=0x262546c | out: lpFileInformation=0x262546c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506)) returned 1
	[0176.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.983] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", lpFilePart=0x0) returned 0x4f
	[0176.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.983] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.983] GetFileType (hFile=0x318) returned 0x1
	[0176.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.983] GetFileType (hFile=0x318) returned 0x1
	[0176.983] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x506
	[0176.983] ReadFile (in: hFile=0x318, lpBuffer=0x2625c48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2625c48*, lpNumberOfBytesRead=0x540efcc*=0x506, lpOverlapped=0x0) returned 1
	[0176.984] CloseHandle (hObject=0x318) returned 1
	[0176.984] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0176.984] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.985] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2626ce4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0176.985] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.985] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.985] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0176.985] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.985] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2626d9c*=0x1, dwFlags=0x0) returned 1
	[0176.985] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2626d68, dwFlags=0x0) returned 1
	[0176.985] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2626dac*, pdwDataLen=0x540efd4*=0x510, dwBufLen=0x510 | out: pbData=0x2626dac*, pdwDataLen=0x540efd4*=0x510) returned 1
	[0176.985] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26272c8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26272c8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.985] CryptDestroyKey (hKey=0x82b400) returned 1
	[0176.985] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.985] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.985] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", lpFilePart=0x0) returned 0x4f
	[0176.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.985] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.987] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", lpFilePart=0x0) returned 0x4f
	[0176.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.987] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), fInfoLevelId=0x0, lpFileInformation=0x262792c | out: lpFileInformation=0x262792c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506)) returned 1
	[0176.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.988] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", lpFilePart=0x0) returned 0x4f
	[0176.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.988] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.988] GetFileType (hFile=0x318) returned 0x1
	[0176.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.988] GetFileType (hFile=0x318) returned 0x1
	[0176.988] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x506
	[0176.988] ReadFile (in: hFile=0x318, lpBuffer=0x2628108, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2628108*, lpNumberOfBytesRead=0x540efcc*=0x506, lpOverlapped=0x0) returned 1
	[0176.989] CloseHandle (hObject=0x318) returned 1
	[0176.989] CryptDestroyKey (hKey=0x82b200) returned 1
	[0176.989] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.989] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26291a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0176.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.989] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0176.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.989] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x262925c*=0x1, dwFlags=0x0) returned 1
	[0176.989] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2629228, dwFlags=0x0) returned 1
	[0176.990] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262926c*, pdwDataLen=0x540efd4*=0x510, dwBufLen=0x510 | out: pbData=0x262926c*, pdwDataLen=0x540efd4*=0x510) returned 1
	[0176.990] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2629788*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2629788*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.990] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0176.990] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.990] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.990] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", lpFilePart=0x0) returned 0x4f
	[0176.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.990] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.992] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", lpFilePart=0x0) returned 0x4f
	[0176.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.992] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), fInfoLevelId=0x0, lpFileInformation=0x2629dec | out: lpFileInformation=0x2629dec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509)) returned 1
	[0176.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.992] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", lpFilePart=0x0) returned 0x4f
	[0176.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.992] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.992] GetFileType (hFile=0x318) returned 0x1
	[0176.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.992] GetFileType (hFile=0x318) returned 0x1
	[0176.993] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x509
	[0176.993] ReadFile (in: hFile=0x318, lpBuffer=0x262a5cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x262a5cc*, lpNumberOfBytesRead=0x540efcc*=0x509, lpOverlapped=0x0) returned 1
	[0176.993] CloseHandle (hObject=0x318) returned 1
	[0176.994] CryptDestroyKey (hKey=0x82b380) returned 1
	[0176.994] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.994] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262b668, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b000) returned 1
	[0176.994] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.994] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.994] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0176.994] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.994] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x262b720*=0x1, dwFlags=0x0) returned 1
	[0176.994] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x262b6ec, dwFlags=0x0) returned 1
	[0176.994] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262b730*, pdwDataLen=0x540efd4*=0x510, dwBufLen=0x510 | out: pbData=0x262b730*, pdwDataLen=0x540efd4*=0x510) returned 1
	[0176.994] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262bc4c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x262bc4c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.994] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0176.994] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.994] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.994] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", lpFilePart=0x0) returned 0x4f
	[0176.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.995] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0176.996] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", lpFilePart=0x0) returned 0x4f
	[0176.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0176.996] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), fInfoLevelId=0x0, lpFileInformation=0x262c2b0 | out: lpFileInformation=0x262c2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509)) returned 1
	[0176.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0176.997] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", lpFilePart=0x0) returned 0x4f
	[0176.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0176.997] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.997] GetFileType (hFile=0x318) returned 0x1
	[0176.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0176.997] GetFileType (hFile=0x318) returned 0x1
	[0176.997] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x509
	[0176.997] ReadFile (in: hFile=0x318, lpBuffer=0x262ca90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x262ca90*, lpNumberOfBytesRead=0x540efcc*=0x509, lpOverlapped=0x0) returned 1
	[0176.998] CloseHandle (hObject=0x318) returned 1
	[0176.998] CryptDestroyKey (hKey=0x82b000) returned 1
	[0176.998] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.998] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262db2c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0176.998] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.998] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.998] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0176.998] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.998] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x262dbe4*=0x1, dwFlags=0x0) returned 1
	[0176.999] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x262dbb0, dwFlags=0x0) returned 1
	[0176.999] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262dbf4*, pdwDataLen=0x540efd4*=0x510, dwBufLen=0x510 | out: pbData=0x262dbf4*, pdwDataLen=0x540efd4*=0x510) returned 1
	[0176.999] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262e110*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x262e110*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0176.999] CryptDestroyKey (hKey=0x82b100) returned 1
	[0176.999] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.999] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.999] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", lpFilePart=0x0) returned 0x4f
	[0176.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0176.999] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0177.001] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", lpFilePart=0x0) returned 0x56
	[0177.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.001] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), fInfoLevelId=0x0, lpFileInformation=0x262e774 | out: lpFileInformation=0x262e774*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b)) returned 1
	[0177.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.001] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", lpFilePart=0x0) returned 0x56
	[0177.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.001] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.001] GetFileType (hFile=0x318) returned 0x1
	[0177.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.002] GetFileType (hFile=0x318) returned 0x1
	[0177.002] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb4b
	[0177.002] ReadFile (in: hFile=0x318, lpBuffer=0x262f5d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x262f5d4*, lpNumberOfBytesRead=0x540efcc*=0xb4b, lpOverlapped=0x0) returned 1
	[0177.003] CloseHandle (hObject=0x318) returned 1
	[0177.003] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.003] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.003] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2630670, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0177.003] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.003] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.003] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0177.003] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.003] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2630728*=0x1, dwFlags=0x0) returned 1
	[0177.003] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26306f4, dwFlags=0x0) returned 1
	[0177.003] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2630738*, pdwDataLen=0x540efd4*=0xb50, dwBufLen=0xb50 | out: pbData=0x2630738*, pdwDataLen=0x540efd4*=0xb50) returned 1
	[0177.003] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2631294*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2631294*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.003] CryptDestroyKey (hKey=0x82b480) returned 1
	[0177.003] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.003] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.003] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", lpFilePart=0x0) returned 0x56
	[0177.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.004] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0177.005] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", lpFilePart=0x0) returned 0x56
	[0177.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.006] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), fInfoLevelId=0x0, lpFileInformation=0x2631944 | out: lpFileInformation=0x2631944*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b)) returned 1
	[0177.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.006] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", lpFilePart=0x0) returned 0x56
	[0177.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.006] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.007] GetFileType (hFile=0x318) returned 0x1
	[0177.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.007] GetFileType (hFile=0x318) returned 0x1
	[0177.007] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb4b
	[0177.007] ReadFile (in: hFile=0x318, lpBuffer=0x26327a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26327a4*, lpNumberOfBytesRead=0x540efcc*=0xb4b, lpOverlapped=0x0) returned 1
	[0177.008] CloseHandle (hObject=0x318) returned 1
	[0177.008] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0177.008] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.008] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2633840, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0177.008] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.008] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.008] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0177.008] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.008] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26338f8*=0x1, dwFlags=0x0) returned 1
	[0177.008] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26338c4, dwFlags=0x0) returned 1
	[0177.008] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2633908*, pdwDataLen=0x540efd4*=0xb50, dwBufLen=0xb50 | out: pbData=0x2633908*, pdwDataLen=0x540efd4*=0xb50) returned 1
	[0177.008] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2634464*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2634464*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.008] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.008] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.008] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.009] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", lpFilePart=0x0) returned 0x56
	[0177.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.009] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0177.011] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", lpFilePart=0x0) returned 0x44
	[0177.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.011] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), fInfoLevelId=0x0, lpFileInformation=0x2634b14 | out: lpFileInformation=0x2634b14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed)) returned 1
	[0177.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.011] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", lpFilePart=0x0) returned 0x44
	[0177.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.011] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.011] GetFileType (hFile=0x318) returned 0x1
	[0177.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.012] GetFileType (hFile=0x318) returned 0x1
	[0177.012] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3ed
	[0177.012] ReadFile (in: hFile=0x318, lpBuffer=0x2635188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2635188*, lpNumberOfBytesRead=0x540efcc*=0x3ed, lpOverlapped=0x0) returned 1
	[0177.013] CloseHandle (hObject=0x318) returned 1
	[0177.013] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.013] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.013] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2636224, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0177.013] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.013] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.013] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0177.013] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.013] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26362dc*=0x1, dwFlags=0x0) returned 1
	[0177.013] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26362a8, dwFlags=0x0) returned 1
	[0177.013] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26362ec*, pdwDataLen=0x540efd4*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x26362ec*, pdwDataLen=0x540efd4*=0x3f0) returned 1
	[0177.013] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26366e8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26366e8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.013] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.013] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.013] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.013] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", lpFilePart=0x0) returned 0x44
	[0177.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.014] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0177.015] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", lpFilePart=0x0) returned 0x43
	[0177.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.015] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), fInfoLevelId=0x0, lpFileInformation=0x2636ce4 | out: lpFileInformation=0x2636ce4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x85f)) returned 1
	[0177.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.016] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", lpFilePart=0x0) returned 0x43
	[0177.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.016] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.016] GetFileType (hFile=0x318) returned 0x1
	[0177.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.016] GetFileType (hFile=0x318) returned 0x1
	[0177.016] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x85f
	[0177.016] ReadFile (in: hFile=0x318, lpBuffer=0x26377b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26377b8*, lpNumberOfBytesRead=0x540efcc*=0x85f, lpOverlapped=0x0) returned 1
	[0177.017] CloseHandle (hObject=0x318) returned 1
	[0177.017] CryptDestroyKey (hKey=0x82b540) returned 1
	[0177.017] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.017] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2638854, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0177.017] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.017] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.017] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0177.017] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.017] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x263890c*=0x1, dwFlags=0x0) returned 1
	[0177.017] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26388d8, dwFlags=0x0) returned 1
	[0177.017] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263891c*, pdwDataLen=0x540efd4*=0x860, dwBufLen=0x860 | out: pbData=0x263891c*, pdwDataLen=0x540efd4*=0x860) returned 1
	[0177.017] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2639188*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2639188*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.017] CryptDestroyKey (hKey=0x82b400) returned 1
	[0177.018] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.018] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.018] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", lpFilePart=0x0) returned 0x43
	[0177.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.018] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0177.019] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", lpFilePart=0x0) returned 0x4d
	[0177.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.019] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), fInfoLevelId=0x0, lpFileInformation=0x2639774 | out: lpFileInformation=0x2639774*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd59)) returned 1
	[0177.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.020] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", lpFilePart=0x0) returned 0x4d
	[0177.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.020] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.020] GetFileType (hFile=0x318) returned 0x1
	[0177.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.020] GetFileType (hFile=0x318) returned 0x1
	[0177.020] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xd59
	[0177.020] ReadFile (in: hFile=0x318, lpBuffer=0x263a794, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x263a794*, lpNumberOfBytesRead=0x540efcc*=0xd59, lpOverlapped=0x0) returned 1
	[0177.021] CloseHandle (hObject=0x318) returned 1
	[0177.021] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.021] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.021] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263b830, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0177.021] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.021] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.039] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0177.039] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.039] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x263b8e8*=0x1, dwFlags=0x0) returned 1
	[0177.040] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x263b8b4, dwFlags=0x0) returned 1
	[0177.040] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263b8f8*, pdwDataLen=0x540efd4*=0xd60, dwBufLen=0xd60 | out: pbData=0x263b8f8*, pdwDataLen=0x540efd4*=0xd60) returned 1
	[0177.040] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263c664*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x263c664*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.040] CryptDestroyKey (hKey=0x82b540) returned 1
	[0177.040] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.040] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.040] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", lpFilePart=0x0) returned 0x4d
	[0177.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.040] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0177.042] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", lpFilePart=0x0) returned 0x45
	[0177.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.042] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), fInfoLevelId=0x0, lpFileInformation=0x263ccb4 | out: lpFileInformation=0x263ccb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa2e)) returned 1
	[0177.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.042] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", lpFilePart=0x0) returned 0x45
	[0177.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.042] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.042] GetFileType (hFile=0x318) returned 0x1
	[0177.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.043] GetFileType (hFile=0x318) returned 0x1
	[0177.043] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xa2e
	[0177.043] ReadFile (in: hFile=0x318, lpBuffer=0x263d968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x263d968*, lpNumberOfBytesRead=0x540efcc*=0xa2e, lpOverlapped=0x0) returned 1
	[0177.043] CloseHandle (hObject=0x318) returned 1
	[0177.044] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.044] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.044] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263ea04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0177.044] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.044] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.044] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0177.044] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.044] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x263eabc*=0x1, dwFlags=0x0) returned 1
	[0177.044] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x263ea88, dwFlags=0x0) returned 1
	[0177.044] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263eacc*, pdwDataLen=0x540efd4*=0xa30, dwBufLen=0xa30 | out: pbData=0x263eacc*, pdwDataLen=0x540efd4*=0xa30) returned 1
	[0177.044] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263f508*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x263f508*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.044] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0177.044] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.044] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.044] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", lpFilePart=0x0) returned 0x45
	[0177.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.044] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0177.046] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", lpFilePart=0x0) returned 0x3c
	[0177.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.046] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), fInfoLevelId=0x0, lpFileInformation=0x263fb08 | out: lpFileInformation=0x263fb08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c)) returned 1
	[0177.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.046] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", lpFilePart=0x0) returned 0x3c
	[0177.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.046] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.047] GetFileType (hFile=0x318) returned 0x1
	[0177.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.047] GetFileType (hFile=0x318) returned 0x1
	[0177.047] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x37c
	[0177.047] ReadFile (in: hFile=0x318, lpBuffer=0x26400c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26400c8*, lpNumberOfBytesRead=0x540efcc*=0x37c, lpOverlapped=0x0) returned 1
	[0177.047] CloseHandle (hObject=0x318) returned 1
	[0177.048] CryptDestroyKey (hKey=0x82b040) returned 1
	[0177.048] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.048] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2641164, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0177.048] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.048] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.048] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0177.048] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.048] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x264121c*=0x1, dwFlags=0x0) returned 1
	[0177.048] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26411e8, dwFlags=0x0) returned 1
	[0177.048] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264122c*, pdwDataLen=0x540efd4*=0x380, dwBufLen=0x380 | out: pbData=0x264122c*, pdwDataLen=0x540efd4*=0x380) returned 1
	[0177.048] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26415b8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26415b8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.048] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0177.048] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.048] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.048] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", lpFilePart=0x0) returned 0x3c
	[0177.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.048] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0177.050] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1", lpFilePart=0x0) returned 0x43
	[0177.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\users\\all users\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1"), fInfoLevelId=0x0, lpFileInformation=0x2641b64 | out: lpFileInformation=0x2641b64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147)) returned 1
	[0177.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.050] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1", lpFilePart=0x0) returned 0x43
	[0177.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.050] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\users\\all users\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.051] GetFileType (hFile=0x318) returned 0x1
	[0177.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.051] GetFileType (hFile=0x318) returned 0x1
	[0177.051] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x147
	[0177.051] ReadFile (in: hFile=0x318, lpBuffer=0x2641f40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2641f40*, lpNumberOfBytesRead=0x540efcc*=0x147, lpOverlapped=0x0) returned 1
	[0177.052] CloseHandle (hObject=0x318) returned 1
	[0177.052] CryptDestroyKey (hKey=0x82b540) returned 1
	[0177.052] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.052] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2642fdc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0177.052] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.052] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.052] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0177.052] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.052] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2643094*=0x1, dwFlags=0x0) returned 1
	[0177.052] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2643060, dwFlags=0x0) returned 1
	[0177.052] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26430a4*, pdwDataLen=0x540efd4*=0x150, dwBufLen=0x150 | out: pbData=0x26430a4*, pdwDataLen=0x540efd4*=0x150) returned 1
	[0177.052] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2643200*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2643200*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.052] CryptDestroyKey (hKey=0x82b100) returned 1
	[0177.052] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.052] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.052] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1", lpFilePart=0x0) returned 0x43
	[0177.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.052] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\users\\all users\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0177.054] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", lpFilePart=0x0) returned 0x47
	[0177.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.054] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), fInfoLevelId=0x0, lpFileInformation=0x26437fc | out: lpFileInformation=0x26437fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x25ec)) returned 1
	[0177.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.054] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", lpFilePart=0x0) returned 0x47
	[0177.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.054] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.055] GetFileType (hFile=0x318) returned 0x1
	[0177.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.055] GetFileType (hFile=0x318) returned 0x1
	[0177.055] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x25ec
	[0177.055] ReadFile (in: hFile=0x318, lpBuffer=0x2643a9c, nNumberOfBytesToRead=0x25ec, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2643a9c*, lpNumberOfBytesRead=0x540efcc*=0x25ec, lpOverlapped=0x0) returned 1
	[0177.055] CloseHandle (hObject=0x318) returned 1
	[0177.056] CryptDestroyKey (hKey=0x82b340) returned 1
	[0177.056] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.056] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2646124, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0177.056] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.056] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.056] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0177.056] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.056] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26461dc*=0x1, dwFlags=0x0) returned 1
	[0177.056] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26461a8, dwFlags=0x0) returned 1
	[0177.056] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26461ec*, pdwDataLen=0x540efd4*=0x25f0, dwBufLen=0x25f0 | out: pbData=0x26461ec*, pdwDataLen=0x540efd4*=0x25f0) returned 1
	[0177.056] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26487e8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26487e8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.056] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.056] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.056] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.056] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", lpFilePart=0x0) returned 0x47
	[0177.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.056] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0177.058] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", lpFilePart=0x0) returned 0x4b
	[0177.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.058] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), fInfoLevelId=0x0, lpFileInformation=0x2648e08 | out: lpFileInformation=0x2648e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c20)) returned 1
	[0177.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.058] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", lpFilePart=0x0) returned 0x4b
	[0177.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.058] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.058] GetFileType (hFile=0x318) returned 0x1
	[0177.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.059] GetFileType (hFile=0x318) returned 0x1
	[0177.059] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c20
	[0177.059] ReadFile (in: hFile=0x318, lpBuffer=0x26490c8, nNumberOfBytesToRead=0x2c20, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26490c8*, lpNumberOfBytesRead=0x540efcc*=0x2c20, lpOverlapped=0x0) returned 1
	[0177.060] CloseHandle (hObject=0x318) returned 1
	[0177.060] CryptDestroyKey (hKey=0x82b280) returned 1
	[0177.060] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.060] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264bd84, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0177.060] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.060] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.060] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0177.060] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.060] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x264be3c*=0x1, dwFlags=0x0) returned 1
	[0177.060] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x264be08, dwFlags=0x0) returned 1
	[0177.060] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264be4c*, pdwDataLen=0x540efd4*=0x2c30, dwBufLen=0x2c30 | out: pbData=0x264be4c*, pdwDataLen=0x540efd4*=0x2c30) returned 1
	[0177.060] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264ea88*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x264ea88*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.060] CryptDestroyKey (hKey=0x82b300) returned 1
	[0177.060] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.060] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.060] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", lpFilePart=0x0) returned 0x4b
	[0177.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.060] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0177.062] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", lpFilePart=0x0) returned 0x4c
	[0177.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.062] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), fInfoLevelId=0x0, lpFileInformation=0x264f0d0 | out: lpFileInformation=0x264f0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724)) returned 1
	[0177.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.062] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", lpFilePart=0x0) returned 0x4c
	[0177.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.063] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.063] GetFileType (hFile=0x318) returned 0x1
	[0177.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.063] GetFileType (hFile=0x318) returned 0x1
	[0177.063] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3724
	[0177.063] ReadFile (in: hFile=0x318, lpBuffer=0x264f398, nNumberOfBytesToRead=0x3724, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x264f398*, lpNumberOfBytesRead=0x540efcc*=0x3724, lpOverlapped=0x0) returned 1
	[0177.064] CloseHandle (hObject=0x318) returned 1
	[0177.064] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0177.064] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.064] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2652b58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b0c0) returned 1
	[0177.064] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.064] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.064] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0177.064] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.064] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x2652c10*=0x1, dwFlags=0x0) returned 1
	[0177.064] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x2652bdc, dwFlags=0x0) returned 1
	[0177.064] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2652c20*, pdwDataLen=0x540efd4*=0x3730, dwBufLen=0x3730 | out: pbData=0x2652c20*, pdwDataLen=0x540efd4*=0x3730) returned 1
	[0177.064] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265635c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x265635c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.064] CryptDestroyKey (hKey=0x82b340) returned 1
	[0177.064] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.064] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.064] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", lpFilePart=0x0) returned 0x4c
	[0177.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.064] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0177.066] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", lpFilePart=0x0) returned 0x71
	[0177.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.066] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), fInfoLevelId=0x0, lpFileInformation=0x26569b0 | out: lpFileInformation=0x26569b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.067] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", lpFilePart=0x0) returned 0x71
	[0177.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.067] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), fInfoLevelId=0x0, lpFileInformation=0x2656e2c | out: lpFileInformation=0x2656e2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.069] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", lpFilePart=0x0) returned 0x71
	[0177.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.069] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), fInfoLevelId=0x0, lpFileInformation=0x26572a8 | out: lpFileInformation=0x26572a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.070] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", lpFilePart=0x0) returned 0x53
	[0177.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.070] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), fInfoLevelId=0x0, lpFileInformation=0x2657724 | out: lpFileInformation=0x2657724*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.072] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", lpFilePart=0x0) returned 0x4b
	[0177.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.072] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), fInfoLevelId=0x0, lpFileInformation=0x2657aec | out: lpFileInformation=0x2657aec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.073] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFilePart=0x0) returned 0x3d
	[0177.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.073] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), fInfoLevelId=0x0, lpFileInformation=0x2657eb4 | out: lpFileInformation=0x2657eb4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.074] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe", lpFilePart=0x0) returned 0x30
	[0177.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.074] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe"), fInfoLevelId=0x0, lpFileInformation=0x2658228 | out: lpFileInformation=0x2658228*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.076] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe", lpFilePart=0x0) returned 0x31
	[0177.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.076] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe"), fInfoLevelId=0x0, lpFileInformation=0x2658560 | out: lpFileInformation=0x2658560*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.077] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe", lpFilePart=0x0) returned 0x32
	[0177.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.077] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe"), fInfoLevelId=0x0, lpFileInformation=0x265889c | out: lpFileInformation=0x265889c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.078] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe", lpFilePart=0x0) returned 0x3e
	[0177.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.078] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\java.exe"), fInfoLevelId=0x0, lpFileInformation=0x2658be0 | out: lpFileInformation=0x2658be0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.080] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe", lpFilePart=0x0) returned 0x3f
	[0177.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.080] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaw.exe"), fInfoLevelId=0x0, lpFileInformation=0x2658f50 | out: lpFileInformation=0x2658f50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.081] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe", lpFilePart=0x0) returned 0x40
	[0177.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.081] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaws.exe"), fInfoLevelId=0x0, lpFileInformation=0x26592c4 | out: lpFileInformation=0x26592c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp", lpFilePart=0x0) returned 0x4c
	[0177.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.082] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\cdpglobalsettings.cdp"), fInfoLevelId=0x0, lpFileInformation=0x2659640 | out: lpFileInformation=0x2659640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x435d76fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5f7)) returned 1
	[0177.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp", lpFilePart=0x0) returned 0x4c
	[0177.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.083] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\cdpglobalsettings.cdp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.083] GetFileType (hFile=0x318) returned 0x1
	[0177.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.083] GetFileType (hFile=0x318) returned 0x1
	[0177.083] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x5f7
	[0177.083] ReadFile (in: hFile=0x318, lpBuffer=0x2659edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2659edc*, lpNumberOfBytesRead=0x540efcc*=0x5f7, lpOverlapped=0x0) returned 1
	[0177.094] CloseHandle (hObject=0x318) returned 1
	[0177.094] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0177.094] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.094] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265af78, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0177.094] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.095] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.095] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0177.095] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.095] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x265b030*=0x1, dwFlags=0x0) returned 1
	[0177.095] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x265affc, dwFlags=0x0) returned 1
	[0177.095] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265b040*, pdwDataLen=0x540efd4*=0x600, dwBufLen=0x600 | out: pbData=0x265b040*, pdwDataLen=0x540efd4*=0x600) returned 1
	[0177.095] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265b64c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x265b64c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.095] CryptDestroyKey (hKey=0x82b100) returned 1
	[0177.095] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.095] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp", lpFilePart=0x0) returned 0x4c
	[0177.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.095] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\cdpglobalsettings.cdp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.097] GetFileType (hFile=0x318) returned 0x1
	[0177.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.097] GetFileType (hFile=0x318) returned 0x1
	[0177.097] WriteFile (in: hFile=0x318, lpBuffer=0x265b7a4*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x265b7a4*, lpNumberOfBytesWritten=0x540ef94*=0x600, lpOverlapped=0x0) returned 1
	[0177.098] CloseHandle (hObject=0x318) returned 1
	[0177.098] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp", lpFilePart=0x0) returned 0x4c
	[0177.098] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7b
	[0177.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.099] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\cdpglobalsettings.cdp"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xa3e26b72, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x600)) returned 1
	[0177.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.099] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\cdpglobalsettings.cdp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\cdpglobalsettings.cdp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif", lpFilePart=0x0) returned 0x37
	[0177.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.100] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1dqlt7mimb7xp0l8.gif"), fInfoLevelId=0x0, lpFileInformation=0x265cb2c | out: lpFileInformation=0x265cb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c879a60, ftCreationTime.dwHighDateTime=0x1d4cf49, ftLastAccessTime.dwLowDateTime=0x68915c10, ftLastAccessTime.dwHighDateTime=0x1d4cb61, ftLastWriteTime.dwLowDateTime=0x68915c10, ftLastWriteTime.dwHighDateTime=0x1d4cb61, nFileSizeHigh=0x0, nFileSizeLow=0x117c)) returned 1
	[0177.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.101] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif", lpFilePart=0x0) returned 0x37
	[0177.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.101] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1dqlt7mimb7xp0l8.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.101] GetFileType (hFile=0x318) returned 0x1
	[0177.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.101] GetFileType (hFile=0x318) returned 0x1
	[0177.101] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x117c
	[0177.101] ReadFile (in: hFile=0x318, lpBuffer=0x265cd6c, nNumberOfBytesToRead=0x117c, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x265cd6c*, lpNumberOfBytesRead=0x540efcc*=0x117c, lpOverlapped=0x0) returned 1
	[0177.102] CloseHandle (hObject=0x318) returned 1
	[0177.102] CryptDestroyKey (hKey=0x82b340) returned 1
	[0177.102] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.102] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265df84, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0177.102] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.102] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.103] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0177.103] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.103] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x265e03c*=0x1, dwFlags=0x0) returned 1
	[0177.103] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x265e008, dwFlags=0x0) returned 1
	[0177.103] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265e04c*, pdwDataLen=0x540efd4*=0x1180, dwBufLen=0x1180 | out: pbData=0x265e04c*, pdwDataLen=0x540efd4*=0x1180) returned 1
	[0177.103] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265f1d8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x265f1d8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.103] CryptDestroyKey (hKey=0x82b480) returned 1
	[0177.103] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.103] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.103] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif", lpFilePart=0x0) returned 0x37
	[0177.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.103] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1dqlt7mimb7xp0l8.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.105] GetFileType (hFile=0x318) returned 0x1
	[0177.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.105] GetFileType (hFile=0x318) returned 0x1
	[0177.105] WriteFile (in: hFile=0x318, lpBuffer=0x265e04c*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x265e04c*, lpNumberOfBytesWritten=0x540efc0*=0x1180, lpOverlapped=0x0) returned 1
	[0177.106] CloseHandle (hObject=0x318) returned 1
	[0177.106] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif", lpFilePart=0x0) returned 0x37
	[0177.106] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0177.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.106] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1dqlt7mimb7xp0l8.gif"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c879a60, ftCreationTime.dwHighDateTime=0x1d4cf49, ftLastAccessTime.dwLowDateTime=0x68915c10, ftLastAccessTime.dwHighDateTime=0x1d4cb61, ftLastWriteTime.dwLowDateTime=0xa3e4cdb0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1180)) returned 1
	[0177.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.106] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1dqlt7mimb7xp0l8.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1DQLT7MimB7Xp0L8.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1dqlt7mimb7xp0l8.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.107] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a", lpFilePart=0x0) returned 0x37
	[0177.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.107] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1tithiq0ej41hgqx.m4a"), fInfoLevelId=0x0, lpFileInformation=0x265f5dc | out: lpFileInformation=0x265f5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f65bc0, ftCreationTime.dwHighDateTime=0x1d4d36a, ftLastAccessTime.dwLowDateTime=0x9abec1a0, ftLastAccessTime.dwHighDateTime=0x1d4cdbe, ftLastWriteTime.dwLowDateTime=0x9abec1a0, ftLastWriteTime.dwHighDateTime=0x1d4cdbe, nFileSizeHigh=0x0, nFileSizeLow=0x8d70)) returned 1
	[0177.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.108] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a", lpFilePart=0x0) returned 0x37
	[0177.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.108] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1tithiq0ej41hgqx.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.108] GetFileType (hFile=0x318) returned 0x1
	[0177.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.108] GetFileType (hFile=0x318) returned 0x1
	[0177.108] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x8d70
	[0177.108] ReadFile (in: hFile=0x318, lpBuffer=0x265f81c, nNumberOfBytesToRead=0x8d70, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x265f81c*, lpNumberOfBytesRead=0x540efcc*=0x8d70, lpOverlapped=0x0) returned 1
	[0177.109] CloseHandle (hObject=0x318) returned 1
	[0177.109] CryptDestroyKey (hKey=0x82b080) returned 1
	[0177.109] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.109] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2668628, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0177.109] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.109] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.109] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0177.109] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.109] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26686e0*=0x1, dwFlags=0x0) returned 1
	[0177.109] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x26686ac, dwFlags=0x0) returned 1
	[0177.109] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26686f0*, pdwDataLen=0x540efd4*=0x8d80, dwBufLen=0x8d80 | out: pbData=0x26686f0*, pdwDataLen=0x540efd4*=0x8d80) returned 1
	[0177.109] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267147c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x267147c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.109] CryptDestroyKey (hKey=0x82b380) returned 1
	[0177.109] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.109] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.109] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a", lpFilePart=0x0) returned 0x37
	[0177.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.109] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1tithiq0ej41hgqx.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.111] GetFileType (hFile=0x318) returned 0x1
	[0177.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.111] GetFileType (hFile=0x318) returned 0x1
	[0177.111] WriteFile (in: hFile=0x318, lpBuffer=0x26686f0*, nNumberOfBytesToWrite=0x8d80, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26686f0*, lpNumberOfBytesWritten=0x540efc0*=0x8d80, lpOverlapped=0x0) returned 1
	[0177.113] CloseHandle (hObject=0x318) returned 1
	[0177.113] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a", lpFilePart=0x0) returned 0x37
	[0177.113] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0177.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.113] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1tithiq0ej41hgqx.m4a"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f65bc0, ftCreationTime.dwHighDateTime=0x1d4d36a, ftLastAccessTime.dwLowDateTime=0x9abec1a0, ftLastAccessTime.dwHighDateTime=0x1d4cdbe, ftLastWriteTime.dwLowDateTime=0xa3e4cdb0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8d80)) returned 1
	[0177.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.114] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1tithiq0ej41hgqx.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1tITHiQ0EJ41hGQX.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1tithiq0ej41hgqx.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.115] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4", lpFilePart=0x0) returned 0x38
	[0177.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.115] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1wcb30v-fei8bvdqj.mp4"), fInfoLevelId=0x0, lpFileInformation=0x2671880 | out: lpFileInformation=0x2671880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9825160, ftCreationTime.dwHighDateTime=0x1d4cea5, ftLastAccessTime.dwLowDateTime=0xe7f32790, ftLastAccessTime.dwHighDateTime=0x1d4c607, ftLastWriteTime.dwLowDateTime=0xe7f32790, ftLastWriteTime.dwHighDateTime=0x1d4c607, nFileSizeHigh=0x0, nFileSizeLow=0x11ed0)) returned 1
	[0177.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.115] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4", lpFilePart=0x0) returned 0x38
	[0177.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.115] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1wcb30v-fei8bvdqj.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.115] GetFileType (hFile=0x318) returned 0x1
	[0177.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.116] GetFileType (hFile=0x318) returned 0x1
	[0177.116] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x11ed0
	[0177.116] ReadFile (in: hFile=0x318, lpBuffer=0x2671ac8, nNumberOfBytesToRead=0x11ed0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2671ac8*, lpNumberOfBytesRead=0x540efcc*=0x11ed0, lpOverlapped=0x0) returned 1
	[0177.117] CloseHandle (hObject=0x318) returned 1
	[0177.117] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.117] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.117] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2683a34, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0177.117] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.117] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.118] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0177.118] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.118] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2683aec*=0x1, dwFlags=0x0) returned 1
	[0177.118] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2683ab8, dwFlags=0x0) returned 1
	[0177.118] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2683afc*, pdwDataLen=0x540efd4*=0x11ee0, dwBufLen=0x11ee0 | out: pbData=0x2683afc*, pdwDataLen=0x540efd4*=0x11ee0) returned 1
	[0177.118] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26959e8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26959e8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.118] CryptDestroyKey (hKey=0x82b380) returned 1
	[0177.118] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.118] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.118] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4", lpFilePart=0x0) returned 0x38
	[0177.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.118] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1wcb30v-fei8bvdqj.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.119] GetFileType (hFile=0x318) returned 0x1
	[0177.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.120] GetFileType (hFile=0x318) returned 0x1
	[0177.120] WriteFile (in: hFile=0x318, lpBuffer=0x2683afc*, nNumberOfBytesToWrite=0x11ee0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2683afc*, lpNumberOfBytesWritten=0x540efc0*=0x11ee0, lpOverlapped=0x0) returned 1
	[0177.121] CloseHandle (hObject=0x318) returned 1
	[0177.121] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4", lpFilePart=0x0) returned 0x38
	[0177.121] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0177.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.121] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1wcb30v-fei8bvdqj.mp4"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9825160, ftCreationTime.dwHighDateTime=0x1d4cea5, ftLastAccessTime.dwLowDateTime=0xe7f32790, ftLastAccessTime.dwHighDateTime=0x1d4c607, ftLastWriteTime.dwLowDateTime=0xa3e73186, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11ee0)) returned 1
	[0177.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.122] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1wcb30v-fei8bvdqj.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1WCb30v-fEI8BvdQj.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1wcb30v-fei8bvdqj.mp4 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.122] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4", lpFilePart=0x0) returned 0x36
	[0177.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.122] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\9luypgfko_w5qh2.mp4"), fInfoLevelId=0x0, lpFileInformation=0x2695df4 | out: lpFileInformation=0x2695df4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa72f90, ftCreationTime.dwHighDateTime=0x1d4c790, ftLastAccessTime.dwLowDateTime=0xf78e99f0, ftLastAccessTime.dwHighDateTime=0x1d4d2d2, ftLastWriteTime.dwLowDateTime=0xf78e99f0, ftLastWriteTime.dwHighDateTime=0x1d4d2d2, nFileSizeHigh=0x0, nFileSizeLow=0x2349)) returned 1
	[0177.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.123] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4", lpFilePart=0x0) returned 0x36
	[0177.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.123] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\9luypgfko_w5qh2.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.123] GetFileType (hFile=0x318) returned 0x1
	[0177.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.123] GetFileType (hFile=0x318) returned 0x1
	[0177.123] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2349
	[0177.123] ReadFile (in: hFile=0x318, lpBuffer=0x269602c, nNumberOfBytesToRead=0x2349, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x269602c*, lpNumberOfBytesRead=0x540efcc*=0x2349, lpOverlapped=0x0) returned 1
	[0177.124] CloseHandle (hObject=0x318) returned 1
	[0177.124] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.124] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.124] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2698414, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0177.124] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.124] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.124] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0177.124] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.124] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26984cc*=0x1, dwFlags=0x0) returned 1
	[0177.125] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2698498, dwFlags=0x0) returned 1
	[0177.125] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26984dc*, pdwDataLen=0x540efd4*=0x2350, dwBufLen=0x2350 | out: pbData=0x26984dc*, pdwDataLen=0x540efd4*=0x2350) returned 1
	[0177.125] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269a838*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x269a838*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.125] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.125] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.125] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.125] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4", lpFilePart=0x0) returned 0x36
	[0177.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\9luypgfko_w5qh2.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.126] GetFileType (hFile=0x318) returned 0x1
	[0177.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.126] GetFileType (hFile=0x318) returned 0x1
	[0177.126] WriteFile (in: hFile=0x318, lpBuffer=0x26984dc*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26984dc*, lpNumberOfBytesWritten=0x540efc0*=0x2350, lpOverlapped=0x0) returned 1
	[0177.127] CloseHandle (hObject=0x318) returned 1
	[0177.128] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4", lpFilePart=0x0) returned 0x36
	[0177.128] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0177.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.128] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\9luypgfko_w5qh2.mp4"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa72f90, ftCreationTime.dwHighDateTime=0x1d4c790, ftLastAccessTime.dwLowDateTime=0xf78e99f0, ftLastAccessTime.dwHighDateTime=0x1d4d2d2, ftLastWriteTime.dwLowDateTime=0xa3e73186, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2350)) returned 1
	[0177.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.128] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\9luypgfko_w5qh2.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\9LUypgfkO_w5qh2.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\9luypgfko_w5qh2.mp4 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.129] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png", lpFilePart=0x0) returned 0x33
	[0177.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.129] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\blxl2wcb4-o4.png"), fInfoLevelId=0x0, lpFileInformation=0x269ac2c | out: lpFileInformation=0x269ac2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd93c07f0, ftCreationTime.dwHighDateTime=0x1d4d078, ftLastAccessTime.dwLowDateTime=0xf23e16d0, ftLastAccessTime.dwHighDateTime=0x1d4c583, ftLastWriteTime.dwLowDateTime=0xf23e16d0, ftLastWriteTime.dwHighDateTime=0x1d4c583, nFileSizeHigh=0x0, nFileSizeLow=0x781a)) returned 1
	[0177.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.129] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png", lpFilePart=0x0) returned 0x33
	[0177.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.129] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\blxl2wcb4-o4.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.129] GetFileType (hFile=0x318) returned 0x1
	[0177.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.130] GetFileType (hFile=0x318) returned 0x1
	[0177.130] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x781a
	[0177.130] ReadFile (in: hFile=0x318, lpBuffer=0x269ae4c, nNumberOfBytesToRead=0x781a, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x269ae4c*, lpNumberOfBytesRead=0x540efcc*=0x781a, lpOverlapped=0x0) returned 1
	[0177.154] CloseHandle (hObject=0x318) returned 1
	[0177.154] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0177.154] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.154] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a2704, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0177.154] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.154] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.154] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0177.154] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.154] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26a27bc*=0x1, dwFlags=0x0) returned 1
	[0177.154] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26a2788, dwFlags=0x0) returned 1
	[0177.155] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a27cc*, pdwDataLen=0x540efd4*=0x7820, dwBufLen=0x7820 | out: pbData=0x26a27cc*, pdwDataLen=0x540efd4*=0x7820) returned 1
	[0177.155] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a9ff8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a9ff8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.155] CryptDestroyKey (hKey=0x82b480) returned 1
	[0177.155] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.155] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.155] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png", lpFilePart=0x0) returned 0x33
	[0177.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.155] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\blxl2wcb4-o4.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.157] GetFileType (hFile=0x318) returned 0x1
	[0177.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.157] GetFileType (hFile=0x318) returned 0x1
	[0177.157] WriteFile (in: hFile=0x318, lpBuffer=0x26a27cc*, nNumberOfBytesToWrite=0x7820, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26a27cc*, lpNumberOfBytesWritten=0x540efc0*=0x7820, lpOverlapped=0x0) returned 1
	[0177.158] CloseHandle (hObject=0x318) returned 1
	[0177.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png", lpFilePart=0x0) returned 0x33
	[0177.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x62
	[0177.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.158] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\blxl2wcb4-o4.png"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd93c07f0, ftCreationTime.dwHighDateTime=0x1d4d078, ftLastAccessTime.dwLowDateTime=0xf23e16d0, ftLastAccessTime.dwHighDateTime=0x1d4c583, ftLastWriteTime.dwLowDateTime=0xa3ebfaeb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7820)) returned 1
	[0177.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.158] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\blxl2wcb4-o4.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BlXl2WCB4-o4.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\blxl2wcb4-o4.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png", lpFilePart=0x0) returned 0x34
	[0177.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.159] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\cjp4zxgtjofzg.png"), fInfoLevelId=0x0, lpFileInformation=0x26aa3cc | out: lpFileInformation=0x26aa3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705326e0, ftCreationTime.dwHighDateTime=0x1d4cac6, ftLastAccessTime.dwLowDateTime=0x8b027d80, ftLastAccessTime.dwHighDateTime=0x1d4c9ca, ftLastWriteTime.dwLowDateTime=0x8b027d80, ftLastWriteTime.dwHighDateTime=0x1d4c9ca, nFileSizeHigh=0x0, nFileSizeLow=0xb9cc)) returned 1
	[0177.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png", lpFilePart=0x0) returned 0x34
	[0177.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\cjp4zxgtjofzg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.160] GetFileType (hFile=0x318) returned 0x1
	[0177.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.160] GetFileType (hFile=0x318) returned 0x1
	[0177.160] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xb9cc
	[0177.160] ReadFile (in: hFile=0x318, lpBuffer=0x26aa5f4, nNumberOfBytesToRead=0xb9cc, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26aa5f4*, lpNumberOfBytesRead=0x540efcc*=0xb9cc, lpOverlapped=0x0) returned 1
	[0177.161] CloseHandle (hObject=0x318) returned 1
	[0177.161] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0177.161] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.161] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b605c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0177.161] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.161] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.161] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0177.161] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.161] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26b6114*=0x1, dwFlags=0x0) returned 1
	[0177.161] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26b60e0, dwFlags=0x0) returned 1
	[0177.161] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b6124*, pdwDataLen=0x540efd4*=0xb9d0, dwBufLen=0xb9d0 | out: pbData=0x26b6124*, pdwDataLen=0x540efd4*=0xb9d0) returned 1
	[0177.161] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c1b00*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c1b00*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.161] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0177.161] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.161] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.161] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png", lpFilePart=0x0) returned 0x34
	[0177.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\cjp4zxgtjofzg.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.163] GetFileType (hFile=0x318) returned 0x1
	[0177.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.163] GetFileType (hFile=0x318) returned 0x1
	[0177.163] WriteFile (in: hFile=0x318, lpBuffer=0x26b6124*, nNumberOfBytesToWrite=0xb9d0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26b6124*, lpNumberOfBytesWritten=0x540efc0*=0xb9d0, lpOverlapped=0x0) returned 1
	[0177.165] CloseHandle (hObject=0x318) returned 1
	[0177.165] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png", lpFilePart=0x0) returned 0x34
	[0177.165] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x63
	[0177.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.165] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\cjp4zxgtjofzg.png"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705326e0, ftCreationTime.dwHighDateTime=0x1d4cac6, ftLastAccessTime.dwLowDateTime=0x8b027d80, ftLastAccessTime.dwHighDateTime=0x1d4c9ca, ftLastWriteTime.dwLowDateTime=0xa3ee5759, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xb9d0)) returned 1
	[0177.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.165] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\cjp4zxgtjofzg.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\cjp4zXGTjOFZG.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\cjp4zxgtjofzg.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf", lpFilePart=0x0) returned 0x38
	[0177.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.169] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\f_9wtadooy1c9xryd.swf"), fInfoLevelId=0x0, lpFileInformation=0x26c1edc | out: lpFileInformation=0x26c1edc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xade76d20, ftCreationTime.dwHighDateTime=0x1d4cdca, ftLastAccessTime.dwLowDateTime=0x9ee844f0, ftLastAccessTime.dwHighDateTime=0x1d4cceb, ftLastWriteTime.dwLowDateTime=0x9ee844f0, ftLastWriteTime.dwHighDateTime=0x1d4cceb, nFileSizeHigh=0x0, nFileSizeLow=0x884c)) returned 1
	[0177.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf", lpFilePart=0x0) returned 0x38
	[0177.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.169] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\f_9wtadooy1c9xryd.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.169] GetFileType (hFile=0x318) returned 0x1
	[0177.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.170] GetFileType (hFile=0x318) returned 0x1
	[0177.170] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x884c
	[0177.170] ReadFile (in: hFile=0x318, lpBuffer=0x26c2124, nNumberOfBytesToRead=0x884c, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c2124*, lpNumberOfBytesRead=0x540efcc*=0x884c, lpOverlapped=0x0) returned 1
	[0177.170] CloseHandle (hObject=0x318) returned 1
	[0177.170] CryptDestroyKey (hKey=0x82b340) returned 1
	[0177.171] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.171] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26caa0c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0177.171] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.171] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.171] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0177.171] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.171] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26caac4*=0x1, dwFlags=0x0) returned 1
	[0177.171] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26caa90, dwFlags=0x0) returned 1
	[0177.171] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26caad4*, pdwDataLen=0x540efd4*=0x8850, dwBufLen=0x8850 | out: pbData=0x26caad4*, pdwDataLen=0x540efd4*=0x8850) returned 1
	[0177.171] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d3330*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26d3330*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.171] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.171] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.171] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.171] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf", lpFilePart=0x0) returned 0x38
	[0177.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.171] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\f_9wtadooy1c9xryd.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.172] GetFileType (hFile=0x318) returned 0x1
	[0177.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.172] GetFileType (hFile=0x318) returned 0x1
	[0177.172] WriteFile (in: hFile=0x318, lpBuffer=0x26caad4*, nNumberOfBytesToWrite=0x8850, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26caad4*, lpNumberOfBytesWritten=0x540efc0*=0x8850, lpOverlapped=0x0) returned 1
	[0177.174] CloseHandle (hObject=0x318) returned 1
	[0177.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf", lpFilePart=0x0) returned 0x38
	[0177.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0177.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.174] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\f_9wtadooy1c9xryd.swf"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xade76d20, ftCreationTime.dwHighDateTime=0x1d4cdca, ftLastAccessTime.dwLowDateTime=0x9ee844f0, ftLastAccessTime.dwHighDateTime=0x1d4cceb, ftLastWriteTime.dwLowDateTime=0xa3ee5759, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8850)) returned 1
	[0177.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.174] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\f_9wtadooy1c9xryd.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\f_9WTaDoOy1C9XRYD.swf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\f_9wtadooy1c9xryd.swf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg", lpFilePart=0x0) returned 0x3a
	[0177.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg", lpFilePart=0x0) returned 0x3a
	[0177.175] ReadFile (in: hFile=0x318, lpBuffer=0x26d3994, nNumberOfBytesToRead=0x27ab, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d3994*, lpNumberOfBytesRead=0x540efcc*=0x27ab, lpOverlapped=0x0) returned 1
	[0177.176] CryptDestroyKey (hKey=0x82b540) returned 1
	[0177.176] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.176] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d61dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0177.176] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.176] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.176] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0177.177] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.177] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26d6294*=0x1, dwFlags=0x0) returned 1
	[0177.177] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26d6260, dwFlags=0x0) returned 1
	[0177.177] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d62a4*, pdwDataLen=0x540efd4*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x26d62a4*, pdwDataLen=0x540efd4*=0x27b0) returned 1
	[0177.177] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d8a60*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26d8a60*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.177] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0177.177] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.177] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.177] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg", lpFilePart=0x0) returned 0x3a
	[0177.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.177] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\gvd3hhv84 tpg6fxcbl.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.178] GetFileType (hFile=0x318) returned 0x1
	[0177.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.178] GetFileType (hFile=0x318) returned 0x1
	[0177.178] WriteFile (in: hFile=0x318, lpBuffer=0x26d62a4*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26d62a4*, lpNumberOfBytesWritten=0x540efc0*=0x27b0, lpOverlapped=0x0) returned 1
	[0177.179] CloseHandle (hObject=0x318) returned 1
	[0177.179] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg", lpFilePart=0x0) returned 0x3a
	[0177.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0177.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\gvd3hhv84 tpg6fxcbl.jpg"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd0cc410, ftCreationTime.dwHighDateTime=0x1d4d1ee, ftLastAccessTime.dwLowDateTime=0xf0f5c460, ftLastAccessTime.dwHighDateTime=0x1d4cdff, ftLastWriteTime.dwLowDateTime=0xa3f0b9ae, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x27b0)) returned 1
	[0177.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.180] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\gvd3hhv84 tpg6fxcbl.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GVD3hHv84 TpG6FxCbl.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\gvd3hhv84 tpg6fxcbl.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4", lpFilePart=0x0) returned 0x3b
	[0177.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.181] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\irx-a2htnn83p0sm25sz.mp4"), fInfoLevelId=0x0, lpFileInformation=0x26d8e84 | out: lpFileInformation=0x26d8e84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108951a0, ftCreationTime.dwHighDateTime=0x1d4ccc7, ftLastAccessTime.dwLowDateTime=0x4e983360, ftLastAccessTime.dwHighDateTime=0x1d4d4df, ftLastWriteTime.dwLowDateTime=0x4e983360, ftLastWriteTime.dwHighDateTime=0x1d4d4df, nFileSizeHigh=0x0, nFileSizeLow=0x880f)) returned 1
	[0177.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4", lpFilePart=0x0) returned 0x3b
	[0177.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.181] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\irx-a2htnn83p0sm25sz.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.181] GetFileType (hFile=0x318) returned 0x1
	[0177.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.181] GetFileType (hFile=0x318) returned 0x1
	[0177.181] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x880f
	[0177.182] ReadFile (in: hFile=0x318, lpBuffer=0x26d90e4, nNumberOfBytesToRead=0x880f, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d90e4*, lpNumberOfBytesRead=0x540efcc*=0x880f, lpOverlapped=0x0) returned 1
	[0177.182] CloseHandle (hObject=0x318) returned 1
	[0177.183] CryptDestroyKey (hKey=0x82b100) returned 1
	[0177.183] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.183] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e1990, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0177.183] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.183] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.183] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0177.183] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.183] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26e1a48*=0x1, dwFlags=0x0) returned 1
	[0177.183] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26e1a14, dwFlags=0x0) returned 1
	[0177.183] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e1a58*, pdwDataLen=0x540efd4*=0x8810, dwBufLen=0x8810 | out: pbData=0x26e1a58*, pdwDataLen=0x540efd4*=0x8810) returned 1
	[0177.183] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ea274*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26ea274*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.183] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.183] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.183] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.183] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4", lpFilePart=0x0) returned 0x3b
	[0177.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\irx-a2htnn83p0sm25sz.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.185] GetFileType (hFile=0x318) returned 0x1
	[0177.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.185] GetFileType (hFile=0x318) returned 0x1
	[0177.185] WriteFile (in: hFile=0x318, lpBuffer=0x26e1a58*, nNumberOfBytesToWrite=0x8810, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26e1a58*, lpNumberOfBytesWritten=0x540efc0*=0x8810, lpOverlapped=0x0) returned 1
	[0177.186] CloseHandle (hObject=0x318) returned 1
	[0177.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4", lpFilePart=0x0) returned 0x3b
	[0177.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6a
	[0177.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.186] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\irx-a2htnn83p0sm25sz.mp4"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108951a0, ftCreationTime.dwHighDateTime=0x1d4ccc7, ftLastAccessTime.dwLowDateTime=0x4e983360, ftLastAccessTime.dwHighDateTime=0x1d4d4df, ftLastWriteTime.dwLowDateTime=0xa3f0b9ae, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8810)) returned 1
	[0177.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.187] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\irx-a2htnn83p0sm25sz.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\iRX-A2hTnN83P0sm25sz.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\irx-a2htnn83p0sm25sz.mp4 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf", lpFilePart=0x0) returned 0x2b
	[0177.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.187] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\jsz9.swf"), fInfoLevelId=0x0, lpFileInformation=0x26ea6a8 | out: lpFileInformation=0x26ea6a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1a37cf0, ftCreationTime.dwHighDateTime=0x1d4d3b9, ftLastAccessTime.dwLowDateTime=0xee443e20, ftLastAccessTime.dwHighDateTime=0x1d4c69a, ftLastWriteTime.dwLowDateTime=0xee443e20, ftLastWriteTime.dwHighDateTime=0x1d4c69a, nFileSizeHigh=0x0, nFileSizeLow=0x1276b)) returned 1
	[0177.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.188] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf", lpFilePart=0x0) returned 0x2b
	[0177.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.188] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\jsz9.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.188] GetFileType (hFile=0x318) returned 0x1
	[0177.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.188] GetFileType (hFile=0x318) returned 0x1
	[0177.188] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1276b
	[0177.188] ReadFile (in: hFile=0x318, lpBuffer=0x26ea888, nNumberOfBytesToRead=0x1276b, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ea888*, lpNumberOfBytesRead=0x540efcc*=0x1276b, lpOverlapped=0x0) returned 1
	[0177.189] CloseHandle (hObject=0x318) returned 1
	[0177.189] CryptDestroyKey (hKey=0x82b080) returned 1
	[0177.189] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.189] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fd090, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0177.189] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.189] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.189] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0177.189] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.189] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26fd148*=0x1, dwFlags=0x0) returned 1
	[0177.189] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26fd114, dwFlags=0x0) returned 1
	[0177.190] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fd158*, pdwDataLen=0x540efd4*=0x12770, dwBufLen=0x12770 | out: pbData=0x26fd158*, pdwDataLen=0x540efd4*=0x12770) returned 1
	[0177.190] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270f8d4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x270f8d4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.190] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0177.190] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.190] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf", lpFilePart=0x0) returned 0x2b
	[0177.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.190] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\jsz9.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.191] GetFileType (hFile=0x318) returned 0x1
	[0177.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.192] GetFileType (hFile=0x318) returned 0x1
	[0177.192] WriteFile (in: hFile=0x318, lpBuffer=0x26fd158*, nNumberOfBytesToWrite=0x12770, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26fd158*, lpNumberOfBytesWritten=0x540efc0*=0x12770, lpOverlapped=0x0) returned 1
	[0177.211] CloseHandle (hObject=0x318) returned 1
	[0177.211] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf", lpFilePart=0x0) returned 0x2b
	[0177.211] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5a
	[0177.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.211] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\jsz9.swf"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1a37cf0, ftCreationTime.dwHighDateTime=0x1d4d3b9, ftLastAccessTime.dwLowDateTime=0xee443e20, ftLastAccessTime.dwHighDateTime=0x1d4c69a, ftLastWriteTime.dwLowDateTime=0xa3f57e7a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x12770)) returned 1
	[0177.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.211] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\jsz9.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jSz9.swf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\jsz9.swf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt", lpFilePart=0x0) returned 0x33
	[0177.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.212] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ju0_u7czicb9.ppt"), fInfoLevelId=0x0, lpFileInformation=0x270fc48 | out: lpFileInformation=0x270fc48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bc54c90, ftCreationTime.dwHighDateTime=0x1d4d325, ftLastAccessTime.dwLowDateTime=0xf6b840d0, ftLastAccessTime.dwHighDateTime=0x1d4cee5, ftLastWriteTime.dwLowDateTime=0xf6b840d0, ftLastWriteTime.dwHighDateTime=0x1d4cee5, nFileSizeHigh=0x0, nFileSizeLow=0x1437a)) returned 1
	[0177.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.256] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.319] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.381] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.421] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.443] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.446] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.447] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.510] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.631] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.694] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.697] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.701] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv", lpFilePart=0x0) returned 0x4a
	[0177.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.701] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\vjv-epwxcyyy7bdaz\\7ykkdpbs2v4myoa.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.701] GetFileType (hFile=0x318) returned 0x1
	[0177.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.702] GetFileType (hFile=0x318) returned 0x1
	[0177.702] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xe505
	[0177.702] ReadFile (in: hFile=0x318, lpBuffer=0x266aa34, nNumberOfBytesToRead=0xe505, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x266aa34*, lpNumberOfBytesRead=0x540efcc*=0xe505, lpOverlapped=0x0) returned 1
	[0177.703] CloseHandle (hObject=0x318) returned 1
	[0177.703] CryptDestroyKey (hKey=0x82b480) returned 1
	[0177.703] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.703] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2678fd8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0177.703] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.703] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.703] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0177.703] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.703] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2679090*=0x1, dwFlags=0x0) returned 1
	[0177.703] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x267905c, dwFlags=0x0) returned 1
	[0177.703] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26790a0*, pdwDataLen=0x540efd4*=0xe510, dwBufLen=0xe510 | out: pbData=0x26790a0*, pdwDataLen=0x540efd4*=0xe510) returned 1
	[0177.703] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26875bc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26875bc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.703] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.703] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.703] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.704] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv", lpFilePart=0x0) returned 0x4a
	[0177.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.704] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\vjv-epwxcyyy7bdaz\\7ykkdpbs2v4myoa.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.705] GetFileType (hFile=0x318) returned 0x1
	[0177.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.705] GetFileType (hFile=0x318) returned 0x1
	[0177.705] WriteFile (in: hFile=0x318, lpBuffer=0x26790a0*, nNumberOfBytesToWrite=0xe510, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26790a0*, lpNumberOfBytesWritten=0x540efc0*=0xe510, lpOverlapped=0x0) returned 1
	[0177.707] CloseHandle (hObject=0x318) returned 1
	[0177.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv", lpFilePart=0x0) returned 0x4a
	[0177.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x79
	[0177.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\vjv-epwxcyyy7bdaz\\7ykkdpbs2v4myoa.mkv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d56580, ftCreationTime.dwHighDateTime=0x1d4cba5, ftLastAccessTime.dwLowDateTime=0xbb425e0, ftLastAccessTime.dwHighDateTime=0x1d4c7c4, ftLastWriteTime.dwLowDateTime=0xa43f6702, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xe510)) returned 1
	[0177.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.707] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\vjv-epwxcyyy7bdaz\\7ykkdpbs2v4myoa.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\vjv-epwxcyyy7bdaz\\7ykkdpbs2v4myoa.mkv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.708] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf", lpFilePart=0x0) returned 0x4d
	[0177.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.708] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\vjv-epwxcyyy7bdaz\\fmqtc20bszrzzyzppq.swf"), fInfoLevelId=0x0, lpFileInformation=0x2687a78 | out: lpFileInformation=0x2687a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5886d10, ftCreationTime.dwHighDateTime=0x1d4d03c, ftLastAccessTime.dwLowDateTime=0x772b3460, ftLastAccessTime.dwHighDateTime=0x1d4d333, ftLastWriteTime.dwLowDateTime=0x772b3460, ftLastWriteTime.dwHighDateTime=0x1d4d333, nFileSizeHigh=0x0, nFileSizeLow=0x8ed9)) returned 1
	[0177.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.709] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf", lpFilePart=0x0) returned 0x4d
	[0177.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.709] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\vjv-epwxcyyy7bdaz\\fmqtc20bszrzzyzppq.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.709] GetFileType (hFile=0x318) returned 0x1
	[0177.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.709] GetFileType (hFile=0x318) returned 0x1
	[0177.709] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x8ed9
	[0177.709] ReadFile (in: hFile=0x318, lpBuffer=0x2687d18, nNumberOfBytesToRead=0x8ed9, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2687d18*, lpNumberOfBytesRead=0x540efcc*=0x8ed9, lpOverlapped=0x0) returned 1
	[0177.710] CloseHandle (hObject=0x318) returned 1
	[0177.710] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.710] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.710] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2690c90, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0177.710] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.711] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.711] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0177.711] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.711] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2690d48*=0x1, dwFlags=0x0) returned 1
	[0177.711] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2690d14, dwFlags=0x0) returned 1
	[0177.711] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2690d58*, pdwDataLen=0x540efd4*=0x8ee0, dwBufLen=0x8ee0 | out: pbData=0x2690d58*, pdwDataLen=0x540efd4*=0x8ee0) returned 1
	[0177.711] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2699c44*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2699c44*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.711] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0177.711] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.711] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.711] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf", lpFilePart=0x0) returned 0x4d
	[0177.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.711] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\vjv-epwxcyyy7bdaz\\fmqtc20bszrzzyzppq.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.712] GetFileType (hFile=0x318) returned 0x1
	[0177.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.713] GetFileType (hFile=0x318) returned 0x1
	[0177.713] WriteFile (in: hFile=0x318, lpBuffer=0x2690d58*, nNumberOfBytesToWrite=0x8ee0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2690d58*, lpNumberOfBytesWritten=0x540efc0*=0x8ee0, lpOverlapped=0x0) returned 1
	[0177.714] CloseHandle (hObject=0x318) returned 1
	[0177.714] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf", lpFilePart=0x0) returned 0x4d
	[0177.714] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7c
	[0177.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\vjv-epwxcyyy7bdaz\\fmqtc20bszrzzyzppq.swf"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5886d10, ftCreationTime.dwHighDateTime=0x1d4d03c, ftLastAccessTime.dwLowDateTime=0x772b3460, ftLastAccessTime.dwHighDateTime=0x1d4d333, ftLastWriteTime.dwLowDateTime=0xa441ca06, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8ee0)) returned 1
	[0177.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.714] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\vjv-epwxcyyy7bdaz\\fmqtc20bszrzzyzppq.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\fMQTC20bSZrZzYzpPq.swf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\vjv-epwxcyyy7bdaz\\fmqtc20bszrzzyzppq.swf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf", lpFilePart=0x0) returned 0x49
	[0177.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.715] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\ih3gzzw35x1.swf"), fInfoLevelId=0x0, lpFileInformation=0x269a128 | out: lpFileInformation=0x269a128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bad39f0, ftCreationTime.dwHighDateTime=0x1d4d160, ftLastAccessTime.dwLowDateTime=0x2e411c20, ftLastAccessTime.dwHighDateTime=0x1d4c77f, ftLastWriteTime.dwLowDateTime=0x2e411c20, ftLastWriteTime.dwHighDateTime=0x1d4c77f, nFileSizeHigh=0x0, nFileSizeLow=0x13055)) returned 1
	[0177.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf", lpFilePart=0x0) returned 0x49
	[0177.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.716] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\ih3gzzw35x1.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.716] GetFileType (hFile=0x318) returned 0x1
	[0177.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.716] GetFileType (hFile=0x318) returned 0x1
	[0177.716] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x13055
	[0177.716] ReadFile (in: hFile=0x318, lpBuffer=0x269a398, nNumberOfBytesToRead=0x13055, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x269a398*, lpNumberOfBytesRead=0x540efcc*=0x13055, lpOverlapped=0x0) returned 1
	[0177.717] CloseHandle (hObject=0x318) returned 1
	[0177.717] CryptDestroyKey (hKey=0x82b040) returned 1
	[0177.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.717] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ad48c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0177.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.717] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0177.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.717] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26ad544*=0x1, dwFlags=0x0) returned 1
	[0177.717] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26ad510, dwFlags=0x0) returned 1
	[0177.718] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ad554*, pdwDataLen=0x540efd4*=0x13060, dwBufLen=0x13060 | out: pbData=0x26ad554*, pdwDataLen=0x540efd4*=0x13060) returned 1
	[0177.718] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c05c0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c05c0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.718] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.718] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.718] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.718] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf", lpFilePart=0x0) returned 0x49
	[0177.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.718] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\ih3gzzw35x1.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.719] GetFileType (hFile=0x318) returned 0x1
	[0177.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.719] GetFileType (hFile=0x318) returned 0x1
	[0177.719] WriteFile (in: hFile=0x318, lpBuffer=0x26ad554*, nNumberOfBytesToWrite=0x13060, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26ad554*, lpNumberOfBytesWritten=0x540efc0*=0x13060, lpOverlapped=0x0) returned 1
	[0177.721] CloseHandle (hObject=0x318) returned 1
	[0177.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf", lpFilePart=0x0) returned 0x49
	[0177.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x78
	[0177.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\ih3gzzw35x1.swf"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bad39f0, ftCreationTime.dwHighDateTime=0x1d4d160, ftLastAccessTime.dwLowDateTime=0x2e411c20, ftLastAccessTime.dwHighDateTime=0x1d4c77f, ftLastWriteTime.dwLowDateTime=0xa441ca06, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13060)) returned 1
	[0177.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.722] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\ih3gzzw35x1.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\Ih3gZZw35x1.swf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\ih3gzzw35x1.swf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.722] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv", lpFilePart=0x0) returned 0x42
	[0177.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\plqq.mkv"), fInfoLevelId=0x0, lpFileInformation=0x26c0a6c | out: lpFileInformation=0x26c0a6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f0236b0, ftCreationTime.dwHighDateTime=0x1d4d51c, ftLastAccessTime.dwLowDateTime=0xf3a710c0, ftLastAccessTime.dwHighDateTime=0x1d4d178, ftLastWriteTime.dwLowDateTime=0xf3a710c0, ftLastWriteTime.dwHighDateTime=0x1d4d178, nFileSizeHigh=0x0, nFileSizeLow=0x1011c)) returned 1
	[0177.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.723] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv", lpFilePart=0x0) returned 0x42
	[0177.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.723] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\plqq.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.723] GetFileType (hFile=0x318) returned 0x1
	[0177.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.723] GetFileType (hFile=0x318) returned 0x1
	[0177.723] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1011c
	[0177.723] ReadFile (in: hFile=0x318, lpBuffer=0x26c0cac, nNumberOfBytesToRead=0x1011c, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c0cac*, lpNumberOfBytesRead=0x540efcc*=0x1011c, lpOverlapped=0x0) returned 1
	[0177.724] CloseHandle (hObject=0x318) returned 1
	[0177.724] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0177.724] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.724] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d0e64, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0177.724] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.724] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.724] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0177.724] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.725] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x26d0f1c*=0x1, dwFlags=0x0) returned 1
	[0177.725] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26d0ee8, dwFlags=0x0) returned 1
	[0177.725] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d0f2c*, pdwDataLen=0x540efd4*=0x10120, dwBufLen=0x10120 | out: pbData=0x26d0f2c*, pdwDataLen=0x540efd4*=0x10120) returned 1
	[0177.725] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e1058*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e1058*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.725] CryptDestroyKey (hKey=0x82b400) returned 1
	[0177.725] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.725] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv", lpFilePart=0x0) returned 0x42
	[0177.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.725] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\plqq.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.727] GetFileType (hFile=0x318) returned 0x1
	[0177.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.727] GetFileType (hFile=0x318) returned 0x1
	[0177.727] WriteFile (in: hFile=0x318, lpBuffer=0x26d0f2c*, nNumberOfBytesToWrite=0x10120, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26d0f2c*, lpNumberOfBytesWritten=0x540efc0*=0x10120, lpOverlapped=0x0) returned 1
	[0177.728] CloseHandle (hObject=0x318) returned 1
	[0177.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv", lpFilePart=0x0) returned 0x42
	[0177.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x71
	[0177.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.729] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\plqq.mkv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f0236b0, ftCreationTime.dwHighDateTime=0x1d4d51c, ftLastAccessTime.dwLowDateTime=0xf3a710c0, ftLastAccessTime.dwHighDateTime=0x1d4d178, ftLastWriteTime.dwLowDateTime=0xa4442bb1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10120)) returned 1
	[0177.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.729] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\plqq.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\pLqQ.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\plqq.mkv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv", lpFilePart=0x0) returned 0x4a
	[0177.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\qvvor vgxccx.flv"), fInfoLevelId=0x0, lpFileInformation=0x26e14b0 | out: lpFileInformation=0x26e14b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc08cdc20, ftCreationTime.dwHighDateTime=0x1d4d4ab, ftLastAccessTime.dwLowDateTime=0xdcf22400, ftLastAccessTime.dwHighDateTime=0x1d4cdb8, ftLastWriteTime.dwLowDateTime=0xdcf22400, ftLastWriteTime.dwHighDateTime=0x1d4cdb8, nFileSizeHigh=0x0, nFileSizeLow=0xcb1a)) returned 1
	[0177.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv", lpFilePart=0x0) returned 0x4a
	[0177.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.730] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\qvvor vgxccx.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.730] GetFileType (hFile=0x318) returned 0x1
	[0177.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.730] GetFileType (hFile=0x318) returned 0x1
	[0177.730] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xcb1a
	[0177.731] ReadFile (in: hFile=0x318, lpBuffer=0x26e1730, nNumberOfBytesToRead=0xcb1a, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e1730*, lpNumberOfBytesRead=0x540efcc*=0xcb1a, lpOverlapped=0x0) returned 1
	[0177.731] CloseHandle (hObject=0x318) returned 1
	[0177.732] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.732] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.732] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ee2e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0177.732] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.732] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.732] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0177.732] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.732] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26ee3a0*=0x1, dwFlags=0x0) returned 1
	[0177.732] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26ee36c, dwFlags=0x0) returned 1
	[0177.732] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ee3b0*, pdwDataLen=0x540efd4*=0xcb20, dwBufLen=0xcb20 | out: pbData=0x26ee3b0*, pdwDataLen=0x540efd4*=0xcb20) returned 1
	[0177.732] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26faedc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26faedc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.732] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0177.732] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.732] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.732] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv", lpFilePart=0x0) returned 0x4a
	[0177.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.733] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\qvvor vgxccx.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.734] GetFileType (hFile=0x318) returned 0x1
	[0177.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.734] GetFileType (hFile=0x318) returned 0x1
	[0177.734] WriteFile (in: hFile=0x318, lpBuffer=0x26ee3b0*, nNumberOfBytesToWrite=0xcb20, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x26ee3b0*, lpNumberOfBytesWritten=0x540efc0*=0xcb20, lpOverlapped=0x0) returned 1
	[0177.736] CloseHandle (hObject=0x318) returned 1
	[0177.736] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv", lpFilePart=0x0) returned 0x4a
	[0177.736] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x79
	[0177.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.736] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\qvvor vgxccx.flv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc08cdc20, ftCreationTime.dwHighDateTime=0x1d4d4ab, ftLastAccessTime.dwLowDateTime=0xdcf22400, ftLastAccessTime.dwHighDateTime=0x1d4cdb8, ftLastWriteTime.dwLowDateTime=0xa4442bb1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xcb20)) returned 1
	[0177.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.736] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\qvvor vgxccx.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\qvvOR VGXCcX.flv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\qvvor vgxccx.flv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.737] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv", lpFilePart=0x0) returned 0x50
	[0177.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.737] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\tayp6d9cyra363eql4.mkv"), fInfoLevelId=0x0, lpFileInformation=0x26fb394 | out: lpFileInformation=0x26fb394*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc561f2a0, ftCreationTime.dwHighDateTime=0x1d4cc8e, ftLastAccessTime.dwLowDateTime=0x48ae5450, ftLastAccessTime.dwHighDateTime=0x1d4cb9f, ftLastWriteTime.dwLowDateTime=0x48ae5450, ftLastWriteTime.dwHighDateTime=0x1d4cb9f, nFileSizeHigh=0x0, nFileSizeLow=0xc9f1)) returned 1
	[0177.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.737] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv", lpFilePart=0x0) returned 0x50
	[0177.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.738] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\tayp6d9cyra363eql4.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.738] GetFileType (hFile=0x318) returned 0x1
	[0177.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.738] GetFileType (hFile=0x318) returned 0x1
	[0177.738] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xc9f1
	[0177.738] ReadFile (in: hFile=0x318, lpBuffer=0x26fb644, nNumberOfBytesToRead=0xc9f1, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26fb644*, lpNumberOfBytesRead=0x540efcc*=0xc9f1, lpOverlapped=0x0) returned 1
	[0177.739] CloseHandle (hObject=0x318) returned 1
	[0177.739] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.739] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.739] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27080d4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0177.739] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.739] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.740] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0177.740] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.740] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x270818c*=0x1, dwFlags=0x0) returned 1
	[0177.740] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2708158, dwFlags=0x0) returned 1
	[0177.740] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270819c*, pdwDataLen=0x540efd4*=0xca00, dwBufLen=0xca00 | out: pbData=0x270819c*, pdwDataLen=0x540efd4*=0xca00) returned 1
	[0177.755] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2714ba8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2714ba8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.755] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.755] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.755] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.755] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv", lpFilePart=0x0) returned 0x50
	[0177.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.755] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\tayp6d9cyra363eql4.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.761] GetFileType (hFile=0x318) returned 0x1
	[0177.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.761] GetFileType (hFile=0x318) returned 0x1
	[0177.761] WriteFile (in: hFile=0x318, lpBuffer=0x270819c*, nNumberOfBytesToWrite=0xca00, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x270819c*, lpNumberOfBytesWritten=0x540efc0*=0xca00, lpOverlapped=0x0) returned 1
	[0177.762] CloseHandle (hObject=0x318) returned 1
	[0177.762] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv", lpFilePart=0x0) returned 0x50
	[0177.762] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7f
	[0177.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.763] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\tayp6d9cyra363eql4.mkv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc561f2a0, ftCreationTime.dwHighDateTime=0x1d4cc8e, ftLastAccessTime.dwLowDateTime=0x48ae5450, ftLastAccessTime.dwHighDateTime=0x1d4cb9f, ftLastWriteTime.dwLowDateTime=0xa448f1de, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xca00)) returned 1
	[0177.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.763] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\tayp6d9cyra363eql4.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\tayP6D9cYra363eql4.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\tayp6d9cyra363eql4.mkv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv", lpFilePart=0x0) returned 0x4a
	[0177.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.764] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\_udddqzjvxkl.mkv"), fInfoLevelId=0x0, lpFileInformation=0x27150a8 | out: lpFileInformation=0x27150a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd34f40, ftCreationTime.dwHighDateTime=0x1d4d578, ftLastAccessTime.dwLowDateTime=0x1b52b770, ftLastAccessTime.dwHighDateTime=0x1d4cfab, ftLastWriteTime.dwLowDateTime=0x1b52b770, ftLastWriteTime.dwHighDateTime=0x1d4cfab, nFileSizeHigh=0x0, nFileSizeLow=0x37a0)) returned 1
	[0177.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv", lpFilePart=0x0) returned 0x4a
	[0177.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.764] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\_udddqzjvxkl.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.764] GetFileType (hFile=0x318) returned 0x1
	[0177.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.764] GetFileType (hFile=0x318) returned 0x1
	[0177.764] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x37a0
	[0177.764] ReadFile (in: hFile=0x318, lpBuffer=0x2715328, nNumberOfBytesToRead=0x37a0, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2715328*, lpNumberOfBytesRead=0x540efcc*=0x37a0, lpOverlapped=0x0) returned 1
	[0177.765] CloseHandle (hObject=0x318) returned 1
	[0177.765] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0177.765] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.766] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2718b64, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0177.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.766] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0177.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.766] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2718c1c*=0x1, dwFlags=0x0) returned 1
	[0177.766] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2718be8, dwFlags=0x0) returned 1
	[0177.766] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2718c2c*, pdwDataLen=0x540efd4*=0x37b0, dwBufLen=0x37b0 | out: pbData=0x2718c2c*, pdwDataLen=0x540efd4*=0x37b0) returned 1
	[0177.766] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271c3e8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271c3e8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.766] CryptDestroyKey (hKey=0x82b080) returned 1
	[0177.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.766] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv", lpFilePart=0x0) returned 0x4a
	[0177.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.766] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\_udddqzjvxkl.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.768] GetFileType (hFile=0x318) returned 0x1
	[0177.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.768] GetFileType (hFile=0x318) returned 0x1
	[0177.768] WriteFile (in: hFile=0x318, lpBuffer=0x2718c2c*, nNumberOfBytesToWrite=0x37b0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2718c2c*, lpNumberOfBytesWritten=0x540efc0*=0x37b0, lpOverlapped=0x0) returned 1
	[0177.769] CloseHandle (hObject=0x318) returned 1
	[0177.769] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv", lpFilePart=0x0) returned 0x4a
	[0177.769] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x79
	[0177.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.769] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\_udddqzjvxkl.mkv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd34f40, ftCreationTime.dwHighDateTime=0x1d4d578, ftLastAccessTime.dwLowDateTime=0x1b52b770, ftLastAccessTime.dwHighDateTime=0x1d4cfab, ftLastWriteTime.dwLowDateTime=0xa448f1de, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x37b0)) returned 1
	[0177.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.769] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\_udddqzjvxkl.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\wRs6luVxjXk46_vbNEsf\\_uDddQZJvxkl.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\wrs6luvxjxk46_vbnesf\\_udddqzjvxkl.mkv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi", lpFilePart=0x0) returned 0x44
	[0177.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.770] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\ljasd_5n_d9ms.avi"), fInfoLevelId=0x0, lpFileInformation=0x271c8a0 | out: lpFileInformation=0x271c8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765735b0, ftCreationTime.dwHighDateTime=0x1d4cfc9, ftLastAccessTime.dwLowDateTime=0x9c94f860, ftLastAccessTime.dwHighDateTime=0x1d4d1c8, ftLastWriteTime.dwLowDateTime=0x9c94f860, ftLastWriteTime.dwHighDateTime=0x1d4d1c8, nFileSizeHigh=0x0, nFileSizeLow=0x5813)) returned 1
	[0177.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi", lpFilePart=0x0) returned 0x44
	[0177.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.771] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\ljasd_5n_d9ms.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.771] GetFileType (hFile=0x318) returned 0x1
	[0177.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.771] GetFileType (hFile=0x318) returned 0x1
	[0177.771] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x5813
	[0177.771] ReadFile (in: hFile=0x318, lpBuffer=0x271cb08, nNumberOfBytesToRead=0x5813, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271cb08*, lpNumberOfBytesRead=0x540efcc*=0x5813, lpOverlapped=0x0) returned 1
	[0177.772] CloseHandle (hObject=0x318) returned 1
	[0177.772] CryptDestroyKey (hKey=0x82b340) returned 1
	[0177.772] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.772] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27223b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0177.772] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.772] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.772] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0177.772] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.773] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2722470*=0x1, dwFlags=0x0) returned 1
	[0177.773] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x272243c, dwFlags=0x0) returned 1
	[0177.773] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2722480*, pdwDataLen=0x540efd4*=0x5820, dwBufLen=0x5820 | out: pbData=0x2722480*, pdwDataLen=0x540efd4*=0x5820) returned 1
	[0177.773] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2727cac*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2727cac*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.773] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.773] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.773] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.773] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi", lpFilePart=0x0) returned 0x44
	[0177.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.773] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\ljasd_5n_d9ms.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.774] GetFileType (hFile=0x318) returned 0x1
	[0177.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.774] GetFileType (hFile=0x318) returned 0x1
	[0177.774] WriteFile (in: hFile=0x318, lpBuffer=0x2722480*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2722480*, lpNumberOfBytesWritten=0x540efc0*=0x5820, lpOverlapped=0x0) returned 1
	[0177.776] CloseHandle (hObject=0x318) returned 1
	[0177.776] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi", lpFilePart=0x0) returned 0x44
	[0177.776] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x73
	[0177.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.776] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\ljasd_5n_d9ms.avi"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765735b0, ftCreationTime.dwHighDateTime=0x1d4cfc9, ftLastAccessTime.dwLowDateTime=0x9c94f860, ftLastAccessTime.dwHighDateTime=0x1d4d1c8, ftLastWriteTime.dwLowDateTime=0xa44b5348, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5820)) returned 1
	[0177.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.776] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\ljasd_5n_d9ms.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ljASd_5N_d9MS.avi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\ljasd_5n_d9ms.avi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.777] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv", lpFilePart=0x0) returned 0x42
	[0177.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.777] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\pedj5vkrgvf.flv"), fInfoLevelId=0x0, lpFileInformation=0x2728128 | out: lpFileInformation=0x2728128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22c5090, ftCreationTime.dwHighDateTime=0x1d4cf7c, ftLastAccessTime.dwLowDateTime=0x79012b60, ftLastAccessTime.dwHighDateTime=0x1d4d47c, ftLastWriteTime.dwLowDateTime=0x79012b60, ftLastWriteTime.dwHighDateTime=0x1d4d47c, nFileSizeHigh=0x0, nFileSizeLow=0x1089b)) returned 1
	[0177.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.777] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv", lpFilePart=0x0) returned 0x42
	[0177.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.777] ReadFile (in: hFile=0x318, lpBuffer=0x2728380, nNumberOfBytesToRead=0x1089b, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2728380*, lpNumberOfBytesRead=0x540efcc*=0x1089b, lpOverlapped=0x0) returned 1
	[0177.778] CryptDestroyKey (hKey=0x82b040) returned 1
	[0177.778] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.778] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2738cb8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0177.778] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.778] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.778] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0177.778] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.778] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2738d70*=0x1, dwFlags=0x0) returned 1
	[0177.779] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2738d3c, dwFlags=0x0) returned 1
	[0177.779] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2738d80*, pdwDataLen=0x540efd4*=0x108a0, dwBufLen=0x108a0 | out: pbData=0x2738d80*, pdwDataLen=0x540efd4*=0x108a0) returned 1
	[0177.779] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274962c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x274962c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.779] CryptDestroyKey (hKey=0x82b000) returned 1
	[0177.779] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.779] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv", lpFilePart=0x0) returned 0x42
	[0177.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.779] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\pedj5vkrgvf.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.780] GetFileType (hFile=0x318) returned 0x1
	[0177.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.780] GetFileType (hFile=0x318) returned 0x1
	[0177.780] WriteFile (in: hFile=0x318, lpBuffer=0x2738d80*, nNumberOfBytesToWrite=0x108a0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2738d80*, lpNumberOfBytesWritten=0x540efc0*=0x108a0, lpOverlapped=0x0) returned 1
	[0177.782] CloseHandle (hObject=0x318) returned 1
	[0177.782] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv", lpFilePart=0x0) returned 0x42
	[0177.782] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x71
	[0177.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.782] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\pedj5vkrgvf.flv"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22c5090, ftCreationTime.dwHighDateTime=0x1d4cf7c, ftLastAccessTime.dwLowDateTime=0x79012b60, ftLastAccessTime.dwHighDateTime=0x1d4d47c, ftLastWriteTime.dwLowDateTime=0xa44b5348, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x108a0)) returned 1
	[0177.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.783] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\pedj5vkrgvf.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\PEDj5VkrGvF.flv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\pedj5vkrgvf.flv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.783] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf", lpFilePart=0x0) returned 0x42
	[0177.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.783] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\sp_dlzw1--3.swf"), fInfoLevelId=0x0, lpFileInformation=0x2749a90 | out: lpFileInformation=0x2749a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197bb0a0, ftCreationTime.dwHighDateTime=0x1d4d2e4, ftLastAccessTime.dwLowDateTime=0x53613660, ftLastAccessTime.dwHighDateTime=0x1d4cc8a, ftLastWriteTime.dwLowDateTime=0x53613660, ftLastWriteTime.dwHighDateTime=0x1d4cc8a, nFileSizeHigh=0x0, nFileSizeLow=0x15c5d)) returned 1
	[0177.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.784] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf", lpFilePart=0x0) returned 0x42
	[0177.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.784] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\sp_dlzw1--3.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.784] GetFileType (hFile=0x318) returned 0x1
	[0177.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.784] GetFileType (hFile=0x318) returned 0x1
	[0177.784] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x15c5d
	[0177.784] ReadFile (in: hFile=0x318, lpBuffer=0x41b3fd8, nNumberOfBytesToRead=0x15c5d, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x41b3fd8*, lpNumberOfBytesRead=0x540efcc*=0x15c5d, lpOverlapped=0x0) returned 1
	[0177.786] CloseHandle (hObject=0x318) returned 1
	[0177.786] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.786] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.786] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2749d78, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0177.786] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.786] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.786] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0177.786] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.786] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2749e30*=0x1, dwFlags=0x0) returned 1
	[0177.786] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2749dfc, dwFlags=0x0) returned 1
	[0177.787] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x41c9c58*, pdwDataLen=0x540efd4*=0x15c60, dwBufLen=0x15c60 | out: pbData=0x41c9c58*, pdwDataLen=0x540efd4*=0x15c60) returned 1
	[0177.787] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2749e40*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2749e40*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.787] CryptDestroyKey (hKey=0x82b380) returned 1
	[0177.787] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.787] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.788] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf", lpFilePart=0x0) returned 0x42
	[0177.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.788] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\sp_dlzw1--3.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.789] GetFileType (hFile=0x318) returned 0x1
	[0177.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.789] GetFileType (hFile=0x318) returned 0x1
	[0177.789] WriteFile (in: hFile=0x318, lpBuffer=0x41c9c58*, nNumberOfBytesToWrite=0x15c60, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x41c9c58*, lpNumberOfBytesWritten=0x540efc0*=0x15c60, lpOverlapped=0x0) returned 1
	[0177.792] CloseHandle (hObject=0x318) returned 1
	[0177.792] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf", lpFilePart=0x0) returned 0x42
	[0177.792] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x71
	[0177.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.792] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\sp_dlzw1--3.swf"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197bb0a0, ftCreationTime.dwHighDateTime=0x1d4d2e4, ftLastAccessTime.dwLowDateTime=0x53613660, ftLastAccessTime.dwHighDateTime=0x1d4cc8a, ftLastWriteTime.dwLowDateTime=0xa44db55b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x15c60)) returned 1
	[0177.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.792] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\sp_dlzw1--3.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\sp_dlzW1--3.swf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\sp_dlzw1--3.swf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4", lpFilePart=0x0) returned 0x3f
	[0177.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.793] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\ugbcdogh.mp4"), fInfoLevelId=0x0, lpFileInformation=0x274a2a4 | out: lpFileInformation=0x274a2a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b51370, ftCreationTime.dwHighDateTime=0x1d4cabf, ftLastAccessTime.dwLowDateTime=0x7750b670, ftLastAccessTime.dwHighDateTime=0x1d4d001, ftLastWriteTime.dwLowDateTime=0x7750b670, ftLastWriteTime.dwHighDateTime=0x1d4d001, nFileSizeHigh=0x0, nFileSizeLow=0x18a45)) returned 1
	[0177.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4", lpFilePart=0x0) returned 0x3f
	[0177.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.793] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\ugbcdogh.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.793] GetFileType (hFile=0x318) returned 0x1
	[0177.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.793] GetFileType (hFile=0x318) returned 0x1
	[0177.793] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x18a45
	[0177.794] ReadFile (in: hFile=0x318, lpBuffer=0x41df8d8, nNumberOfBytesToRead=0x18a45, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x41df8d8*, lpNumberOfBytesRead=0x540efcc*=0x18a45, lpOverlapped=0x0) returned 1
	[0177.796] CloseHandle (hObject=0x318) returned 1
	[0177.796] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.796] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.796] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274a574, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0177.796] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.796] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.796] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0177.796] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.796] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x274a62c*=0x1, dwFlags=0x0) returned 1
	[0177.796] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x274a5f8, dwFlags=0x0) returned 1
	[0177.798] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x41f8340*, pdwDataLen=0x540efd4*=0x18a50, dwBufLen=0x18a50 | out: pbData=0x41f8340*, pdwDataLen=0x540efd4*=0x18a50) returned 1
	[0177.798] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274a63c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x274a63c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.798] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.798] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.798] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.798] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4", lpFilePart=0x0) returned 0x3f
	[0177.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.798] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\ugbcdogh.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.800] GetFileType (hFile=0x318) returned 0x1
	[0177.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.800] GetFileType (hFile=0x318) returned 0x1
	[0177.800] WriteFile (in: hFile=0x318, lpBuffer=0x41f8340*, nNumberOfBytesToWrite=0x18a50, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x41f8340*, lpNumberOfBytesWritten=0x540efc0*=0x18a50, lpOverlapped=0x0) returned 1
	[0177.813] CloseHandle (hObject=0x318) returned 1
	[0177.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4", lpFilePart=0x0) returned 0x3f
	[0177.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6e
	[0177.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.814] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\ugbcdogh.mp4"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b51370, ftCreationTime.dwHighDateTime=0x1d4cabf, ftLastAccessTime.dwLowDateTime=0x7750b670, ftLastAccessTime.dwHighDateTime=0x1d4d001, ftLastWriteTime.dwLowDateTime=0xa4501714, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x18a50)) returned 1
	[0177.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.814] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\ugbcdogh.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\yYO9153Pz4zX5\\ugbcdOGh.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\yyo9153pz4zx5\\ugbcdogh.mp4 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.815] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x7c
	[0177.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.815] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x274aa80 | out: lpFileInformation=0x274aa80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a346f8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a346f8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd19cd600, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5bec)) returned 1
	[0177.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.817] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x7c
	[0177.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.817] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.817] GetFileType (hFile=0x318) returned 0x1
	[0177.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.818] GetFileType (hFile=0x318) returned 0x1
	[0177.818] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x5bec
	[0177.818] ReadFile (in: hFile=0x318, lpBuffer=0x274adf0, nNumberOfBytesToRead=0x5bec, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x274adf0*, lpNumberOfBytesRead=0x540efcc*=0x5bec, lpOverlapped=0x0) returned 1
	[0177.946] CloseHandle (hObject=0x318) returned 1
	[0177.946] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.946] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.946] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2750a78, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0177.946] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.946] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.946] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0177.946] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.946] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2750b30*=0x1, dwFlags=0x0) returned 1
	[0177.946] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2750afc, dwFlags=0x0) returned 1
	[0177.946] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2750b40*, pdwDataLen=0x540efd4*=0x5bf0, dwBufLen=0x5bf0 | out: pbData=0x2750b40*, pdwDataLen=0x540efd4*=0x5bf0) returned 1
	[0177.947] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275673c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x275673c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.947] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0177.947] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.947] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.947] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x7c
	[0177.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.947] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.948] GetFileType (hFile=0x318) returned 0x1
	[0177.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.948] GetFileType (hFile=0x318) returned 0x1
	[0177.948] WriteFile (in: hFile=0x318, lpBuffer=0x2750b40*, nNumberOfBytesToWrite=0x5bf0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2750b40*, lpNumberOfBytesWritten=0x540efc0*=0x5bf0, lpOverlapped=0x0) returned 1
	[0177.950] CloseHandle (hObject=0x318) returned 1
	[0177.950] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x7c
	[0177.950] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xab
	[0177.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.950] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a346f8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a346f8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa4658cc1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5bf0)) returned 1
	[0177.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.950] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash", lpFilePart=0x0) returned 0x6e
	[0177.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.951] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash"), fInfoLevelId=0x0, lpFileInformation=0x2756dfc | out: lpFileInformation=0x2756dfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x66)) returned 1
	[0177.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash", lpFilePart=0x0) returned 0x6e
	[0177.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.952] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.952] GetFileType (hFile=0x318) returned 0x1
	[0177.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.952] GetFileType (hFile=0x318) returned 0x1
	[0177.952] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x66
	[0177.952] ReadFile (in: hFile=0x318, lpBuffer=0x2757170, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2757170*, lpNumberOfBytesRead=0x540efcc*=0x66, lpOverlapped=0x0) returned 1
	[0177.953] CloseHandle (hObject=0x318) returned 1
	[0177.953] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.953] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.954] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275820c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0177.954] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.954] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.954] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0177.954] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.954] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27582c4*=0x1, dwFlags=0x0) returned 1
	[0177.954] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2758290, dwFlags=0x0) returned 1
	[0177.954] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27582d4*, pdwDataLen=0x540efd4*=0x70, dwBufLen=0x70 | out: pbData=0x27582d4*, pdwDataLen=0x540efd4*=0x70) returned 1
	[0177.954] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2758350*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2758350*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0177.954] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0177.954] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.954] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash", lpFilePart=0x0) returned 0x6e
	[0177.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0177.954] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.956] GetFileType (hFile=0x318) returned 0x1
	[0177.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0177.956] GetFileType (hFile=0x318) returned 0x1
	[0177.956] WriteFile (in: hFile=0x318, lpBuffer=0x27584dc*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27584dc*, lpNumberOfBytesWritten=0x540ef94*=0x70, lpOverlapped=0x0) returned 1
	[0177.957] CloseHandle (hObject=0x318) returned 1
	[0177.957] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash", lpFilePart=0x0) returned 0x6e
	[0177.957] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9d
	[0177.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0177.957] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa4658cc1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
	[0177.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0177.958] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", lpFilePart=0x0) returned 0x81
	[0177.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0177.959] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), fInfoLevelId=0x0, lpFileInformation=0x2759974 | out: lpFileInformation=0x2759974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x1dff67)) returned 1
	[0177.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0177.959] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", lpFilePart=0x0) returned 0x81
	[0177.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0177.959] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.959] GetFileType (hFile=0x318) returned 0x1
	[0177.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0177.960] GetFileType (hFile=0x318) returned 0x1
	[0177.960] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1dff67
	[0177.964] ReadFile (in: hFile=0x318, lpBuffer=0x4210db0, nNumberOfBytesToRead=0x1dff67, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x4210db0*, lpNumberOfBytesRead=0x540efcc*=0x1dff67, lpOverlapped=0x0) returned 1
	[0178.175] CloseHandle (hObject=0x318) returned 1
	[0178.175] CryptDestroyKey (hKey=0x82b380) returned 1
	[0178.175] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.175] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2759d94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0178.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.175] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0178.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.175] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2759e4c*=0x1, dwFlags=0x0) returned 1
	[0178.175] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2759e18, dwFlags=0x0) returned 1
	[0178.217] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x62a9aa8*, pdwDataLen=0x540efd4*=0x1dff70, dwBufLen=0x1dff70 | out: pbData=0x62a9aa8*, pdwDataLen=0x540efd4*=0x1dff70) returned 1
	[0178.218] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2759e5c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2759e5c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0178.219] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0178.219] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.219] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.219] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", lpFilePart=0x0) returned 0x81
	[0178.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0178.219] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0178.228] GetFileType (hFile=0x318) returned 0x1
	[0178.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0178.228] GetFileType (hFile=0x318) returned 0x1
	[0178.228] WriteFile (in: hFile=0x318, lpBuffer=0x62a9aa8*, nNumberOfBytesToWrite=0x1dff70, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x62a9aa8*, lpNumberOfBytesWritten=0x540efc0*=0x1dff70, lpOverlapped=0x0) returned 1
	[0178.294] CloseHandle (hObject=0x318) returned 1
	[0178.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", lpFilePart=0x0) returned 0x81
	[0178.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb0
	[0178.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0178.399] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa49a0024, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1dff70)) returned 1
	[0178.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0178.400] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0178.425] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash", lpFilePart=0x0) returned 0x77
	[0178.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0178.425] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash"), fInfoLevelId=0x0, lpFileInformation=0x275a558 | out: lpFileInformation=0x275a558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1
	[0178.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0178.426] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash", lpFilePart=0x0) returned 0x77
	[0178.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0178.426] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0178.426] GetFileType (hFile=0x318) returned 0x1
	[0178.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0178.426] GetFileType (hFile=0x318) returned 0x1
	[0178.426] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x80
	[0178.427] ReadFile (in: hFile=0x318, lpBuffer=0x275a924, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x275a924*, lpNumberOfBytesRead=0x540efcc*=0x80, lpOverlapped=0x0) returned 1
	[0178.446] CloseHandle (hObject=0x318) returned 1
	[0178.446] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0178.446] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.446] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275b9c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0178.446] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.446] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.446] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0178.446] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.446] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x275ba78*=0x1, dwFlags=0x0) returned 1
	[0178.446] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x275ba44, dwFlags=0x0) returned 1
	[0178.446] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275ba88*, pdwDataLen=0x540efd4*=0x90, dwBufLen=0x90 | out: pbData=0x275ba88*, pdwDataLen=0x540efd4*=0x90) returned 1
	[0178.447] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275bb24*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x275bb24*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0178.447] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0178.447] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.447] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.447] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash", lpFilePart=0x0) returned 0x77
	[0178.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0178.447] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0178.448] GetFileType (hFile=0x318) returned 0x1
	[0178.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0178.448] GetFileType (hFile=0x318) returned 0x1
	[0178.448] WriteFile (in: hFile=0x318, lpBuffer=0x275bcd0*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x275bcd0*, lpNumberOfBytesWritten=0x540ef94*=0x90, lpOverlapped=0x0) returned 1
	[0178.449] CloseHandle (hObject=0x318) returned 1
	[0178.449] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash", lpFilePart=0x0) returned 0x77
	[0178.450] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa6
	[0178.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0178.450] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa4b22cef, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1
	[0178.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0178.450] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0178.451] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat", lpFilePart=0x0) returned 0x7a
	[0178.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0178.451] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x275d1b4 | out: lpFileInformation=0x275d1b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693)) returned 1
	[0178.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0178.452] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat", lpFilePart=0x0) returned 0x7a
	[0178.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0178.452] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0178.452] GetFileType (hFile=0x318) returned 0x1
	[0178.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0178.452] GetFileType (hFile=0x318) returned 0x1
	[0178.452] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x108693
	[0178.502] ReadFile (in: hFile=0x318, lpBuffer=0x6489a38, nNumberOfBytesToRead=0x108693, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x6489a38*, lpNumberOfBytesRead=0x540efcc*=0x108693, lpOverlapped=0x0) returned 1
	[0178.595] CloseHandle (hObject=0x318) returned 1
	[0178.595] CryptDestroyKey (hKey=0x82b540) returned 1
	[0178.595] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.596] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275d5a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0178.596] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.596] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.596] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0178.596] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.596] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x275d65c*=0x1, dwFlags=0x0) returned 1
	[0178.596] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x275d628, dwFlags=0x0) returned 1
	[0178.747] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5941018*, pdwDataLen=0x540efd4*=0x1086a0, dwBufLen=0x1086a0 | out: pbData=0x5941018*, pdwDataLen=0x540efd4*=0x1086a0) returned 1
	[0178.748] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2629038*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2629038*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0178.748] CryptDestroyKey (hKey=0x82b540) returned 1
	[0178.748] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.748] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat", lpFilePart=0x0) returned 0x7a
	[0178.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0178.748] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0178.750] GetFileType (hFile=0x318) returned 0x1
	[0178.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0178.750] GetFileType (hFile=0x318) returned 0x1
	[0178.750] WriteFile (in: hFile=0x318, lpBuffer=0x5941018*, nNumberOfBytesToWrite=0x1086a0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x5941018*, lpNumberOfBytesWritten=0x540efc0*=0x1086a0, lpOverlapped=0x0) returned 1
	[0178.769] CloseHandle (hObject=0x318) returned 1
	[0178.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat", lpFilePart=0x0) returned 0x7a
	[0178.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa9
	[0178.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0178.770] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa4e18750, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1086a0)) returned 1
	[0178.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0178.770] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0178.771] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x7e
	[0178.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0178.771] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x26296e0 | out: lpFileInformation=0x26296e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bd39c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdd889800, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5b31)) returned 1
	[0178.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0178.772] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x7e
	[0178.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0178.772] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0178.772] GetFileType (hFile=0x318) returned 0x1
	[0178.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0178.772] GetFileType (hFile=0x318) returned 0x1
	[0178.772] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x5b31
	[0178.773] ReadFile (in: hFile=0x318, lpBuffer=0x2629a58, nNumberOfBytesToRead=0x5b31, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2629a58*, lpNumberOfBytesRead=0x540efcc*=0x5b31, lpOverlapped=0x0) returned 1
	[0178.774] CloseHandle (hObject=0x318) returned 1
	[0178.775] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0178.775] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.775] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262f628, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0178.775] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.775] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.775] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0178.775] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.775] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x262f6e0*=0x1, dwFlags=0x0) returned 1
	[0178.775] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x262f6ac, dwFlags=0x0) returned 1
	[0178.775] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262f6f0*, pdwDataLen=0x540efd4*=0x5b40, dwBufLen=0x5b40 | out: pbData=0x262f6f0*, pdwDataLen=0x540efd4*=0x5b40) returned 1
	[0178.775] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263523c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x263523c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0178.775] CryptDestroyKey (hKey=0x82b280) returned 1
	[0178.775] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.775] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.776] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x7e
	[0178.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0178.776] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0178.777] GetFileType (hFile=0x318) returned 0x1
	[0178.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0178.777] GetFileType (hFile=0x318) returned 0x1
	[0178.777] WriteFile (in: hFile=0x318, lpBuffer=0x262f6f0*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x262f6f0*, lpNumberOfBytesWritten=0x540efc0*=0x5b40, lpOverlapped=0x0) returned 1
	[0178.779] CloseHandle (hObject=0x318) returned 1
	[0178.779] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x7e
	[0178.779] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xad
	[0178.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0178.779] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bd39c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa4e3ea5c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5b40)) returned 1
	[0178.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0178.779] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0178.780] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash", lpFilePart=0x0) returned 0x6c
	[0178.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0178.780] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash"), fInfoLevelId=0x0, lpFileInformation=0x2635910 | out: lpFileInformation=0x2635910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x66)) returned 1
	[0178.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0178.800] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash", lpFilePart=0x0) returned 0x6c
	[0178.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0178.800] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0178.800] GetFileType (hFile=0x318) returned 0x1
	[0178.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0178.800] GetFileType (hFile=0x318) returned 0x1
	[0178.800] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x66
	[0178.800] ReadFile (in: hFile=0x318, lpBuffer=0x2635c6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2635c6c*, lpNumberOfBytesRead=0x540efcc*=0x66, lpOverlapped=0x0) returned 1
	[0178.801] CloseHandle (hObject=0x318) returned 1
	[0178.801] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0178.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.802] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2636d08, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0178.802] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.802] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.802] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0178.802] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0178.802] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2636dc0*=0x1, dwFlags=0x0) returned 1
	[0178.802] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2636d8c, dwFlags=0x0) returned 1
	[0178.802] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2636dd0*, pdwDataLen=0x540efd4*=0x70, dwBufLen=0x70 | out: pbData=0x2636dd0*, pdwDataLen=0x540efd4*=0x70) returned 1
	[0178.802] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2636e4c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2636e4c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0178.802] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0178.802] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.802] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0178.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash", lpFilePart=0x0) returned 0x6c
	[0178.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0178.802] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0178.804] GetFileType (hFile=0x318) returned 0x1
	[0178.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0178.804] GetFileType (hFile=0x318) returned 0x1
	[0178.804] WriteFile (in: hFile=0x318, lpBuffer=0x2636fcc*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2636fcc*, lpNumberOfBytesWritten=0x540ef94*=0x70, lpOverlapped=0x0) returned 1
	[0178.805] CloseHandle (hObject=0x318) returned 1
	[0178.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash", lpFilePart=0x0) returned 0x6c
	[0178.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9b
	[0178.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0178.805] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa4e8ae6a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
	[0178.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0178.805] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0178.806] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", lpFilePart=0x0) returned 0x81
	[0178.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0178.806] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), fInfoLevelId=0x0, lpFileInformation=0x2638454 | out: lpFileInformation=0x2638454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a5c)) returned 1
	[0178.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0178.807] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", lpFilePart=0x0) returned 0x81
	[0178.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0178.807] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0178.807] GetFileType (hFile=0x318) returned 0x1
	[0178.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0178.807] GetFileType (hFile=0x318) returned 0x1
	[0178.807] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x7e0a5c
	[0178.854] ReadFile (in: hFile=0x318, lpBuffer=0x5a496d8, nNumberOfBytesToRead=0x7e0a5c, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x5a496d8*, lpNumberOfBytesRead=0x540efcc*=0x7e0a5c, lpOverlapped=0x0) returned 1
	[0179.088] CloseHandle (hObject=0x318) returned 1
	[0179.088] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0179.088] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0179.089] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2638874, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0179.089] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0179.089] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0179.089] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0179.089] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0179.089] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x263892c*=0x1, dwFlags=0x0) returned 1
	[0179.089] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26388f8, dwFlags=0x0) returned 1
	[0179.407] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34494c8*, pdwDataLen=0x540efd4*=0x7e0a60, dwBufLen=0x7e0a60 | out: pbData=0x34494c8*, pdwDataLen=0x540efd4*=0x7e0a60) returned 1
	[0179.414] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2629038*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2629038*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0179.414] CryptDestroyKey (hKey=0x82b480) returned 1
	[0179.414] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0179.414] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0179.414] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", lpFilePart=0x0) returned 0x81
	[0179.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0179.414] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0179.424] GetFileType (hFile=0x318) returned 0x1
	[0179.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0179.424] GetFileType (hFile=0x318) returned 0x1
	[0179.424] WriteFile (in: hFile=0x318, lpBuffer=0x34494c8*, nNumberOfBytesToWrite=0x7e0a60, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesWritten=0x540efc0*=0x7e0a60, lpOverlapped=0x0) returned 1
	[0179.649] CloseHandle (hObject=0x318) returned 1
	[0179.649] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", lpFilePart=0x0) returned 0x81
	[0179.649] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb0
	[0179.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0179.649] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa5696d14, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a60)) returned 1
	[0179.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0179.649] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0179.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash", lpFilePart=0x0) returned 0x79
	[0179.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0179.650] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash"), fInfoLevelId=0x0, lpFileInformation=0x2629734 | out: lpFileInformation=0x2629734*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x316a100, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1
	[0179.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0179.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.748] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.772] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.773] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.777] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.779] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.782] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.783] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.791] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.793] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.796] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.797] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.800] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.802] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.806] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.815] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.817] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.882] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.884] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.885] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.886] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.887] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.888] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.889] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.890] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.891] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.900] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.901] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.911] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.913] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.915] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.920] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.921] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.923] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.275] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.277] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.278] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.280] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.280] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.283] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.285] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.286] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.290] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.292] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.293] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.295] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.296] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.300] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.302] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.367] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.396] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.498] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.533] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.060] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x64
	[0181.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.060] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.060] GetFileType (hFile=0x318) returned 0x1
	[0181.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.060] GetFileType (hFile=0x318) returned 0x1
	[0181.060] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x536
	[0181.061] ReadFile (in: hFile=0x318, lpBuffer=0x262ee2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x262ee2c*, lpNumberOfBytesRead=0x540efcc*=0x536, lpOverlapped=0x0) returned 1
	[0181.110] CloseHandle (hObject=0x318) returned 1
	[0181.110] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0181.110] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.110] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262fec8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0181.110] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.110] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.110] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0181.110] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.110] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x262ff80*=0x1, dwFlags=0x0) returned 1
	[0181.110] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x262ff4c, dwFlags=0x0) returned 1
	[0181.110] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262ff90*, pdwDataLen=0x540efd4*=0x540, dwBufLen=0x540 | out: pbData=0x262ff90*, pdwDataLen=0x540efd4*=0x540) returned 1
	[0181.110] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26304dc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26304dc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.110] CryptDestroyKey (hKey=0x82b400) returned 1
	[0181.110] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.110] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.110] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x64
	[0181.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.110] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0181.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0181.112] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x64
	[0181.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.112] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), fInfoLevelId=0x0, lpFileInformation=0x2630bc8 | out: lpFileInformation=0x2630bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8)) returned 1
	[0181.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x64
	[0181.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.113] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.113] GetFileType (hFile=0x318) returned 0x1
	[0181.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.113] GetFileType (hFile=0x318) returned 0x1
	[0181.113] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x5e8
	[0181.113] ReadFile (in: hFile=0x318, lpBuffer=0x2631494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2631494*, lpNumberOfBytesRead=0x540efcc*=0x5e8, lpOverlapped=0x0) returned 1
	[0181.114] CloseHandle (hObject=0x318) returned 1
	[0181.114] CryptDestroyKey (hKey=0x82b540) returned 1
	[0181.114] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.114] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2632530, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0181.115] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.115] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.115] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0181.115] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.115] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26325e8*=0x1, dwFlags=0x0) returned 1
	[0181.115] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26325b4, dwFlags=0x0) returned 1
	[0181.115] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26325f8*, pdwDataLen=0x540efd4*=0x5f0, dwBufLen=0x5f0 | out: pbData=0x26325f8*, pdwDataLen=0x540efd4*=0x5f0) returned 1
	[0181.115] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2632bf4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2632bf4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.115] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0181.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.115] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x64
	[0181.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.115] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0181.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540d8f0) returned 1
	[0181.117] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.117] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26332e0 | out: lpFileInformation=0x26332e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e3557c, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e3557c, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e3557c, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x71e)) returned 1
	[0181.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.117] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.117] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.117] GetFileType (hFile=0x318) returned 0x1
	[0181.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.117] GetFileType (hFile=0x318) returned 0x1
	[0181.117] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x71e
	[0181.117] ReadFile (in: hFile=0x318, lpBuffer=0x2633d3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2633d3c*, lpNumberOfBytesRead=0x540efcc*=0x71e, lpOverlapped=0x0) returned 1
	[0181.119] CloseHandle (hObject=0x318) returned 1
	[0181.119] CryptDestroyKey (hKey=0x82b100) returned 1
	[0181.119] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.119] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2634dd8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0181.119] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.119] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.119] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0181.119] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.119] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2634e90*=0x1, dwFlags=0x0) returned 1
	[0181.119] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2634e5c, dwFlags=0x0) returned 1
	[0181.119] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2634ea0*, pdwDataLen=0x540efd4*=0x720, dwBufLen=0x720 | out: pbData=0x2634ea0*, pdwDataLen=0x540efd4*=0x720) returned 1
	[0181.119] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26355cc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26355cc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.119] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0181.119] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.119] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.120] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.121] GetFileType (hFile=0x318) returned 0x1
	[0181.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.121] GetFileType (hFile=0x318) returned 0x1
	[0181.121] WriteFile (in: hFile=0x318, lpBuffer=0x2635770*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2635770*, lpNumberOfBytesWritten=0x540ef94*=0x720, lpOverlapped=0x0) returned 1
	[0181.122] CloseHandle (hObject=0x318) returned 1
	[0181.122] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.122] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa0
	[0181.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.122] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e3557c, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e3557c, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa64989cb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x720)) returned 1
	[0181.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.122] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml", lpFilePart=0x0) returned 0x73
	[0181.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.123] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2636c24 | out: lpFileInformation=0x2636c24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e6fcbc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e6fcbc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x168)) returned 1
	[0181.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml", lpFilePart=0x0) returned 0x73
	[0181.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.123] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.123] GetFileType (hFile=0x318) returned 0x1
	[0181.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.123] GetFileType (hFile=0x318) returned 0x1
	[0181.124] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x168
	[0181.124] ReadFile (in: hFile=0x318, lpBuffer=0x26370d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26370d8*, lpNumberOfBytesRead=0x540efcc*=0x168, lpOverlapped=0x0) returned 1
	[0181.124] CloseHandle (hObject=0x318) returned 1
	[0181.125] CryptDestroyKey (hKey=0x82b440) returned 1
	[0181.125] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.125] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2638174, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0181.125] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.125] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.125] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0181.125] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.125] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x263822c*=0x1, dwFlags=0x0) returned 1
	[0181.125] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26381f8, dwFlags=0x0) returned 1
	[0181.125] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263823c*, pdwDataLen=0x540efd4*=0x170, dwBufLen=0x170 | out: pbData=0x263823c*, pdwDataLen=0x540efd4*=0x170) returned 1
	[0181.125] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26383b8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26383b8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.125] CryptDestroyKey (hKey=0x82b300) returned 1
	[0181.125] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.125] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.125] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml", lpFilePart=0x0) returned 0x73
	[0181.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.125] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.126] GetFileType (hFile=0x318) returned 0x1
	[0181.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.126] GetFileType (hFile=0x318) returned 0x1
	[0181.126] WriteFile (in: hFile=0x318, lpBuffer=0x275f514*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x275f514*, lpNumberOfBytesWritten=0x540ef94*=0x170, lpOverlapped=0x0) returned 1
	[0181.127] CloseHandle (hObject=0x318) returned 1
	[0181.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml", lpFilePart=0x0) returned 0x73
	[0181.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa2
	[0181.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.127] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e6fcbc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e6fcbc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa64989cb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x170)) returned 1
	[0181.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.127] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.128] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml", lpFilePart=0x0) returned 0x73
	[0181.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.128] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27609d8 | out: lpFileInformation=0x27609d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x168)) returned 1
	[0181.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.128] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml", lpFilePart=0x0) returned 0x73
	[0181.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.129] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.129] GetFileType (hFile=0x318) returned 0x1
	[0181.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.129] GetFileType (hFile=0x318) returned 0x1
	[0181.129] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x168
	[0181.129] ReadFile (in: hFile=0x318, lpBuffer=0x2760e8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2760e8c*, lpNumberOfBytesRead=0x540efcc*=0x168, lpOverlapped=0x0) returned 1
	[0181.130] CloseHandle (hObject=0x318) returned 1
	[0181.130] CryptDestroyKey (hKey=0x82b200) returned 1
	[0181.130] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.130] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2761f28, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0181.130] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.130] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.130] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0181.130] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.130] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2761fe0*=0x1, dwFlags=0x0) returned 1
	[0181.130] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2761fac, dwFlags=0x0) returned 1
	[0181.130] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2761ff0*, pdwDataLen=0x540efd4*=0x170, dwBufLen=0x170 | out: pbData=0x2761ff0*, pdwDataLen=0x540efd4*=0x170) returned 1
	[0181.130] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276216c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x276216c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.130] CryptDestroyKey (hKey=0x82b380) returned 1
	[0181.130] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.130] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.130] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml", lpFilePart=0x0) returned 0x73
	[0181.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.130] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.132] GetFileType (hFile=0x318) returned 0x1
	[0181.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.132] GetFileType (hFile=0x318) returned 0x1
	[0181.132] WriteFile (in: hFile=0x318, lpBuffer=0x2762318*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2762318*, lpNumberOfBytesWritten=0x540ef94*=0x170, lpOverlapped=0x0) returned 1
	[0181.133] CloseHandle (hObject=0x318) returned 1
	[0181.133] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml", lpFilePart=0x0) returned 0x73
	[0181.133] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa2
	[0181.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.133] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa64bec5c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x170)) returned 1
	[0181.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.133] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.134] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.134] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27637dc | out: lpFileInformation=0x27637dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54060701, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54060701, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54060701, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcdd)) returned 1
	[0181.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.134] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.135] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.135] GetFileType (hFile=0x318) returned 0x1
	[0181.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.135] GetFileType (hFile=0x318) returned 0x1
	[0181.135] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xcdd
	[0181.135] ReadFile (in: hFile=0x318, lpBuffer=0x27647f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27647f8*, lpNumberOfBytesRead=0x540efcc*=0xcdd, lpOverlapped=0x0) returned 1
	[0181.153] CloseHandle (hObject=0x318) returned 1
	[0181.154] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0181.154] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.154] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2765894, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0181.154] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.154] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.154] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0181.154] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.154] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x276594c*=0x1, dwFlags=0x0) returned 1
	[0181.154] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2765918, dwFlags=0x0) returned 1
	[0181.154] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276595c*, pdwDataLen=0x540efd4*=0xce0, dwBufLen=0xce0 | out: pbData=0x276595c*, pdwDataLen=0x540efd4*=0xce0) returned 1
	[0181.154] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2766648*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2766648*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.154] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0181.154] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.154] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.154] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.154] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.155] GetFileType (hFile=0x318) returned 0x1
	[0181.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.155] GetFileType (hFile=0x318) returned 0x1
	[0181.155] WriteFile (in: hFile=0x318, lpBuffer=0x27667ec*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27667ec*, lpNumberOfBytesWritten=0x540ef94*=0xce0, lpOverlapped=0x0) returned 1
	[0181.156] CloseHandle (hObject=0x318) returned 1
	[0181.156] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.156] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa0
	[0181.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.156] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54060701, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54060701, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa64e4dc4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xce0)) returned 1
	[0181.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.157] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.157] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.157] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2767ca0 | out: lpFileInformation=0x2767ca0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53dc2e6f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53dc2e6f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x3a7)) returned 1
	[0181.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.158] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.158] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.158] GetFileType (hFile=0x318) returned 0x1
	[0181.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.158] GetFileType (hFile=0x318) returned 0x1
	[0181.158] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3a7
	[0181.158] ReadFile (in: hFile=0x318, lpBuffer=0x2768384, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2768384*, lpNumberOfBytesRead=0x540efcc*=0x3a7, lpOverlapped=0x0) returned 1
	[0181.159] CloseHandle (hObject=0x318) returned 1
	[0181.160] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0181.160] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.160] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2769420, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0181.160] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.160] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.160] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0181.160] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.160] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27694d8*=0x1, dwFlags=0x0) returned 1
	[0181.160] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x27694a4, dwFlags=0x0) returned 1
	[0181.160] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27694e8*, pdwDataLen=0x540efd4*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x27694e8*, pdwDataLen=0x540efd4*=0x3b0) returned 1
	[0181.160] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27698a4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27698a4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.160] CryptDestroyKey (hKey=0x82b080) returned 1
	[0181.160] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.160] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.160] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.160] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.161] GetFileType (hFile=0x318) returned 0x1
	[0181.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.161] GetFileType (hFile=0x318) returned 0x1
	[0181.161] WriteFile (in: hFile=0x318, lpBuffer=0x2769a48*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2769a48*, lpNumberOfBytesWritten=0x540ef94*=0x3b0, lpOverlapped=0x0) returned 1
	[0181.164] CloseHandle (hObject=0x318) returned 1
	[0181.164] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.164] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa0
	[0181.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.164] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53dc2e6f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53dc2e6f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa650b0c7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1
	[0181.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.164] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.165] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x276aefc | out: lpFileInformation=0x276aefc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53eab83a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53eab83a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53eab83a, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0181.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.166] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.166] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.166] GetFileType (hFile=0x318) returned 0x1
	[0181.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.166] GetFileType (hFile=0x318) returned 0x1
	[0181.166] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x360
	[0181.166] ReadFile (in: hFile=0x318, lpBuffer=0x276b598, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x276b598*, lpNumberOfBytesRead=0x540efcc*=0x360, lpOverlapped=0x0) returned 1
	[0181.167] CloseHandle (hObject=0x318) returned 1
	[0181.167] CryptDestroyKey (hKey=0x82b340) returned 1
	[0181.167] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.168] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276c634, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0181.168] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.168] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.168] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0181.168] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.168] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x276c6ec*=0x1, dwFlags=0x0) returned 1
	[0181.168] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x276c6b8, dwFlags=0x0) returned 1
	[0181.168] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276c6fc*, pdwDataLen=0x540efd4*=0x370, dwBufLen=0x370 | out: pbData=0x276c6fc*, pdwDataLen=0x540efd4*=0x370) returned 1
	[0181.168] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276ca78*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x276ca78*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.168] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0181.168] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.168] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.168] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.168] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.169] GetFileType (hFile=0x318) returned 0x1
	[0181.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.169] GetFileType (hFile=0x318) returned 0x1
	[0181.169] WriteFile (in: hFile=0x318, lpBuffer=0x276cc1c*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x276cc1c*, lpNumberOfBytesWritten=0x540ef94*=0x370, lpOverlapped=0x0) returned 1
	[0181.170] CloseHandle (hObject=0x318) returned 1
	[0181.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa0
	[0181.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.170] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53eab83a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53eab83a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa650b0c7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1
	[0181.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.170] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.172] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.172] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x276e0d0 | out: lpFileInformation=0x276e0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54075ff8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54075ff8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x720)) returned 1
	[0181.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.172] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.172] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.172] GetFileType (hFile=0x318) returned 0x1
	[0181.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.172] GetFileType (hFile=0x318) returned 0x1
	[0181.172] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x720
	[0181.172] ReadFile (in: hFile=0x318, lpBuffer=0x276eb2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x276eb2c*, lpNumberOfBytesRead=0x540efcc*=0x720, lpOverlapped=0x0) returned 1
	[0181.350] CloseHandle (hObject=0x318) returned 1
	[0181.350] CryptDestroyKey (hKey=0x82b200) returned 1
	[0181.350] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.350] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276fbc8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0181.350] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.350] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.350] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0181.350] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.350] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x276fc80*=0x1, dwFlags=0x0) returned 1
	[0181.350] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x276fc4c, dwFlags=0x0) returned 1
	[0181.350] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276fc90*, pdwDataLen=0x540efd4*=0x730, dwBufLen=0x730 | out: pbData=0x276fc90*, pdwDataLen=0x540efd4*=0x730) returned 1
	[0181.350] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27703cc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27703cc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.350] CryptDestroyKey (hKey=0x82b280) returned 1
	[0181.351] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.351] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.351] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.351] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.352] GetFileType (hFile=0x318) returned 0x1
	[0181.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.352] GetFileType (hFile=0x318) returned 0x1
	[0181.352] WriteFile (in: hFile=0x318, lpBuffer=0x2770570*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2770570*, lpNumberOfBytesWritten=0x540ef94*=0x730, lpOverlapped=0x0) returned 1
	[0181.353] CloseHandle (hObject=0x318) returned 1
	[0181.353] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.353] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa0
	[0181.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.353] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54075ff8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54075ff8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa66d4df9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x730)) returned 1
	[0181.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.353] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.354] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.354] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2771a24 | out: lpFileInformation=0x2771a24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x905)) returned 1
	[0181.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.355] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.355] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.355] GetFileType (hFile=0x318) returned 0x1
	[0181.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.355] GetFileType (hFile=0x318) returned 0x1
	[0181.355] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x905
	[0181.355] ReadFile (in: hFile=0x318, lpBuffer=0x2772668, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2772668*, lpNumberOfBytesRead=0x540efcc*=0x905, lpOverlapped=0x0) returned 1
	[0181.377] CloseHandle (hObject=0x318) returned 1
	[0181.377] CryptDestroyKey (hKey=0x82b380) returned 1
	[0181.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.377] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2773704, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0181.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.377] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0181.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.377] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27737bc*=0x1, dwFlags=0x0) returned 1
	[0181.377] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2773788, dwFlags=0x0) returned 1
	[0181.377] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27737cc*, pdwDataLen=0x540efd4*=0x910, dwBufLen=0x910 | out: pbData=0x27737cc*, pdwDataLen=0x540efd4*=0x910) returned 1
	[0181.377] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27740e8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27740e8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.377] CryptDestroyKey (hKey=0x82b280) returned 1
	[0181.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.377] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.378] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.379] GetFileType (hFile=0x318) returned 0x1
	[0181.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.379] GetFileType (hFile=0x318) returned 0x1
	[0181.379] WriteFile (in: hFile=0x318, lpBuffer=0x277428c*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x277428c*, lpNumberOfBytesWritten=0x540ef94*=0x910, lpOverlapped=0x0) returned 1
	[0181.380] CloseHandle (hObject=0x318) returned 1
	[0181.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa0
	[0181.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.380] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa66fb03a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x910)) returned 1
	[0181.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.380] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.383] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.383] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2775740 | out: lpFileInformation=0x2775740*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f405fa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f405fa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcec)) returned 1
	[0181.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.383] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.384] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.384] GetFileType (hFile=0x318) returned 0x1
	[0181.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.384] GetFileType (hFile=0x318) returned 0x1
	[0181.384] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0xcec
	[0181.384] ReadFile (in: hFile=0x318, lpBuffer=0x2776768, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2776768*, lpNumberOfBytesRead=0x540efcc*=0xcec, lpOverlapped=0x0) returned 1
	[0181.414] CloseHandle (hObject=0x318) returned 1
	[0181.414] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0181.414] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.414] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2777804, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0181.414] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.414] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.415] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0181.415] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.415] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27778bc*=0x1, dwFlags=0x0) returned 1
	[0181.415] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2777888, dwFlags=0x0) returned 1
	[0181.415] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27778cc*, pdwDataLen=0x540efd4*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x27778cc*, pdwDataLen=0x540efd4*=0xcf0) returned 1
	[0181.415] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27785c8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27785c8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.415] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0181.415] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.415] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.415] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.416] GetFileType (hFile=0x318) returned 0x1
	[0181.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.416] GetFileType (hFile=0x318) returned 0x1
	[0181.416] WriteFile (in: hFile=0x318, lpBuffer=0x277876c*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x277876c*, lpNumberOfBytesWritten=0x540ef94*=0xcf0, lpOverlapped=0x0) returned 1
	[0181.417] CloseHandle (hObject=0x318) returned 1
	[0181.417] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.418] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa0
	[0181.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.418] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f405fa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f405fa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa676d703, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xcf0)) returned 1
	[0181.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.418] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.419] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2779c20 | out: lpFileInformation=0x2779c20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x716)) returned 1
	[0181.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.419] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.419] GetFileType (hFile=0x318) returned 0x1
	[0181.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.420] GetFileType (hFile=0x318) returned 0x1
	[0181.420] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x716
	[0181.420] ReadFile (in: hFile=0x318, lpBuffer=0x277a674, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x277a674*, lpNumberOfBytesRead=0x540efcc*=0x716, lpOverlapped=0x0) returned 1
	[0181.517] CloseHandle (hObject=0x318) returned 1
	[0181.518] CryptDestroyKey (hKey=0x82b100) returned 1
	[0181.518] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.518] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277b710, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0181.518] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.518] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.518] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0181.518] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.518] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x277b7c8*=0x1, dwFlags=0x0) returned 1
	[0181.518] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x277b794, dwFlags=0x0) returned 1
	[0181.518] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277b7d8*, pdwDataLen=0x540efd4*=0x720, dwBufLen=0x720 | out: pbData=0x277b7d8*, pdwDataLen=0x540efd4*=0x720) returned 1
	[0181.518] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277bf04*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x277bf04*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.518] CryptDestroyKey (hKey=0x82b100) returned 1
	[0181.518] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.518] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.518] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.518] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.520] GetFileType (hFile=0x318) returned 0x1
	[0181.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.520] GetFileType (hFile=0x318) returned 0x1
	[0181.520] WriteFile (in: hFile=0x318, lpBuffer=0x277c0a8*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x277c0a8*, lpNumberOfBytesWritten=0x540ef94*=0x720, lpOverlapped=0x0) returned 1
	[0181.521] CloseHandle (hObject=0x318) returned 1
	[0181.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa0
	[0181.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.521] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa685251e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x720)) returned 1
	[0181.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.521] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.522] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.522] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml"), fInfoLevelId=0x0, lpFileInformation=0x277d55c | out: lpFileInformation=0x277d55c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ecd6b4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ecd6b4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ecd6b4, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cf)) returned 1
	[0181.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.523] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.523] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.523] GetFileType (hFile=0x318) returned 0x1
	[0181.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.523] GetFileType (hFile=0x318) returned 0x1
	[0181.523] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cf
	[0181.523] ReadFile (in: hFile=0x318, lpBuffer=0x277dae8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x277dae8*, lpNumberOfBytesRead=0x540efcc*=0x1cf, lpOverlapped=0x0) returned 1
	[0181.524] CloseHandle (hObject=0x318) returned 1
	[0181.524] CryptDestroyKey (hKey=0x82b300) returned 1
	[0181.524] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.524] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277eb84, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0181.524] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.524] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.525] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0181.525] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.525] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x277ec3c*=0x1, dwFlags=0x0) returned 1
	[0181.525] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x277ec08, dwFlags=0x0) returned 1
	[0181.525] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277ec4c*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x277ec4c*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0181.525] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277ee28*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x277ee28*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.525] CryptDestroyKey (hKey=0x82b340) returned 1
	[0181.525] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.525] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.525] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.525] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.526] GetFileType (hFile=0x318) returned 0x1
	[0181.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.526] GetFileType (hFile=0x318) returned 0x1
	[0181.526] WriteFile (in: hFile=0x318, lpBuffer=0x277f00c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x277f00c*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0181.527] CloseHandle (hObject=0x318) returned 1
	[0181.528] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.528] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb0
	[0181.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.528] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ecd6b4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ecd6b4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa68787a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0181.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.528] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.529] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.529] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2780540 | out: lpFileInformation=0x2780540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x21b)) returned 1
	[0181.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.529] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.529] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.529] GetFileType (hFile=0x318) returned 0x1
	[0181.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.530] GetFileType (hFile=0x318) returned 0x1
	[0181.530] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x21b
	[0181.530] ReadFile (in: hFile=0x318, lpBuffer=0x2780b18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2780b18*, lpNumberOfBytesRead=0x540efcc*=0x21b, lpOverlapped=0x0) returned 1
	[0181.531] CloseHandle (hObject=0x318) returned 1
	[0181.531] CryptDestroyKey (hKey=0x82b100) returned 1
	[0181.531] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.531] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2781bb4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0181.531] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.531] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.531] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0181.531] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.531] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2781c6c*=0x1, dwFlags=0x0) returned 1
	[0181.531] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2781c38, dwFlags=0x0) returned 1
	[0181.531] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2781c7c*, pdwDataLen=0x540efd4*=0x220, dwBufLen=0x220 | out: pbData=0x2781c7c*, pdwDataLen=0x540efd4*=0x220) returned 1
	[0181.531] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2781ea8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2781ea8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.531] CryptDestroyKey (hKey=0x82b040) returned 1
	[0181.532] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.532] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.532] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.532] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.534] GetFileType (hFile=0x318) returned 0x1
	[0181.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.534] GetFileType (hFile=0x318) returned 0x1
	[0181.534] WriteFile (in: hFile=0x318, lpBuffer=0x278208c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x278208c*, lpNumberOfBytesWritten=0x540ef94*=0x220, lpOverlapped=0x0) returned 1
	[0181.535] CloseHandle (hObject=0x318) returned 1
	[0181.535] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.535] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb0
	[0181.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.536] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa68787a4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x220)) returned 1
	[0181.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.536] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.536] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.537] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27835c0 | out: lpFileInformation=0x27835c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x670)) returned 1
	[0181.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.610] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.610] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.610] GetFileType (hFile=0x318) returned 0x1
	[0181.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.610] GetFileType (hFile=0x318) returned 0x1
	[0181.610] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x670
	[0181.610] ReadFile (in: hFile=0x318, lpBuffer=0x2783fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2783fec*, lpNumberOfBytesRead=0x540efcc*=0x670, lpOverlapped=0x0) returned 1
	[0181.666] CloseHandle (hObject=0x318) returned 1
	[0181.666] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0181.666] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.666] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2785088, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0181.666] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.666] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.666] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0181.666] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.666] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2785140*=0x1, dwFlags=0x0) returned 1
	[0181.666] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x278510c, dwFlags=0x0) returned 1
	[0181.666] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2785150*, pdwDataLen=0x540efd4*=0x680, dwBufLen=0x680 | out: pbData=0x2785150*, pdwDataLen=0x540efd4*=0x680) returned 1
	[0181.667] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27857dc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27857dc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.667] CryptDestroyKey (hKey=0x82b000) returned 1
	[0181.667] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.667] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.667] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.668] GetFileType (hFile=0x318) returned 0x1
	[0181.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.668] GetFileType (hFile=0x318) returned 0x1
	[0181.668] WriteFile (in: hFile=0x318, lpBuffer=0x27859c0*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27859c0*, lpNumberOfBytesWritten=0x540ef94*=0x680, lpOverlapped=0x0) returned 1
	[0181.669] CloseHandle (hObject=0x318) returned 1
	[0181.669] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.669] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb0
	[0181.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.670] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa69cfc4f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x680)) returned 1
	[0181.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.670] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.670] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.671] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2786ef4 | out: lpFileInformation=0x2786ef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fdcb85, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fdcb85, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fdcb85, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1bae)) returned 1
	[0181.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.672] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.672] GetFileType (hFile=0x318) returned 0x1
	[0181.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.672] GetFileType (hFile=0x318) returned 0x1
	[0181.672] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1bae
	[0181.672] ReadFile (in: hFile=0x318, lpBuffer=0x27872a4, nNumberOfBytesToRead=0x1bae, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27872a4*, lpNumberOfBytesRead=0x540efcc*=0x1bae, lpOverlapped=0x0) returned 1
	[0181.687] CloseHandle (hObject=0x318) returned 1
	[0181.687] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0181.687] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.687] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2788ef0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0181.687] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.687] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.687] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0181.687] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.687] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2788fa8*=0x1, dwFlags=0x0) returned 1
	[0181.687] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2788f74, dwFlags=0x0) returned 1
	[0181.688] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2788fb8*, pdwDataLen=0x540efd4*=0x1bb0, dwBufLen=0x1bb0 | out: pbData=0x2788fb8*, pdwDataLen=0x540efd4*=0x1bb0) returned 1
	[0181.688] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278ab74*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x278ab74*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.688] CryptDestroyKey (hKey=0x82b280) returned 1
	[0181.688] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.688] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.688] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.688] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.689] GetFileType (hFile=0x318) returned 0x1
	[0181.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.689] GetFileType (hFile=0x318) returned 0x1
	[0181.689] WriteFile (in: hFile=0x318, lpBuffer=0x2788fb8*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x540efc0, lpOverlapped=0x0 | out: lpBuffer=0x2788fb8*, lpNumberOfBytesWritten=0x540efc0*=0x1bb0, lpOverlapped=0x0) returned 1
	[0181.690] CloseHandle (hObject=0x318) returned 1
	[0181.690] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.690] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb0
	[0181.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.690] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fdcb85, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fdcb85, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa69f5e54, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1bb0)) returned 1
	[0181.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.690] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.691] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.691] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278b280 | out: lpFileInformation=0x278b280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1ea40, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1ea40, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x710)) returned 1
	[0181.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.691] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.691] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.692] GetFileType (hFile=0x318) returned 0x1
	[0181.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.692] GetFileType (hFile=0x318) returned 0x1
	[0181.692] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x710
	[0181.692] ReadFile (in: hFile=0x318, lpBuffer=0x278bccc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x278bccc*, lpNumberOfBytesRead=0x540efcc*=0x710, lpOverlapped=0x0) returned 1
	[0181.693] CloseHandle (hObject=0x318) returned 1
	[0181.693] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0181.693] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.693] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278cd68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0181.693] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.693] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.693] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0181.693] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.693] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x278ce20*=0x1, dwFlags=0x0) returned 1
	[0181.693] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x278cdec, dwFlags=0x0) returned 1
	[0181.694] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278ce30*, pdwDataLen=0x540efd4*=0x720, dwBufLen=0x720 | out: pbData=0x278ce30*, pdwDataLen=0x540efd4*=0x720) returned 1
	[0181.694] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278d55c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x278d55c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.694] CryptDestroyKey (hKey=0x82b440) returned 1
	[0181.694] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.694] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.694] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.694] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.695] GetFileType (hFile=0x318) returned 0x1
	[0181.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.695] GetFileType (hFile=0x318) returned 0x1
	[0181.695] WriteFile (in: hFile=0x318, lpBuffer=0x278d700*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x278d700*, lpNumberOfBytesWritten=0x540ef94*=0x720, lpOverlapped=0x0) returned 1
	[0181.696] CloseHandle (hObject=0x318) returned 1
	[0181.696] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml", lpFilePart=0x0) returned 0x71
	[0181.696] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa0
	[0181.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.696] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1ea40, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1ea40, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa6a1c03a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x720)) returned 1
	[0181.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.696] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.697] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.697] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278ebb4 | out: lpFileInformation=0x278ebb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x663)) returned 1
	[0181.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.697] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.697] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.698] GetFileType (hFile=0x318) returned 0x1
	[0181.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.698] GetFileType (hFile=0x318) returned 0x1
	[0181.698] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x663
	[0181.698] ReadFile (in: hFile=0x318, lpBuffer=0x278f5d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x278f5d4*, lpNumberOfBytesRead=0x540efcc*=0x663, lpOverlapped=0x0) returned 1
	[0181.720] CloseHandle (hObject=0x318) returned 1
	[0181.720] CryptDestroyKey (hKey=0x82b080) returned 1
	[0181.720] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.720] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2790670, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0181.721] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.721] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.721] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0181.721] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.721] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2790728*=0x1, dwFlags=0x0) returned 1
	[0181.721] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x27906f4, dwFlags=0x0) returned 1
	[0181.721] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2790738*, pdwDataLen=0x540efd4*=0x670, dwBufLen=0x670 | out: pbData=0x2790738*, pdwDataLen=0x540efd4*=0x670) returned 1
	[0181.721] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2790db4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2790db4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.721] CryptDestroyKey (hKey=0x82b200) returned 1
	[0181.721] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.721] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.721] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.722] GetFileType (hFile=0x318) returned 0x1
	[0181.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.723] GetFileType (hFile=0x318) returned 0x1
	[0181.723] WriteFile (in: hFile=0x318, lpBuffer=0x2790f98*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2790f98*, lpNumberOfBytesWritten=0x540ef94*=0x670, lpOverlapped=0x0) returned 1
	[0181.724] CloseHandle (hObject=0x318) returned 1
	[0181.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb0
	[0181.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.724] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa6a42353, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x670)) returned 1
	[0181.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.724] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.725] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27924cc | out: lpFileInformation=0x27924cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f7b887, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f7b887, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f7b887, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x2a5)) returned 1
	[0181.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.726] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.726] GetFileType (hFile=0x318) returned 0x1
	[0181.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.726] GetFileType (hFile=0x318) returned 0x1
	[0181.726] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2a5
	[0181.726] ReadFile (in: hFile=0x318, lpBuffer=0x2792b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2792b30*, lpNumberOfBytesRead=0x540efcc*=0x2a5, lpOverlapped=0x0) returned 1
	[0181.728] CloseHandle (hObject=0x318) returned 1
	[0181.728] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0181.728] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.728] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2793bcc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0181.728] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.728] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.728] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0181.728] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.728] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2793c84*=0x1, dwFlags=0x0) returned 1
	[0181.728] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2793c50, dwFlags=0x0) returned 1
	[0181.728] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2793c94*, pdwDataLen=0x540efd4*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x2793c94*, pdwDataLen=0x540efd4*=0x2b0) returned 1
	[0181.728] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2793f50*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2793f50*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.729] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0181.729] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.729] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.729] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.730] GetFileType (hFile=0x318) returned 0x1
	[0181.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.730] GetFileType (hFile=0x318) returned 0x1
	[0181.730] WriteFile (in: hFile=0x318, lpBuffer=0x2794134*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2794134*, lpNumberOfBytesWritten=0x540ef94*=0x2b0, lpOverlapped=0x0) returned 1
	[0181.731] CloseHandle (hObject=0x318) returned 1
	[0181.731] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpFilePart=0x0) returned 0x81
	[0181.731] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb0
	[0181.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.731] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f7b887, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f7b887, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0xa6a68533, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2b0)) returned 1
	[0181.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.731] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.732] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0181.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.732] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2795668 | out: lpFileInformation=0x2795668*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900a4472, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900a4472, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd)) returned 1
	[0181.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.733] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0181.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.733] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.733] GetFileType (hFile=0x318) returned 0x1
	[0181.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.733] GetFileType (hFile=0x318) returned 0x1
	[0181.733] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2dd
	[0181.733] ReadFile (in: hFile=0x318, lpBuffer=0x2795e94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2795e94*, lpNumberOfBytesRead=0x540efcc*=0x2dd, lpOverlapped=0x0) returned 1
	[0181.736] CloseHandle (hObject=0x318) returned 1
	[0181.736] CryptDestroyKey (hKey=0x82b280) returned 1
	[0181.736] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.736] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2796f30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0181.736] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.736] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.736] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0181.736] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.736] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2796fe8*=0x1, dwFlags=0x0) returned 1
	[0181.736] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2796fb4, dwFlags=0x0) returned 1
	[0181.736] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2796ff8*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2796ff8*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0181.736] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27972e4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27972e4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.736] CryptDestroyKey (hKey=0x82b200) returned 1
	[0181.737] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.737] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.737] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0181.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.737] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.738] GetFileType (hFile=0x318) returned 0x1
	[0181.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.738] GetFileType (hFile=0x318) returned 0x1
	[0181.738] WriteFile (in: hFile=0x318, lpBuffer=0x2797590*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2797590*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0181.739] CloseHandle (hObject=0x318) returned 1
	[0181.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0181.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe1
	[0181.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.739] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900a4472, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900a4472, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa6a68533, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0181.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.740] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0181.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.741] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2798c48 | out: lpFileInformation=0x2798c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x292)) returned 1
	[0181.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0181.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.742] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.742] GetFileType (hFile=0x318) returned 0x1
	[0181.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.742] GetFileType (hFile=0x318) returned 0x1
	[0181.742] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x292
	[0181.742] ReadFile (in: hFile=0x318, lpBuffer=0x2799388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2799388*, lpNumberOfBytesRead=0x540efcc*=0x292, lpOverlapped=0x0) returned 1
	[0181.762] CloseHandle (hObject=0x318) returned 1
	[0181.762] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0181.762] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.762] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279a424, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0181.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.762] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0181.763] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.763] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x279a4dc*=0x1, dwFlags=0x0) returned 1
	[0181.763] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x279a4a8, dwFlags=0x0) returned 1
	[0181.763] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279a4ec*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x279a4ec*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0181.763] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279a798*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x279a798*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.763] CryptDestroyKey (hKey=0x82b200) returned 1
	[0181.763] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.763] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.763] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0181.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.763] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.764] GetFileType (hFile=0x318) returned 0x1
	[0181.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.765] GetFileType (hFile=0x318) returned 0x1
	[0181.765] WriteFile (in: hFile=0x318, lpBuffer=0x279a9f4*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x279a9f4*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0181.766] CloseHandle (hObject=0x318) returned 1
	[0181.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0181.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0181.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.766] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa6ab4a7c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0181.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.766] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.777] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0181.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.777] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x279c00c | out: lpFileInformation=0x279c00c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d2)) returned 1
	[0181.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.780] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0181.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.780] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.780] GetFileType (hFile=0x318) returned 0x1
	[0181.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.780] GetFileType (hFile=0x318) returned 0x1
	[0181.780] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1d2
	[0181.780] ReadFile (in: hFile=0x318, lpBuffer=0x279c60c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x279c60c*, lpNumberOfBytesRead=0x540efcc*=0x1d2, lpOverlapped=0x0) returned 1
	[0181.782] CloseHandle (hObject=0x318) returned 1
	[0181.782] CryptDestroyKey (hKey=0x82b040) returned 1
	[0181.782] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.782] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279d6a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0181.782] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.782] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.782] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0181.782] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0181.782] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x279d760*=0x1, dwFlags=0x0) returned 1
	[0181.782] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x279d72c, dwFlags=0x0) returned 1
	[0181.782] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279d770*, pdwDataLen=0x540efd4*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x279d770*, pdwDataLen=0x540efd4*=0x1e0) returned 1
	[0181.782] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279d95c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x279d95c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0181.782] CryptDestroyKey (hKey=0x82b480) returned 1
	[0181.782] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.783] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0181.783] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0181.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0181.783] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.784] GetFileType (hFile=0x318) returned 0x1
	[0181.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0181.784] GetFileType (hFile=0x318) returned 0x1
	[0181.784] WriteFile (in: hFile=0x318, lpBuffer=0x279db78*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x279db78*, lpNumberOfBytesWritten=0x540ef94*=0x1e0, lpOverlapped=0x0) returned 1
	[0181.785] CloseHandle (hObject=0x318) returned 1
	[0181.785] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0181.785] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0181.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0181.785] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa6adacb8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0181.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0181.786] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.813] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0181.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0181.814] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x279f11c | out: lpFileInformation=0x279f11c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a)) returned 1
	[0181.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0181.814] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0181.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0181.814] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0181.814] GetFileType (hFile=0x318) returned 0x1
	[0181.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0181.814] GetFileType (hFile=0x318) returned 0x1
	[0181.814] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x28a
	[0181.815] ReadFile (in: hFile=0x318, lpBuffer=0x279f894, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x279f894*, lpNumberOfBytesRead=0x540efcc*=0x28a, lpOverlapped=0x0) returned 1
	[0182.127] CloseHandle (hObject=0x318) returned 1
	[0182.127] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0182.127] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.127] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a0930, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0182.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.128] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0182.128] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.128] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27a09e8*=0x1, dwFlags=0x0) returned 1
	[0182.128] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x27a09b4, dwFlags=0x0) returned 1
	[0182.128] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a09f8*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x27a09f8*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0182.128] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a0c94*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a0c94*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.128] CryptDestroyKey (hKey=0x82b080) returned 1
	[0182.128] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.128] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.128] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0182.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.128] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.129] GetFileType (hFile=0x318) returned 0x1
	[0182.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.129] GetFileType (hFile=0x318) returned 0x1
	[0182.129] WriteFile (in: hFile=0x318, lpBuffer=0x27a0f10*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27a0f10*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0182.130] CloseHandle (hObject=0x318) returned 1
	[0182.130] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0182.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0182.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.131] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa6e45f7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0182.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.131] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.132] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0182.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.132] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a2568 | out: lpFileInformation=0x27a2568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29e)) returned 1
	[0182.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.132] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0182.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.132] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.132] GetFileType (hFile=0x318) returned 0x1
	[0182.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.132] GetFileType (hFile=0x318) returned 0x1
	[0182.132] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x29e
	[0182.133] ReadFile (in: hFile=0x318, lpBuffer=0x27a2cf4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a2cf4*, lpNumberOfBytesRead=0x540efcc*=0x29e, lpOverlapped=0x0) returned 1
	[0182.134] CloseHandle (hObject=0x318) returned 1
	[0182.134] CryptDestroyKey (hKey=0x82b540) returned 1
	[0182.134] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.134] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a3d90, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0182.134] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.134] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.134] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0182.134] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.134] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27a3e48*=0x1, dwFlags=0x0) returned 1
	[0182.134] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27a3e14, dwFlags=0x0) returned 1
	[0182.135] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a3e58*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x27a3e58*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0182.135] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a4104*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a4104*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.135] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0182.135] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.135] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.135] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0182.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.135] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.136] GetFileType (hFile=0x318) returned 0x1
	[0182.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.136] GetFileType (hFile=0x318) returned 0x1
	[0182.136] WriteFile (in: hFile=0x318, lpBuffer=0x27a4380*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27a4380*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0182.137] CloseHandle (hObject=0x318) returned 1
	[0182.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0182.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0182.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.137] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa6e45f7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0182.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.137] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.138] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0182.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.138] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a59d8 | out: lpFileInformation=0x27a59d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283)) returned 1
	[0182.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.138] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0182.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.138] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.138] GetFileType (hFile=0x318) returned 0x1
	[0182.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.139] GetFileType (hFile=0x318) returned 0x1
	[0182.139] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x283
	[0182.139] ReadFile (in: hFile=0x318, lpBuffer=0x27a6108, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a6108*, lpNumberOfBytesRead=0x540efcc*=0x283, lpOverlapped=0x0) returned 1
	[0182.140] CloseHandle (hObject=0x318) returned 1
	[0182.140] CryptDestroyKey (hKey=0x82b300) returned 1
	[0182.140] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.140] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a71a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0182.140] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.140] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.140] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0182.141] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.141] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27a725c*=0x1, dwFlags=0x0) returned 1
	[0182.141] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27a7228, dwFlags=0x0) returned 1
	[0182.141] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a726c*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x27a726c*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0182.141] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a7508*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a7508*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.141] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0182.141] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.141] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.141] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0182.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.141] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.142] GetFileType (hFile=0x318) returned 0x1
	[0182.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.142] GetFileType (hFile=0x318) returned 0x1
	[0182.142] WriteFile (in: hFile=0x318, lpBuffer=0x27a7764*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27a7764*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0182.143] CloseHandle (hObject=0x318) returned 1
	[0182.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0182.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0182.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.144] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa6e45f7b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0182.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.144] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0182.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.145] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a8d88 | out: lpFileInformation=0x27a8d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9)) returned 1
	[0182.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0182.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.146] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.146] GetFileType (hFile=0x318) returned 0x1
	[0182.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.146] GetFileType (hFile=0x318) returned 0x1
	[0182.146] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d9
	[0182.147] ReadFile (in: hFile=0x318, lpBuffer=0x27a9520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a9520*, lpNumberOfBytesRead=0x540efcc*=0x2d9, lpOverlapped=0x0) returned 1
	[0182.172] CloseHandle (hObject=0x318) returned 1
	[0182.172] CryptDestroyKey (hKey=0x82b300) returned 1
	[0182.172] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.172] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27aa5bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0182.172] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.172] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.172] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0182.172] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.172] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27aa674*=0x1, dwFlags=0x0) returned 1
	[0182.172] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27aa640, dwFlags=0x0) returned 1
	[0182.172] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27aa684*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27aa684*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0182.173] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27aa970*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27aa970*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.173] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0182.173] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.173] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.173] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0182.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.173] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.174] GetFileType (hFile=0x318) returned 0x1
	[0182.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.174] GetFileType (hFile=0x318) returned 0x1
	[0182.174] WriteFile (in: hFile=0x318, lpBuffer=0x27aabd4*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27aabd4*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0182.175] CloseHandle (hObject=0x318) returned 1
	[0182.175] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0182.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0182.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.176] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa6e925a1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0182.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.176] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.177] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0182.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.177] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ac1fc | out: lpFileInformation=0x27ac1fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0182.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0182.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.178] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.178] GetFileType (hFile=0x318) returned 0x1
	[0182.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.178] GetFileType (hFile=0x318) returned 0x1
	[0182.178] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2ca
	[0182.178] ReadFile (in: hFile=0x318, lpBuffer=0x27ac954, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27ac954*, lpNumberOfBytesRead=0x540efcc*=0x2ca, lpOverlapped=0x0) returned 1
	[0182.180] CloseHandle (hObject=0x318) returned 1
	[0182.180] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0182.180] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.180] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ad9f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0182.181] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.181] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.181] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0182.181] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.181] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27adaa8*=0x1, dwFlags=0x0) returned 1
	[0182.181] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27ada74, dwFlags=0x0) returned 1
	[0182.181] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27adab8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27adab8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0182.181] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27add94*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27add94*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.181] CryptDestroyKey (hKey=0x82b380) returned 1
	[0182.181] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.181] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.181] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0182.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.181] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.182] GetFileType (hFile=0x318) returned 0x1
	[0182.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.183] GetFileType (hFile=0x318) returned 0x1
	[0182.183] WriteFile (in: hFile=0x318, lpBuffer=0x27adfe0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27adfe0*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0182.184] CloseHandle (hObject=0x318) returned 1
	[0182.184] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0182.184] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0182.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.184] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa6eb8ae5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0182.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.184] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.185] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0182.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.185] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27af5e4 | out: lpFileInformation=0x27af5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0182.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.185] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0182.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.186] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.186] GetFileType (hFile=0x318) returned 0x1
	[0182.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.186] GetFileType (hFile=0x318) returned 0x1
	[0182.186] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x360
	[0182.186] ReadFile (in: hFile=0x318, lpBuffer=0x27afe10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27afe10*, lpNumberOfBytesRead=0x540efcc*=0x360, lpOverlapped=0x0) returned 1
	[0182.204] CloseHandle (hObject=0x318) returned 1
	[0182.204] CryptDestroyKey (hKey=0x82b340) returned 1
	[0182.204] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.204] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b0eac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0182.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.205] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0182.205] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.205] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x27b0f64*=0x1, dwFlags=0x0) returned 1
	[0182.205] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x27b0f30, dwFlags=0x0) returned 1
	[0182.205] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b0f74*, pdwDataLen=0x540efd4*=0x370, dwBufLen=0x370 | out: pbData=0x27b0f74*, pdwDataLen=0x540efd4*=0x370) returned 1
	[0182.205] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b12f0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b12f0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.205] CryptDestroyKey (hKey=0x82b200) returned 1
	[0182.205] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.205] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.205] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0182.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.205] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.206] GetFileType (hFile=0x318) returned 0x1
	[0182.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.206] GetFileType (hFile=0x318) returned 0x1
	[0182.206] WriteFile (in: hFile=0x318, lpBuffer=0x27b155c*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27b155c*, lpNumberOfBytesWritten=0x540ef94*=0x370, lpOverlapped=0x0) returned 1
	[0182.207] CloseHandle (hObject=0x318) returned 1
	[0182.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0182.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0182.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.207] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa6ede95b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1
	[0182.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.208] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0182.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.209] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b2b94 | out: lpFileInformation=0x27b2b94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0182.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0182.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.210] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.210] GetFileType (hFile=0x318) returned 0x1
	[0182.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.210] GetFileType (hFile=0x318) returned 0x1
	[0182.210] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1e0
	[0182.210] ReadFile (in: hFile=0x318, lpBuffer=0x27b31a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b31a0*, lpNumberOfBytesRead=0x540efcc*=0x1e0, lpOverlapped=0x0) returned 1
	[0182.211] CloseHandle (hObject=0x318) returned 1
	[0182.211] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0182.211] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.211] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b423c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0182.211] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.211] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.211] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0182.211] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.211] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27b42f4*=0x1, dwFlags=0x0) returned 1
	[0182.211] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27b42c0, dwFlags=0x0) returned 1
	[0182.212] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b4304*, pdwDataLen=0x540efd4*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x27b4304*, pdwDataLen=0x540efd4*=0x1f0) returned 1
	[0182.212] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b4500*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b4500*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.212] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0182.212] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.212] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.212] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0182.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.212] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.213] GetFileType (hFile=0x318) returned 0x1
	[0182.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.213] GetFileType (hFile=0x318) returned 0x1
	[0182.213] WriteFile (in: hFile=0x318, lpBuffer=0x27b471c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27b471c*, lpNumberOfBytesWritten=0x540ef94*=0x1f0, lpOverlapped=0x0) returned 1
	[0182.214] CloseHandle (hObject=0x318) returned 1
	[0182.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0182.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0182.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.214] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa6f04c17, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0182.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.215] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.216] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0182.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.216] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b5cc0 | out: lpFileInformation=0x27b5cc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0182.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0182.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.217] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.217] GetFileType (hFile=0x318) returned 0x1
	[0182.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.217] GetFileType (hFile=0x318) returned 0x1
	[0182.217] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cb
	[0182.217] ReadFile (in: hFile=0x318, lpBuffer=0x27b6448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b6448*, lpNumberOfBytesRead=0x540efcc*=0x2cb, lpOverlapped=0x0) returned 1
	[0182.219] CloseHandle (hObject=0x318) returned 1
	[0182.219] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0182.219] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.219] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b74e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0182.219] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.219] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.219] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0182.219] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.219] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27b759c*=0x1, dwFlags=0x0) returned 1
	[0182.219] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27b7568, dwFlags=0x0) returned 1
	[0182.219] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b75ac*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27b75ac*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0182.219] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b7888*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b7888*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.219] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0182.219] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.220] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.220] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0182.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.220] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.221] GetFileType (hFile=0x318) returned 0x1
	[0182.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.221] GetFileType (hFile=0x318) returned 0x1
	[0182.221] WriteFile (in: hFile=0x318, lpBuffer=0x27b7aec*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27b7aec*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0182.222] CloseHandle (hObject=0x318) returned 1
	[0182.222] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0182.222] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0182.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.222] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa6f04c17, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0182.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.223] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0182.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.224] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b9120 | out: lpFileInformation=0x27b9120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90116bb1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90116bb1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90116bb1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0182.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0182.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.224] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.224] GetFileType (hFile=0x318) returned 0x1
	[0182.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.224] GetFileType (hFile=0x318) returned 0x1
	[0182.224] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c9
	[0182.224] ReadFile (in: hFile=0x318, lpBuffer=0x27b9888, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b9888*, lpNumberOfBytesRead=0x540efcc*=0x2c9, lpOverlapped=0x0) returned 1
	[0182.315] CloseHandle (hObject=0x318) returned 1
	[0182.315] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0182.315] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.315] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ba924, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0182.316] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.316] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.316] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0182.316] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.316] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27ba9dc*=0x1, dwFlags=0x0) returned 1
	[0182.316] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27ba9a8, dwFlags=0x0) returned 1
	[0182.316] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ba9ec*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27ba9ec*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0182.316] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27bacc8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27bacc8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.316] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0182.316] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.316] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0182.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.316] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.318] GetFileType (hFile=0x318) returned 0x1
	[0182.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.318] GetFileType (hFile=0x318) returned 0x1
	[0182.318] WriteFile (in: hFile=0x318, lpBuffer=0x27baf1c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27baf1c*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0182.319] CloseHandle (hObject=0x318) returned 1
	[0182.319] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0182.319] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0182.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.319] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90116bb1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90116bb1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa70104ab, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0182.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.319] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0182.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.320] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27bc524 | out: lpFileInformation=0x27bc524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1)) returned 1
	[0182.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.321] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0182.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.321] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.321] GetFileType (hFile=0x318) returned 0x1
	[0182.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.321] GetFileType (hFile=0x318) returned 0x1
	[0182.321] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c1
	[0182.321] ReadFile (in: hFile=0x318, lpBuffer=0x27bcc94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27bcc94*, lpNumberOfBytesRead=0x540efcc*=0x2c1, lpOverlapped=0x0) returned 1
	[0182.323] CloseHandle (hObject=0x318) returned 1
	[0182.323] CryptDestroyKey (hKey=0x82b480) returned 1
	[0182.323] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.323] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27bdd30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0182.323] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.323] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.323] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0182.323] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.323] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27bdde8*=0x1, dwFlags=0x0) returned 1
	[0182.323] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27bddb4, dwFlags=0x0) returned 1
	[0182.323] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27bddf8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27bddf8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0182.323] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27be0d4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27be0d4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.324] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0182.324] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.324] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.324] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0182.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.324] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.325] GetFileType (hFile=0x318) returned 0x1
	[0182.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.325] GetFileType (hFile=0x318) returned 0x1
	[0182.325] WriteFile (in: hFile=0x318, lpBuffer=0x27be330*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27be330*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0182.326] CloseHandle (hObject=0x318) returned 1
	[0182.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0182.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0182.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.326] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa70104ab, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0182.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.326] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.327] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0182.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.328] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27bf954 | out: lpFileInformation=0x27bf954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0182.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.328] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0182.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.328] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.328] GetFileType (hFile=0x318) returned 0x1
	[0182.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.328] GetFileType (hFile=0x318) returned 0x1
	[0182.328] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x290
	[0182.328] ReadFile (in: hFile=0x318, lpBuffer=0x27c0090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c0090*, lpNumberOfBytesRead=0x540efcc*=0x290, lpOverlapped=0x0) returned 1
	[0182.349] CloseHandle (hObject=0x318) returned 1
	[0182.349] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0182.349] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.349] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c112c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0182.349] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.349] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.349] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0182.349] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.349] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27c11e4*=0x1, dwFlags=0x0) returned 1
	[0182.349] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27c11b0, dwFlags=0x0) returned 1
	[0182.349] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c11f4*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x27c11f4*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0182.349] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c14a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c14a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.349] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0182.349] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.349] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.349] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0182.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.349] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.351] GetFileType (hFile=0x318) returned 0x1
	[0182.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.351] GetFileType (hFile=0x318) returned 0x1
	[0182.351] WriteFile (in: hFile=0x318, lpBuffer=0x27c16fc*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27c16fc*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0182.352] CloseHandle (hObject=0x318) returned 1
	[0182.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0182.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0182.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.352] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa705c172, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0182.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.352] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.353] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0182.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.353] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c2d20 | out: lpFileInformation=0x27c2d20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db)) returned 1
	[0182.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.359] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0182.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.359] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.359] GetFileType (hFile=0x318) returned 0x1
	[0182.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.359] GetFileType (hFile=0x318) returned 0x1
	[0182.359] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2db
	[0182.359] ReadFile (in: hFile=0x318, lpBuffer=0x27c34d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c34d8*, lpNumberOfBytesRead=0x540efcc*=0x2db, lpOverlapped=0x0) returned 1
	[0182.370] CloseHandle (hObject=0x318) returned 1
	[0182.370] CryptDestroyKey (hKey=0x82b480) returned 1
	[0182.370] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.370] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c4574, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0182.370] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.370] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.370] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0182.370] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.370] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x27c462c*=0x1, dwFlags=0x0) returned 1
	[0182.371] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x27c45f8, dwFlags=0x0) returned 1
	[0182.371] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c463c*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27c463c*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0182.371] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c4928*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c4928*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.371] CryptDestroyKey (hKey=0x82b000) returned 1
	[0182.371] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.371] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.371] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0182.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.371] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.372] GetFileType (hFile=0x318) returned 0x1
	[0182.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.372] GetFileType (hFile=0x318) returned 0x1
	[0182.372] WriteFile (in: hFile=0x318, lpBuffer=0x27c4b9c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27c4b9c*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0182.373] CloseHandle (hObject=0x318) returned 1
	[0182.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0182.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0182.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.373] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa70822fa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0182.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.374] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0182.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.374] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c61e4 | out: lpFileInformation=0x27c61e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0182.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.375] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0182.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.375] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.375] GetFileType (hFile=0x318) returned 0x1
	[0182.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.375] GetFileType (hFile=0x318) returned 0x1
	[0182.375] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cb
	[0182.375] ReadFile (in: hFile=0x318, lpBuffer=0x27c695c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c695c*, lpNumberOfBytesRead=0x540efcc*=0x2cb, lpOverlapped=0x0) returned 1
	[0182.377] CloseHandle (hObject=0x318) returned 1
	[0182.377] CryptDestroyKey (hKey=0x82b540) returned 1
	[0182.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.377] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c79f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0182.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.377] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0182.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.377] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x27c7ab0*=0x1, dwFlags=0x0) returned 1
	[0182.377] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x27c7a7c, dwFlags=0x0) returned 1
	[0182.377] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c7ac0*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27c7ac0*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0182.377] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c7d9c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c7d9c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.377] CryptDestroyKey (hKey=0x82b040) returned 1
	[0182.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.378] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0182.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.378] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.379] GetFileType (hFile=0x318) returned 0x1
	[0182.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.379] GetFileType (hFile=0x318) returned 0x1
	[0182.379] WriteFile (in: hFile=0x318, lpBuffer=0x27c7ff8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27c7ff8*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0182.380] CloseHandle (hObject=0x318) returned 1
	[0182.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0182.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0182.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.380] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa70a84e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0182.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.380] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0182.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.381] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c9610 | out: lpFileInformation=0x27c9610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28c)) returned 1
	[0182.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.382] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0182.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.382] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.382] GetFileType (hFile=0x318) returned 0x1
	[0182.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.382] GetFileType (hFile=0x318) returned 0x1
	[0182.382] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x28c
	[0182.382] ReadFile (in: hFile=0x318, lpBuffer=0x27c9d48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c9d48*, lpNumberOfBytesRead=0x540efcc*=0x28c, lpOverlapped=0x0) returned 1
	[0182.386] CloseHandle (hObject=0x318) returned 1
	[0182.386] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0182.386] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.386] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27cade4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0182.386] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.386] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.386] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0182.386] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.386] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27cae9c*=0x1, dwFlags=0x0) returned 1
	[0182.386] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27cae68, dwFlags=0x0) returned 1
	[0182.386] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27caeac*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x27caeac*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0182.386] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb148*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27cb148*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.386] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0182.386] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.386] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0182.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.386] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.387] GetFileType (hFile=0x318) returned 0x1
	[0182.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.387] GetFileType (hFile=0x318) returned 0x1
	[0182.388] WriteFile (in: hFile=0x318, lpBuffer=0x27cb3a4*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27cb3a4*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0182.388] CloseHandle (hObject=0x318) returned 1
	[0182.388] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0182.388] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0182.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.389] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa70a84e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0182.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.389] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0182.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.390] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27cc9bc | out: lpFileInformation=0x27cc9bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0182.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.390] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0182.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.390] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.390] GetFileType (hFile=0x318) returned 0x1
	[0182.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.390] GetFileType (hFile=0x318) returned 0x1
	[0182.390] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cd
	[0182.390] ReadFile (in: hFile=0x318, lpBuffer=0x27cd158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27cd158*, lpNumberOfBytesRead=0x540efcc*=0x2cd, lpOverlapped=0x0) returned 1
	[0182.465] CloseHandle (hObject=0x318) returned 1
	[0182.465] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0182.465] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.465] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ce1f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0182.465] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.465] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.465] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0182.465] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.466] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27ce2ac*=0x1, dwFlags=0x0) returned 1
	[0182.466] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27ce278, dwFlags=0x0) returned 1
	[0182.466] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ce2bc*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27ce2bc*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0182.466] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ce598*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27ce598*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.466] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0182.466] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.466] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0182.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.466] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.467] GetFileType (hFile=0x318) returned 0x1
	[0182.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.467] GetFileType (hFile=0x318) returned 0x1
	[0182.467] WriteFile (in: hFile=0x318, lpBuffer=0x27ce804*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27ce804*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0182.468] CloseHandle (hObject=0x318) returned 1
	[0182.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0182.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd2
	[0182.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.469] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7167079, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0182.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.469] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.470] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0182.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.470] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27cfe48 | out: lpFileInformation=0x27cfe48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286)) returned 1
	[0182.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0182.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0182.471] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.471] GetFileType (hFile=0x318) returned 0x1
	[0182.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0182.471] GetFileType (hFile=0x318) returned 0x1
	[0182.471] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x286
	[0182.471] ReadFile (in: hFile=0x318, lpBuffer=0x27d054c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27d054c*, lpNumberOfBytesRead=0x540efcc*=0x286, lpOverlapped=0x0) returned 1
	[0182.566] CloseHandle (hObject=0x318) returned 1
	[0182.566] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0182.566] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.566] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d15e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0182.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.566] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0182.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.566] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27d16a0*=0x1, dwFlags=0x0) returned 1
	[0182.566] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27d166c, dwFlags=0x0) returned 1
	[0182.566] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d16b0*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x27d16b0*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0182.566] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d194c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27d194c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0182.566] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0182.566] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.566] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.566] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0182.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0182.566] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.568] GetFileType (hFile=0x318) returned 0x1
	[0182.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0182.568] GetFileType (hFile=0x318) returned 0x1
	[0182.568] WriteFile (in: hFile=0x318, lpBuffer=0x27d1b90*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27d1b90*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0182.568] CloseHandle (hObject=0x318) returned 1
	[0182.569] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0182.569] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0182.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0182.569] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7272097, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0182.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0182.569] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.570] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0182.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0182.570] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d3184 | out: lpFileInformation=0x27d3184*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0182.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0182.931] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.945] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.946] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.968] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.976] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.983] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.010] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.023] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.027] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.045] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.106] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.128] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.130] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.202] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.261] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.322] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.398] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.460] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.472] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.478] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.511] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.512] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.787] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.004] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.057] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.102] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.149] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.179] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.180] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.242] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.305] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.779] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.994] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.043] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.070] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.130] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.182] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.238] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.260] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.284] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.331] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.332] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.332] GetFileType (hFile=0x318) returned 0x1
	[0185.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.332] GetFileType (hFile=0x318) returned 0x1
	[0185.332] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2e8
	[0185.332] ReadFile (in: hFile=0x318, lpBuffer=0x261a740, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x261a740*, lpNumberOfBytesRead=0x540efcc*=0x2e8, lpOverlapped=0x0) returned 1
	[0185.333] CloseHandle (hObject=0x318) returned 1
	[0185.333] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0185.333] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.333] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261b7dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0185.333] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.333] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.333] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0185.334] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.334] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x261b894*=0x1, dwFlags=0x0) returned 1
	[0185.334] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x261b860, dwFlags=0x0) returned 1
	[0185.334] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261b8a4*, pdwDataLen=0x540efd4*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x261b8a4*, pdwDataLen=0x540efd4*=0x2f0) returned 1
	[0185.334] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261bba0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x261bba0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.334] CryptDestroyKey (hKey=0x82b400) returned 1
	[0185.334] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.334] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.334] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.334] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.335] GetFileType (hFile=0x318) returned 0x1
	[0185.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.335] GetFileType (hFile=0x318) returned 0x1
	[0185.335] WriteFile (in: hFile=0x318, lpBuffer=0x261be04*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x261be04*, lpNumberOfBytesWritten=0x540ef94*=0x2f0, lpOverlapped=0x0) returned 1
	[0185.336] CloseHandle (hObject=0x318) returned 1
	[0185.336] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.336] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0185.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.336] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8cb6cfc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0185.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.336] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.337] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.380] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x261d438 | out: lpFileInformation=0x261d438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0185.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.380] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.380] GetFileType (hFile=0x318) returned 0x1
	[0185.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.380] GetFileType (hFile=0x318) returned 0x1
	[0185.381] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d3
	[0185.381] ReadFile (in: hFile=0x318, lpBuffer=0x261dbc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x261dbc8*, lpNumberOfBytesRead=0x540efcc*=0x2d3, lpOverlapped=0x0) returned 1
	[0185.407] CloseHandle (hObject=0x318) returned 1
	[0185.407] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.407] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.407] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261ec64, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0185.407] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.407] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.407] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0185.407] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.407] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x261ed1c*=0x1, dwFlags=0x0) returned 1
	[0185.408] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x261ece8, dwFlags=0x0) returned 1
	[0185.408] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261ed2c*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x261ed2c*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0185.408] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261f018*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x261f018*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.408] CryptDestroyKey (hKey=0x82b300) returned 1
	[0185.408] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.408] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.408] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.408] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.409] GetFileType (hFile=0x318) returned 0x1
	[0185.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.409] GetFileType (hFile=0x318) returned 0x1
	[0185.409] WriteFile (in: hFile=0x318, lpBuffer=0x261f27c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x261f27c*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.411] CloseHandle (hObject=0x318) returned 1
	[0185.411] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.411] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0185.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.411] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8d7587d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.411] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.412] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.413] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26208b0 | out: lpFileInformation=0x26208b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc)) returned 1
	[0185.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.413] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.413] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.413] GetFileType (hFile=0x318) returned 0x1
	[0185.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.413] GetFileType (hFile=0x318) returned 0x1
	[0185.413] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2dc
	[0185.413] ReadFile (in: hFile=0x318, lpBuffer=0x2621048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2621048*, lpNumberOfBytesRead=0x540efcc*=0x2dc, lpOverlapped=0x0) returned 1
	[0185.467] CloseHandle (hObject=0x318) returned 1
	[0185.467] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0185.467] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.468] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26220e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0185.468] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.468] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.468] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0185.468] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.468] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x262219c*=0x1, dwFlags=0x0) returned 1
	[0185.468] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2622168, dwFlags=0x0) returned 1
	[0185.468] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26221ac*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26221ac*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0185.468] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2622498*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2622498*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.468] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0185.468] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.468] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.469] GetFileType (hFile=0x318) returned 0x1
	[0185.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.469] GetFileType (hFile=0x318) returned 0x1
	[0185.469] WriteFile (in: hFile=0x318, lpBuffer=0x26226fc*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26226fc*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.470] CloseHandle (hObject=0x318) returned 1
	[0185.470] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.470] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0185.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.470] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8e0e196, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.470] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.471] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2623d30 | out: lpFileInformation=0x2623d30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2df)) returned 1
	[0185.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.472] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.472] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.472] GetFileType (hFile=0x318) returned 0x1
	[0185.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.472] GetFileType (hFile=0x318) returned 0x1
	[0185.472] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2df
	[0185.472] ReadFile (in: hFile=0x318, lpBuffer=0x26244cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26244cc*, lpNumberOfBytesRead=0x540efcc*=0x2df, lpOverlapped=0x0) returned 1
	[0185.485] CloseHandle (hObject=0x318) returned 1
	[0185.485] CryptDestroyKey (hKey=0x82b280) returned 1
	[0185.485] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.485] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2625568, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0185.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.485] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0185.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.485] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2625620*=0x1, dwFlags=0x0) returned 1
	[0185.486] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x26255ec, dwFlags=0x0) returned 1
	[0185.486] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2625630*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2625630*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0185.486] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262591c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x262591c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.486] CryptDestroyKey (hKey=0x82b080) returned 1
	[0185.486] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.486] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.486] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.486] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.503] GetFileType (hFile=0x318) returned 0x1
	[0185.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.504] GetFileType (hFile=0x318) returned 0x1
	[0185.504] WriteFile (in: hFile=0x318, lpBuffer=0x2625b80*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2625b80*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.504] CloseHandle (hObject=0x318) returned 1
	[0185.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0185.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.505] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8e5a64a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.505] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.514] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26271b4 | out: lpFileInformation=0x26271b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7)) returned 1
	[0185.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.514] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.514] GetFileType (hFile=0x318) returned 0x1
	[0185.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.514] GetFileType (hFile=0x318) returned 0x1
	[0185.514] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d7
	[0185.515] ReadFile (in: hFile=0x318, lpBuffer=0x2627948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2627948*, lpNumberOfBytesRead=0x540efcc*=0x2d7, lpOverlapped=0x0) returned 1
	[0185.708] CloseHandle (hObject=0x318) returned 1
	[0185.708] CryptDestroyKey (hKey=0x82b540) returned 1
	[0185.708] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.708] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26289e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0185.708] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.708] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.709] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0185.709] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.709] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2628a9c*=0x1, dwFlags=0x0) returned 1
	[0185.709] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2628a68, dwFlags=0x0) returned 1
	[0185.709] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2628aac*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2628aac*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0185.709] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2628d98*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2628d98*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.709] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.709] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.709] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.709] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.709] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.710] GetFileType (hFile=0x318) returned 0x1
	[0185.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.711] GetFileType (hFile=0x318) returned 0x1
	[0185.711] WriteFile (in: hFile=0x318, lpBuffer=0x2628ffc*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2628ffc*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.712] CloseHandle (hObject=0x318) returned 1
	[0185.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0185.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.712] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa904a642, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.712] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.713] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.713] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x262a624 | out: lpFileInformation=0x262a624*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0185.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.715] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.715] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.715] GetFileType (hFile=0x318) returned 0x1
	[0185.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.715] GetFileType (hFile=0x318) returned 0x1
	[0185.715] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cd
	[0185.715] ReadFile (in: hFile=0x318, lpBuffer=0x262adb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x262adb0*, lpNumberOfBytesRead=0x540efcc*=0x2cd, lpOverlapped=0x0) returned 1
	[0185.718] CloseHandle (hObject=0x318) returned 1
	[0185.718] CryptDestroyKey (hKey=0x82b300) returned 1
	[0185.718] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.718] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262be4c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b0c0) returned 1
	[0185.718] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.718] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.718] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0185.718] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.718] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x262bf04*=0x1, dwFlags=0x0) returned 1
	[0185.718] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x262bed0, dwFlags=0x0) returned 1
	[0185.718] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262bf14*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x262bf14*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0185.718] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262c1f0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x262c1f0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.718] CryptDestroyKey (hKey=0x82b300) returned 1
	[0185.718] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.718] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.719] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.720] GetFileType (hFile=0x318) returned 0x1
	[0185.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.720] GetFileType (hFile=0x318) returned 0x1
	[0185.720] WriteFile (in: hFile=0x318, lpBuffer=0x262c454*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x262c454*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0185.721] CloseHandle (hObject=0x318) returned 1
	[0185.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0185.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.721] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa90708cf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0185.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.721] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.722] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x262da7c | out: lpFileInformation=0x262da7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9)) returned 1
	[0185.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.722] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.722] GetFileType (hFile=0x318) returned 0x1
	[0185.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.722] GetFileType (hFile=0x318) returned 0x1
	[0185.722] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d9
	[0185.723] ReadFile (in: hFile=0x318, lpBuffer=0x262e214, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x262e214*, lpNumberOfBytesRead=0x540efcc*=0x2d9, lpOverlapped=0x0) returned 1
	[0185.735] CloseHandle (hObject=0x318) returned 1
	[0185.735] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0185.735] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.735] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262f2b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0185.735] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.735] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.735] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0185.735] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.735] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x262f368*=0x1, dwFlags=0x0) returned 1
	[0185.735] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x262f334, dwFlags=0x0) returned 1
	[0185.735] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262f378*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x262f378*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0185.735] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262f664*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x262f664*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.735] CryptDestroyKey (hKey=0x82b300) returned 1
	[0185.735] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.735] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.735] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.735] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.736] GetFileType (hFile=0x318) returned 0x1
	[0185.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.737] GetFileType (hFile=0x318) returned 0x1
	[0185.737] WriteFile (in: hFile=0x318, lpBuffer=0x262f8c8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x262f8c8*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.737] CloseHandle (hObject=0x318) returned 1
	[0185.738] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.738] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0185.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.738] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9096a01, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.738] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.739] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2630ef0 | out: lpFileInformation=0x2630ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd)) returned 1
	[0185.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.739] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.739] GetFileType (hFile=0x318) returned 0x1
	[0185.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.740] GetFileType (hFile=0x318) returned 0x1
	[0185.740] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2dd
	[0185.740] ReadFile (in: hFile=0x318, lpBuffer=0x263168c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x263168c*, lpNumberOfBytesRead=0x540efcc*=0x2dd, lpOverlapped=0x0) returned 1
	[0185.741] CloseHandle (hObject=0x318) returned 1
	[0185.742] CryptDestroyKey (hKey=0x82b280) returned 1
	[0185.742] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.742] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2632728, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0185.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.742] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0185.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.742] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26327e0*=0x1, dwFlags=0x0) returned 1
	[0185.742] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26327ac, dwFlags=0x0) returned 1
	[0185.742] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26327f0*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26327f0*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0185.742] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2632adc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2632adc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.742] CryptDestroyKey (hKey=0x82b340) returned 1
	[0185.742] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.742] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.742] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.742] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.744] GetFileType (hFile=0x318) returned 0x1
	[0185.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.744] GetFileType (hFile=0x318) returned 0x1
	[0185.744] WriteFile (in: hFile=0x318, lpBuffer=0x2632d40*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2632d40*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.745] CloseHandle (hObject=0x318) returned 1
	[0185.745] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.745] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0185.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.745] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa90bcfbe, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.745] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.746] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.746] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2634368 | out: lpFileInformation=0x2634368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0185.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.747] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.747] GetFileType (hFile=0x318) returned 0x1
	[0185.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.747] GetFileType (hFile=0x318) returned 0x1
	[0185.747] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d0
	[0185.748] ReadFile (in: hFile=0x318, lpBuffer=0x2634af4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2634af4*, lpNumberOfBytesRead=0x540efcc*=0x2d0, lpOverlapped=0x0) returned 1
	[0185.755] CloseHandle (hObject=0x318) returned 1
	[0185.755] CryptDestroyKey (hKey=0x82b540) returned 1
	[0185.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.756] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2635b90, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0185.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.756] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0185.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.756] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2635c48*=0x1, dwFlags=0x0) returned 1
	[0185.756] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2635c14, dwFlags=0x0) returned 1
	[0185.756] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2635c58*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2635c58*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0185.756] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2635f44*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2635f44*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.756] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.756] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.756] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.758] GetFileType (hFile=0x318) returned 0x1
	[0185.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.758] GetFileType (hFile=0x318) returned 0x1
	[0185.758] WriteFile (in: hFile=0x318, lpBuffer=0x26361a8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26361a8*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.759] CloseHandle (hObject=0x318) returned 1
	[0185.759] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.761] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0185.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.761] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa90bcfbe, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.761] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.763] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26377d0 | out: lpFileInformation=0x26377d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da)) returned 1
	[0185.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.763] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.763] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.763] GetFileType (hFile=0x318) returned 0x1
	[0185.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.764] GetFileType (hFile=0x318) returned 0x1
	[0185.764] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2da
	[0185.764] ReadFile (in: hFile=0x318, lpBuffer=0x2637f68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2637f68*, lpNumberOfBytesRead=0x540efcc*=0x2da, lpOverlapped=0x0) returned 1
	[0185.766] CloseHandle (hObject=0x318) returned 1
	[0185.766] CryptDestroyKey (hKey=0x82b200) returned 1
	[0185.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.766] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2639004, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0185.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.767] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.767] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0185.767] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.767] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x26390bc*=0x1, dwFlags=0x0) returned 1
	[0185.767] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2639088, dwFlags=0x0) returned 1
	[0185.767] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26390cc*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26390cc*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0185.767] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26393b8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26393b8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.767] CryptDestroyKey (hKey=0x82b000) returned 1
	[0185.767] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.767] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.767] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.767] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.769] GetFileType (hFile=0x318) returned 0x1
	[0185.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.769] GetFileType (hFile=0x318) returned 0x1
	[0185.769] WriteFile (in: hFile=0x318, lpBuffer=0x263961c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x263961c*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.770] CloseHandle (hObject=0x318) returned 1
	[0185.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0185.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.770] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa90e30c8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.770] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.771] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0185.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.772] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x263ac44 | out: lpFileInformation=0x263ac44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x288)) returned 1
	[0185.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.773] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0185.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.773] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.773] GetFileType (hFile=0x318) returned 0x1
	[0185.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.773] GetFileType (hFile=0x318) returned 0x1
	[0185.773] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x288
	[0185.773] ReadFile (in: hFile=0x318, lpBuffer=0x263b398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x263b398*, lpNumberOfBytesRead=0x540efcc*=0x288, lpOverlapped=0x0) returned 1
	[0185.786] CloseHandle (hObject=0x318) returned 1
	[0185.786] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0185.786] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.786] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263c434, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0185.787] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.787] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.787] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0185.787] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.787] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x263c4ec*=0x1, dwFlags=0x0) returned 1
	[0185.787] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x263c4b8, dwFlags=0x0) returned 1
	[0185.787] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263c4fc*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x263c4fc*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0185.787] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263c798*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x263c798*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.787] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0185.787] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.787] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.787] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0185.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.787] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.788] GetFileType (hFile=0x318) returned 0x1
	[0185.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.788] GetFileType (hFile=0x318) returned 0x1
	[0185.789] WriteFile (in: hFile=0x318, lpBuffer=0x263ca04*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x263ca04*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0185.790] CloseHandle (hObject=0x318) returned 1
	[0185.790] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0185.790] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0185.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.790] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa91091a7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0185.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.790] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.791] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.791] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x263e03c | out: lpFileInformation=0x263e03c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e3)) returned 1
	[0185.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.792] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.792] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.792] GetFileType (hFile=0x318) returned 0x1
	[0185.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.792] GetFileType (hFile=0x318) returned 0x1
	[0185.792] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2e3
	[0185.792] ReadFile (in: hFile=0x318, lpBuffer=0x263e7dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x263e7dc*, lpNumberOfBytesRead=0x540efcc*=0x2e3, lpOverlapped=0x0) returned 1
	[0185.793] CloseHandle (hObject=0x318) returned 1
	[0185.794] CryptDestroyKey (hKey=0x82b380) returned 1
	[0185.794] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.794] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263f878, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0185.794] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.794] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.794] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0185.794] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.794] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x263f930*=0x1, dwFlags=0x0) returned 1
	[0185.794] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x263f8fc, dwFlags=0x0) returned 1
	[0185.794] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263f940*, pdwDataLen=0x540efd4*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x263f940*, pdwDataLen=0x540efd4*=0x2f0) returned 1
	[0185.794] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263fc3c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x263fc3c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.794] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.794] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.794] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.794] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.795] GetFileType (hFile=0x318) returned 0x1
	[0185.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.796] GetFileType (hFile=0x318) returned 0x1
	[0185.796] WriteFile (in: hFile=0x318, lpBuffer=0x263fea0*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x263fea0*, lpNumberOfBytesWritten=0x540ef94*=0x2f0, lpOverlapped=0x0) returned 1
	[0185.796] CloseHandle (hObject=0x318) returned 1
	[0185.797] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.797] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0185.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.797] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa912f425, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0185.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.797] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.798] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.798] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26414c8 | out: lpFileInformation=0x26414c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2)) returned 1
	[0185.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.798] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.798] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.799] GetFileType (hFile=0x318) returned 0x1
	[0185.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.799] GetFileType (hFile=0x318) returned 0x1
	[0185.799] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d2
	[0185.799] ReadFile (in: hFile=0x318, lpBuffer=0x2641c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2641c58*, lpNumberOfBytesRead=0x540efcc*=0x2d2, lpOverlapped=0x0) returned 1
	[0185.800] CloseHandle (hObject=0x318) returned 1
	[0185.800] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0185.800] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.801] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2642cf4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0185.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.801] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0185.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.801] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x2642dac*=0x1, dwFlags=0x0) returned 1
	[0185.801] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x2642d78, dwFlags=0x0) returned 1
	[0185.801] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2642dbc*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2642dbc*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0185.801] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26430a8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26430a8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.801] CryptDestroyKey (hKey=0x82b340) returned 1
	[0185.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.801] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.802] GetFileType (hFile=0x318) returned 0x1
	[0185.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.802] GetFileType (hFile=0x318) returned 0x1
	[0185.802] WriteFile (in: hFile=0x318, lpBuffer=0x264330c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x264330c*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.803] CloseHandle (hObject=0x318) returned 1
	[0185.803] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.803] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0185.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.804] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa912f425, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.804] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.805] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2644934 | out: lpFileInformation=0x2644934*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294)) returned 1
	[0185.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.805] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.805] GetFileType (hFile=0x318) returned 0x1
	[0185.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.805] GetFileType (hFile=0x318) returned 0x1
	[0185.805] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x294
	[0185.806] ReadFile (in: hFile=0x318, lpBuffer=0x2645074, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2645074*, lpNumberOfBytesRead=0x540efcc*=0x294, lpOverlapped=0x0) returned 1
	[0185.807] CloseHandle (hObject=0x318) returned 1
	[0185.807] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0185.807] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.807] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2646110, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0185.807] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.807] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.807] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0185.807] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.808] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26461c8*=0x1, dwFlags=0x0) returned 1
	[0185.808] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2646194, dwFlags=0x0) returned 1
	[0185.808] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26461d8*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x26461d8*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0185.808] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2646484*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2646484*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.808] CryptDestroyKey (hKey=0x82b280) returned 1
	[0185.808] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.808] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.808] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.808] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.809] GetFileType (hFile=0x318) returned 0x1
	[0185.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.809] GetFileType (hFile=0x318) returned 0x1
	[0185.809] WriteFile (in: hFile=0x318, lpBuffer=0x26466e0*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26466e0*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0185.810] CloseHandle (hObject=0x318) returned 1
	[0185.811] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.811] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0185.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.811] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9155625, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0185.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.811] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.812] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.812] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2647d04 | out: lpFileInformation=0x2647d04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a)) returned 1
	[0185.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.886] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.886] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.886] GetFileType (hFile=0x318) returned 0x1
	[0185.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.886] GetFileType (hFile=0x318) returned 0x1
	[0185.886] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x28a
	[0185.886] ReadFile (in: hFile=0x318, lpBuffer=0x264843c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x264843c*, lpNumberOfBytesRead=0x540efcc*=0x28a, lpOverlapped=0x0) returned 1
	[0185.888] CloseHandle (hObject=0x318) returned 1
	[0185.888] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.888] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26494d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0185.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.888] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0185.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.888] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2649590*=0x1, dwFlags=0x0) returned 1
	[0185.888] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x264955c, dwFlags=0x0) returned 1
	[0185.888] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26495a0*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x26495a0*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0185.888] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264983c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x264983c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.888] CryptDestroyKey (hKey=0x82b400) returned 1
	[0185.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.888] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.888] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.890] GetFileType (hFile=0x318) returned 0x1
	[0185.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.890] GetFileType (hFile=0x318) returned 0x1
	[0185.890] WriteFile (in: hFile=0x318, lpBuffer=0x2649a98*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2649a98*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0185.891] CloseHandle (hObject=0x318) returned 1
	[0185.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0185.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.891] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9214247, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0185.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.891] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.892] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.892] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x264b0bc | out: lpFileInformation=0x264b0bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5)) returned 1
	[0185.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.892] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.892] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.893] GetFileType (hFile=0x318) returned 0x1
	[0185.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.893] GetFileType (hFile=0x318) returned 0x1
	[0185.893] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d5
	[0185.893] ReadFile (in: hFile=0x318, lpBuffer=0x264b850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x264b850*, lpNumberOfBytesRead=0x540efcc*=0x2d5, lpOverlapped=0x0) returned 1
	[0185.894] CloseHandle (hObject=0x318) returned 1
	[0185.894] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.894] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.894] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264c8ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0185.894] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.895] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.895] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0185.895] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.895] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x264c9a4*=0x1, dwFlags=0x0) returned 1
	[0185.895] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x264c970, dwFlags=0x0) returned 1
	[0185.895] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264c9b4*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x264c9b4*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0185.895] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264cca0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x264cca0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.895] CryptDestroyKey (hKey=0x82b280) returned 1
	[0185.895] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.895] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.895] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.895] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.896] GetFileType (hFile=0x318) returned 0x1
	[0185.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.896] GetFileType (hFile=0x318) returned 0x1
	[0185.897] WriteFile (in: hFile=0x318, lpBuffer=0x264cf04*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x264cf04*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.897] CloseHandle (hObject=0x318) returned 1
	[0185.898] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.898] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0185.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.898] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9214247, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.898] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.899] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.899] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x264e538 | out: lpFileInformation=0x264e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8)) returned 1
	[0185.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.899] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.899] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.899] GetFileType (hFile=0x318) returned 0x1
	[0185.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.900] GetFileType (hFile=0x318) returned 0x1
	[0185.900] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d8
	[0185.900] ReadFile (in: hFile=0x318, lpBuffer=0x264eccc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x264eccc*, lpNumberOfBytesRead=0x540efcc*=0x2d8, lpOverlapped=0x0) returned 1
	[0185.902] CloseHandle (hObject=0x318) returned 1
	[0185.902] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0185.902] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.902] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264fd68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0185.902] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.902] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.902] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0185.902] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.902] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x264fe20*=0x1, dwFlags=0x0) returned 1
	[0185.902] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x264fdec, dwFlags=0x0) returned 1
	[0185.902] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264fe30*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x264fe30*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0185.902] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265011c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x265011c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.902] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0185.902] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.902] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.902] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.903] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.904] GetFileType (hFile=0x318) returned 0x1
	[0185.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.904] GetFileType (hFile=0x318) returned 0x1
	[0185.904] WriteFile (in: hFile=0x318, lpBuffer=0x2650380*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2650380*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.905] CloseHandle (hObject=0x318) returned 1
	[0185.905] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.905] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0185.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.905] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa923a472, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.905] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.906] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.906] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26519b4 | out: lpFileInformation=0x26519b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.907] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.907] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.907] GetFileType (hFile=0x318) returned 0x1
	[0185.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.907] GetFileType (hFile=0x318) returned 0x1
	[0185.907] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2e0
	[0185.907] ReadFile (in: hFile=0x318, lpBuffer=0x2652150, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2652150*, lpNumberOfBytesRead=0x540efcc*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.909] CloseHandle (hObject=0x318) returned 1
	[0185.909] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.909] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.909] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26531ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0185.909] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.909] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.909] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0185.909] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.910] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26532a4*=0x1, dwFlags=0x0) returned 1
	[0185.910] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2653270, dwFlags=0x0) returned 1
	[0185.910] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26532b4*, pdwDataLen=0x540efd4*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x26532b4*, pdwDataLen=0x540efd4*=0x2f0) returned 1
	[0185.910] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26535b0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26535b0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.910] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.910] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.910] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.910] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.910] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.911] GetFileType (hFile=0x318) returned 0x1
	[0185.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.911] GetFileType (hFile=0x318) returned 0x1
	[0185.912] WriteFile (in: hFile=0x318, lpBuffer=0x2653814*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2653814*, lpNumberOfBytesWritten=0x540ef94*=0x2f0, lpOverlapped=0x0) returned 1
	[0185.913] CloseHandle (hObject=0x318) returned 1
	[0185.913] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.913] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0185.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.913] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa923a472, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0185.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.913] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xae
	[0185.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.914] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2654e48 | out: lpFileInformation=0x2654e48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e7)) returned 1
	[0185.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.915] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xae
	[0185.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.915] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.915] GetFileType (hFile=0x318) returned 0x1
	[0185.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.915] GetFileType (hFile=0x318) returned 0x1
	[0185.915] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2e7
	[0185.915] ReadFile (in: hFile=0x318, lpBuffer=0x265565c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x265565c*, lpNumberOfBytesRead=0x540efcc*=0x2e7, lpOverlapped=0x0) returned 1
	[0185.917] CloseHandle (hObject=0x318) returned 1
	[0185.917] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0185.917] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.917] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26566f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0185.917] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.917] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.917] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0185.917] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.917] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26567b0*=0x1, dwFlags=0x0) returned 1
	[0185.917] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x265677c, dwFlags=0x0) returned 1
	[0185.917] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26567c0*, pdwDataLen=0x540efd4*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x26567c0*, pdwDataLen=0x540efd4*=0x2f0) returned 1
	[0185.917] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2656abc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2656abc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.917] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0185.917] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.917] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.918] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xae
	[0185.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.918] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.919] GetFileType (hFile=0x318) returned 0x1
	[0185.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.919] GetFileType (hFile=0x318) returned 0x1
	[0185.919] WriteFile (in: hFile=0x318, lpBuffer=0x2656d58*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2656d58*, lpNumberOfBytesWritten=0x540ef94*=0x2f0, lpOverlapped=0x0) returned 1
	[0185.920] CloseHandle (hObject=0x318) returned 1
	[0185.920] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xae
	[0185.920] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdd
	[0185.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.920] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa92606ee, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0185.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.921] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.922] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0185.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.922] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26583f0 | out: lpFileInformation=0x26583f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35d)) returned 1
	[0185.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.922] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0185.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.923] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.923] GetFileType (hFile=0x318) returned 0x1
	[0185.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.923] GetFileType (hFile=0x318) returned 0x1
	[0185.923] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x35d
	[0185.923] ReadFile (in: hFile=0x318, lpBuffer=0x2658c2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2658c2c*, lpNumberOfBytesRead=0x540efcc*=0x35d, lpOverlapped=0x0) returned 1
	[0185.947] CloseHandle (hObject=0x318) returned 1
	[0185.947] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.947] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.948] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2659cc8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0185.948] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.948] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.948] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0185.948] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.948] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2659d80*=0x1, dwFlags=0x0) returned 1
	[0185.948] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2659d4c, dwFlags=0x0) returned 1
	[0185.948] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2659d90*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x2659d90*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0185.948] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265a0fc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x265a0fc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.948] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0185.948] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.948] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.948] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0185.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.948] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.950] GetFileType (hFile=0x318) returned 0x1
	[0185.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.950] GetFileType (hFile=0x318) returned 0x1
	[0185.950] WriteFile (in: hFile=0x318, lpBuffer=0x265a370*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x265a370*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0185.951] CloseHandle (hObject=0x318) returned 1
	[0185.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0185.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0185.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.951] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa92acbbe, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0185.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.951] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.952] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x265b9c4 | out: lpFileInformation=0x265b9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0185.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.953] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.953] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.953] GetFileType (hFile=0x318) returned 0x1
	[0185.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.953] GetFileType (hFile=0x318) returned 0x1
	[0185.953] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1e0
	[0185.953] ReadFile (in: hFile=0x318, lpBuffer=0x265bfd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x265bfd0*, lpNumberOfBytesRead=0x540efcc*=0x1e0, lpOverlapped=0x0) returned 1
	[0185.954] CloseHandle (hObject=0x318) returned 1
	[0185.954] CryptDestroyKey (hKey=0x82b040) returned 1
	[0185.954] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.954] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265d06c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0185.955] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.955] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.955] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0185.955] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.955] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x265d124*=0x1, dwFlags=0x0) returned 1
	[0185.955] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x265d0f0, dwFlags=0x0) returned 1
	[0185.955] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265d134*, pdwDataLen=0x540efd4*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x265d134*, pdwDataLen=0x540efd4*=0x1f0) returned 1
	[0185.955] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265d330*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x265d330*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.955] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0185.955] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.955] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.955] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.955] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.956] GetFileType (hFile=0x318) returned 0x1
	[0185.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.957] GetFileType (hFile=0x318) returned 0x1
	[0185.957] WriteFile (in: hFile=0x318, lpBuffer=0x265d54c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x265d54c*, lpNumberOfBytesWritten=0x540ef94*=0x1f0, lpOverlapped=0x0) returned 1
	[0185.957] CloseHandle (hObject=0x318) returned 1
	[0185.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0185.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.958] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa92acbbe, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0185.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.958] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.963] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0185.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.963] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x265eaf0 | out: lpFileInformation=0x265eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c)) returned 1
	[0185.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.964] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0185.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.964] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.964] GetFileType (hFile=0x318) returned 0x1
	[0185.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.964] GetFileType (hFile=0x318) returned 0x1
	[0185.964] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34c
	[0185.964] ReadFile (in: hFile=0x318, lpBuffer=0x265f2e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x265f2e8*, lpNumberOfBytesRead=0x540efcc*=0x34c, lpOverlapped=0x0) returned 1
	[0185.965] CloseHandle (hObject=0x318) returned 1
	[0185.965] CryptDestroyKey (hKey=0x82b480) returned 1
	[0185.965] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.966] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2660384, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0185.966] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.966] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.966] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0185.966] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.966] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x266043c*=0x1, dwFlags=0x0) returned 1
	[0185.966] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2660408, dwFlags=0x0) returned 1
	[0185.966] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266044c*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x266044c*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0185.966] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26607a8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26607a8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.966] CryptDestroyKey (hKey=0x82b540) returned 1
	[0185.966] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.966] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.966] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0185.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.966] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.967] GetFileType (hFile=0x318) returned 0x1
	[0185.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.967] GetFileType (hFile=0x318) returned 0x1
	[0185.967] WriteFile (in: hFile=0x318, lpBuffer=0x2660a04*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2660a04*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0185.968] CloseHandle (hObject=0x318) returned 1
	[0185.968] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0185.969] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0185.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.969] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa92d36ae, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0185.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.969] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.970] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0185.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.970] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x266201c | out: lpFileInformation=0x266201c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0185.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.971] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0185.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.971] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.971] GetFileType (hFile=0x318) returned 0x1
	[0185.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.971] GetFileType (hFile=0x318) returned 0x1
	[0185.971] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cc
	[0185.971] ReadFile (in: hFile=0x318, lpBuffer=0x2662774, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2662774*, lpNumberOfBytesRead=0x540efcc*=0x2cc, lpOverlapped=0x0) returned 1
	[0185.973] CloseHandle (hObject=0x318) returned 1
	[0185.973] CryptDestroyKey (hKey=0x82b080) returned 1
	[0185.973] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.973] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2663810, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0185.973] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.973] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.973] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0185.973] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.973] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26638c8*=0x1, dwFlags=0x0) returned 1
	[0185.973] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2663894, dwFlags=0x0) returned 1
	[0185.973] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26638d8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26638d8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0185.973] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2663bb4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2663bb4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.973] CryptDestroyKey (hKey=0x82b280) returned 1
	[0185.973] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.973] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0185.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.973] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.975] GetFileType (hFile=0x318) returned 0x1
	[0185.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.975] GetFileType (hFile=0x318) returned 0x1
	[0185.975] WriteFile (in: hFile=0x318, lpBuffer=0x2663e00*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2663e00*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0185.976] CloseHandle (hObject=0x318) returned 1
	[0185.976] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0185.976] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0185.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.976] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa92d36ae, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0185.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.976] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.977] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0185.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.977] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26653f8 | out: lpFileInformation=0x26653f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0185.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.978] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0185.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.978] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.978] GetFileType (hFile=0x318) returned 0x1
	[0185.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.978] GetFileType (hFile=0x318) returned 0x1
	[0185.978] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d0
	[0185.978] ReadFile (in: hFile=0x318, lpBuffer=0x2665b94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2665b94*, lpNumberOfBytesRead=0x540efcc*=0x2d0, lpOverlapped=0x0) returned 1
	[0185.979] CloseHandle (hObject=0x318) returned 1
	[0185.979] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0185.979] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.979] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2666c30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b0c0) returned 1
	[0185.980] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.980] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.980] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0185.980] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.980] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2666ce8*=0x1, dwFlags=0x0) returned 1
	[0185.980] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2666cb4, dwFlags=0x0) returned 1
	[0185.980] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2666cf8*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2666cf8*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0185.980] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2666fe4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2666fe4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0185.980] CryptDestroyKey (hKey=0x82b300) returned 1
	[0185.980] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.980] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.980] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0185.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0185.980] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.981] GetFileType (hFile=0x318) returned 0x1
	[0185.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0185.981] GetFileType (hFile=0x318) returned 0x1
	[0185.981] WriteFile (in: hFile=0x318, lpBuffer=0x2667250*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2667250*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.982] CloseHandle (hObject=0x318) returned 1
	[0185.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0185.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0185.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0185.983] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa92f907e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0185.983] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.984] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0185.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0185.984] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2668888 | out: lpFileInformation=0x2668888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de)) returned 1
	[0185.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0185.984] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0185.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0185.985] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.985] GetFileType (hFile=0x318) returned 0x1
	[0185.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0185.985] GetFileType (hFile=0x318) returned 0x1
	[0185.985] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2de
	[0185.985] ReadFile (in: hFile=0x318, lpBuffer=0x2669084, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2669084*, lpNumberOfBytesRead=0x540efcc*=0x2de, lpOverlapped=0x0) returned 1
	[0186.010] CloseHandle (hObject=0x318) returned 1
	[0186.010] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0186.010] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.010] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266a120, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0186.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.011] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0186.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.011] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x266a1d8*=0x1, dwFlags=0x0) returned 1
	[0186.011] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x266a1a4, dwFlags=0x0) returned 1
	[0186.011] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266a1e8*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x266a1e8*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0186.011] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266a4d4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x266a4d4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.011] CryptDestroyKey (hKey=0x82b300) returned 1
	[0186.011] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.011] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.011] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0186.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.011] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.013] GetFileType (hFile=0x318) returned 0x1
	[0186.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.013] GetFileType (hFile=0x318) returned 0x1
	[0186.013] WriteFile (in: hFile=0x318, lpBuffer=0x266a768*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x266a768*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0186.014] CloseHandle (hObject=0x318) returned 1
	[0186.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0186.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdc
	[0186.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.014] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9345523, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0186.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.015] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0186.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.016] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x266bdfc | out: lpFileInformation=0x266bdfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x326)) returned 1
	[0186.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.017] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0186.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.017] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.017] GetFileType (hFile=0x318) returned 0x1
	[0186.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.017] GetFileType (hFile=0x318) returned 0x1
	[0186.017] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x326
	[0186.017] ReadFile (in: hFile=0x318, lpBuffer=0x266c640, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x266c640*, lpNumberOfBytesRead=0x540efcc*=0x326, lpOverlapped=0x0) returned 1
	[0186.019] CloseHandle (hObject=0x318) returned 1
	[0186.019] CryptDestroyKey (hKey=0x82b280) returned 1
	[0186.019] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.019] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266d6dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0186.019] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.019] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.019] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0186.019] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.019] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x266d794*=0x1, dwFlags=0x0) returned 1
	[0186.019] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x266d760, dwFlags=0x0) returned 1
	[0186.020] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266d7a4*, pdwDataLen=0x540efd4*=0x330, dwBufLen=0x330 | out: pbData=0x266d7a4*, pdwDataLen=0x540efd4*=0x330) returned 1
	[0186.020] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266dae0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x266dae0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.020] CryptDestroyKey (hKey=0x82b340) returned 1
	[0186.020] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.020] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.020] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0186.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.020] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.021] GetFileType (hFile=0x318) returned 0x1
	[0186.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.021] GetFileType (hFile=0x318) returned 0x1
	[0186.021] WriteFile (in: hFile=0x318, lpBuffer=0x266dd74*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x266dd74*, lpNumberOfBytesWritten=0x540ef94*=0x330, lpOverlapped=0x0) returned 1
	[0186.022] CloseHandle (hObject=0x318) returned 1
	[0186.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0186.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdc
	[0186.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.023] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9345523, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x330)) returned 1
	[0186.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.023] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.024] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0186.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.024] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x266f408 | out: lpFileInformation=0x266f408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30b)) returned 1
	[0186.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.024] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0186.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.025] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.025] GetFileType (hFile=0x318) returned 0x1
	[0186.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.025] GetFileType (hFile=0x318) returned 0x1
	[0186.025] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x30b
	[0186.025] ReadFile (in: hFile=0x318, lpBuffer=0x266fbf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x266fbf0*, lpNumberOfBytesRead=0x540efcc*=0x30b, lpOverlapped=0x0) returned 1
	[0186.027] CloseHandle (hObject=0x318) returned 1
	[0186.027] CryptDestroyKey (hKey=0x82b540) returned 1
	[0186.027] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.027] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2670c8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0186.027] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.027] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.027] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0186.027] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.027] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2670d44*=0x1, dwFlags=0x0) returned 1
	[0186.027] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2670d10, dwFlags=0x0) returned 1
	[0186.027] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2670d54*, pdwDataLen=0x540efd4*=0x310, dwBufLen=0x310 | out: pbData=0x2670d54*, pdwDataLen=0x540efd4*=0x310) returned 1
	[0186.027] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2671070*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2671070*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.028] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.028] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.028] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.028] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0186.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.028] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.029] GetFileType (hFile=0x318) returned 0x1
	[0186.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.029] GetFileType (hFile=0x318) returned 0x1
	[0186.029] WriteFile (in: hFile=0x318, lpBuffer=0x26712e4*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26712e4*, lpNumberOfBytesWritten=0x540ef94*=0x310, lpOverlapped=0x0) returned 1
	[0186.031] CloseHandle (hObject=0x318) returned 1
	[0186.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0186.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0186.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.031] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa936b789, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0186.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.031] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.033] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2672938 | out: lpFileInformation=0x2672938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0186.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.033] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.033] GetFileType (hFile=0x318) returned 0x1
	[0186.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.033] GetFileType (hFile=0x318) returned 0x1
	[0186.033] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1e0
	[0186.034] ReadFile (in: hFile=0x318, lpBuffer=0x2672f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2672f44*, lpNumberOfBytesRead=0x540efcc*=0x1e0, lpOverlapped=0x0) returned 1
	[0186.035] CloseHandle (hObject=0x318) returned 1
	[0186.035] CryptDestroyKey (hKey=0x82b200) returned 1
	[0186.035] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.035] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2673fe0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0186.035] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.035] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.035] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0186.035] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.035] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2674098*=0x1, dwFlags=0x0) returned 1
	[0186.035] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2674064, dwFlags=0x0) returned 1
	[0186.036] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26740a8*, pdwDataLen=0x540efd4*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x26740a8*, pdwDataLen=0x540efd4*=0x1f0) returned 1
	[0186.036] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26742a4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26742a4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.036] CryptDestroyKey (hKey=0x82b000) returned 1
	[0186.036] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.036] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.036] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.037] GetFileType (hFile=0x318) returned 0x1
	[0186.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.037] GetFileType (hFile=0x318) returned 0x1
	[0186.038] WriteFile (in: hFile=0x318, lpBuffer=0x26744c0*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26744c0*, lpNumberOfBytesWritten=0x540ef94*=0x1f0, lpOverlapped=0x0) returned 1
	[0186.039] CloseHandle (hObject=0x318) returned 1
	[0186.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0186.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.039] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa936b789, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0186.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.039] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.041] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.041] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2675a64 | out: lpFileInformation=0x2675a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fd)) returned 1
	[0186.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.042] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.042] GetFileType (hFile=0x318) returned 0x1
	[0186.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.042] GetFileType (hFile=0x318) returned 0x1
	[0186.042] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2fd
	[0186.043] ReadFile (in: hFile=0x318, lpBuffer=0x2676200, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2676200*, lpNumberOfBytesRead=0x540efcc*=0x2fd, lpOverlapped=0x0) returned 1
	[0186.073] CloseHandle (hObject=0x318) returned 1
	[0186.073] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.073] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.073] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267729c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0186.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.073] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0186.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.073] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2677354*=0x1, dwFlags=0x0) returned 1
	[0186.073] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2677320, dwFlags=0x0) returned 1
	[0186.073] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2677364*, pdwDataLen=0x540efd4*=0x300, dwBufLen=0x300 | out: pbData=0x2677364*, pdwDataLen=0x540efd4*=0x300) returned 1
	[0186.073] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2677670*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2677670*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.074] CryptDestroyKey (hKey=0x82b480) returned 1
	[0186.074] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.074] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.074] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.075] GetFileType (hFile=0x318) returned 0x1
	[0186.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.075] GetFileType (hFile=0x318) returned 0x1
	[0186.075] WriteFile (in: hFile=0x318, lpBuffer=0x26778c4*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26778c4*, lpNumberOfBytesWritten=0x540ef94*=0x300, lpOverlapped=0x0) returned 1
	[0186.076] CloseHandle (hObject=0x318) returned 1
	[0186.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0186.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.077] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa93ddeba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x300)) returned 1
	[0186.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.077] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.078] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.078] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2678ed8 | out: lpFileInformation=0x2678ed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x311)) returned 1
	[0186.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.079] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.079] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.079] GetFileType (hFile=0x318) returned 0x1
	[0186.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.079] GetFileType (hFile=0x318) returned 0x1
	[0186.079] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x311
	[0186.079] ReadFile (in: hFile=0x318, lpBuffer=0x2679688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2679688*, lpNumberOfBytesRead=0x540efcc*=0x311, lpOverlapped=0x0) returned 1
	[0186.080] CloseHandle (hObject=0x318) returned 1
	[0186.080] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.080] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.081] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267a724, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.081] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.081] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.081] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0186.081] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.081] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x267a7dc*=0x1, dwFlags=0x0) returned 1
	[0186.081] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x267a7a8, dwFlags=0x0) returned 1
	[0186.081] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267a7ec*, pdwDataLen=0x540efd4*=0x320, dwBufLen=0x320 | out: pbData=0x267a7ec*, pdwDataLen=0x540efd4*=0x320) returned 1
	[0186.081] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267ab18*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x267ab18*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.081] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0186.081] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.081] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.081] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.081] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.082] GetFileType (hFile=0x318) returned 0x1
	[0186.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.083] GetFileType (hFile=0x318) returned 0x1
	[0186.083] WriteFile (in: hFile=0x318, lpBuffer=0x267ad6c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x267ad6c*, lpNumberOfBytesWritten=0x540ef94*=0x320, lpOverlapped=0x0) returned 1
	[0186.084] CloseHandle (hObject=0x318) returned 1
	[0186.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0186.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.084] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa93ddeba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1
	[0186.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.084] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.085] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.085] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x267c380 | out: lpFileInformation=0x267c380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307)) returned 1
	[0186.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.085] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.086] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.086] GetFileType (hFile=0x318) returned 0x1
	[0186.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.086] GetFileType (hFile=0x318) returned 0x1
	[0186.086] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x307
	[0186.086] ReadFile (in: hFile=0x318, lpBuffer=0x267cb24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x267cb24*, lpNumberOfBytesRead=0x540efcc*=0x307, lpOverlapped=0x0) returned 1
	[0186.088] CloseHandle (hObject=0x318) returned 1
	[0186.088] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.088] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.088] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267dbc0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0186.088] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.088] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.088] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0186.088] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.088] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x267dc78*=0x1, dwFlags=0x0) returned 1
	[0186.088] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x267dc44, dwFlags=0x0) returned 1
	[0186.088] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267dc88*, pdwDataLen=0x540efd4*=0x310, dwBufLen=0x310 | out: pbData=0x267dc88*, pdwDataLen=0x540efd4*=0x310) returned 1
	[0186.088] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267dfa4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x267dfa4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.088] CryptDestroyKey (hKey=0x82b480) returned 1
	[0186.088] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.088] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.088] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.088] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.089] GetFileType (hFile=0x318) returned 0x1
	[0186.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.090] GetFileType (hFile=0x318) returned 0x1
	[0186.090] WriteFile (in: hFile=0x318, lpBuffer=0x267e1f8*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x267e1f8*, lpNumberOfBytesWritten=0x540ef94*=0x310, lpOverlapped=0x0) returned 1
	[0186.091] CloseHandle (hObject=0x318) returned 1
	[0186.091] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.091] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0186.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.091] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9404063, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0186.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.091] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.092] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.092] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x267f80c | out: lpFileInformation=0x267f80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x322)) returned 1
	[0186.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.092] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.093] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.093] GetFileType (hFile=0x318) returned 0x1
	[0186.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.093] GetFileType (hFile=0x318) returned 0x1
	[0186.093] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x322
	[0186.093] ReadFile (in: hFile=0x318, lpBuffer=0x267fffc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x267fffc*, lpNumberOfBytesRead=0x540efcc*=0x322, lpOverlapped=0x0) returned 1
	[0186.094] CloseHandle (hObject=0x318) returned 1
	[0186.094] CryptDestroyKey (hKey=0x82b440) returned 1
	[0186.094] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.095] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2681098, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0186.095] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.095] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.095] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0186.095] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.095] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2681150*=0x1, dwFlags=0x0) returned 1
	[0186.095] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x268111c, dwFlags=0x0) returned 1
	[0186.095] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2681160*, pdwDataLen=0x540efd4*=0x330, dwBufLen=0x330 | out: pbData=0x2681160*, pdwDataLen=0x540efd4*=0x330) returned 1
	[0186.095] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268149c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x268149c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.095] CryptDestroyKey (hKey=0x82b040) returned 1
	[0186.095] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.095] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.095] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.097] GetFileType (hFile=0x318) returned 0x1
	[0186.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.097] GetFileType (hFile=0x318) returned 0x1
	[0186.097] WriteFile (in: hFile=0x318, lpBuffer=0x2681708*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2681708*, lpNumberOfBytesWritten=0x540ef94*=0x330, lpOverlapped=0x0) returned 1
	[0186.097] CloseHandle (hObject=0x318) returned 1
	[0186.098] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.098] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0186.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.098] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9404063, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x330)) returned 1
	[0186.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.098] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.099] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0186.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.099] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2682d40 | out: lpFileInformation=0x2682d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0186.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.099] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0186.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.099] ReadFile (in: hFile=0x318, lpBuffer=0x2683488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2683488*, lpNumberOfBytesRead=0x540efcc*=0x2cc, lpOverlapped=0x0) returned 1
	[0186.101] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.101] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.101] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2684524, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0186.101] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.101] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.101] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0186.101] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.101] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26845dc*=0x1, dwFlags=0x0) returned 1
	[0186.102] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26845a8, dwFlags=0x0) returned 1
	[0186.102] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26845ec*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26845ec*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.102] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26848c8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26848c8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.102] CryptDestroyKey (hKey=0x82b300) returned 1
	[0186.102] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.102] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.102] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0186.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.102] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.103] GetFileType (hFile=0x318) returned 0x1
	[0186.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.104] GetFileType (hFile=0x318) returned 0x1
	[0186.104] WriteFile (in: hFile=0x318, lpBuffer=0x2684b0c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2684b0c*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.105] CloseHandle (hObject=0x318) returned 1
	[0186.105] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0186.105] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0186.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.105] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa942a25d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.105] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.106] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0186.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.106] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2686100 | out: lpFileInformation=0x2686100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35b)) returned 1
	[0186.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.107] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0186.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.107] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.107] GetFileType (hFile=0x318) returned 0x1
	[0186.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.107] GetFileType (hFile=0x318) returned 0x1
	[0186.107] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x35b
	[0186.107] ReadFile (in: hFile=0x318, lpBuffer=0x2686938, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2686938*, lpNumberOfBytesRead=0x540efcc*=0x35b, lpOverlapped=0x0) returned 1
	[0186.135] CloseHandle (hObject=0x318) returned 1
	[0186.135] CryptDestroyKey (hKey=0x82b340) returned 1
	[0186.135] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.135] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26879d4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0186.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.135] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0186.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.135] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2687a8c*=0x1, dwFlags=0x0) returned 1
	[0186.135] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2687a58, dwFlags=0x0) returned 1
	[0186.136] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2687a9c*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x2687a9c*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0186.136] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2687e08*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2687e08*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.136] CryptDestroyKey (hKey=0x82b100) returned 1
	[0186.136] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.136] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0186.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.136] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.137] GetFileType (hFile=0x318) returned 0x1
	[0186.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.137] GetFileType (hFile=0x318) returned 0x1
	[0186.137] WriteFile (in: hFile=0x318, lpBuffer=0x268807c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x268807c*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0186.138] CloseHandle (hObject=0x318) returned 1
	[0186.139] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0186.139] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0186.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.139] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa94767e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0186.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.139] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0186.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.140] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26896d0 | out: lpFileInformation=0x26896d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b)) returned 1
	[0186.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.141] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0186.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.141] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.141] GetFileType (hFile=0x318) returned 0x1
	[0186.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.142] GetFileType (hFile=0x318) returned 0x1
	[0186.142] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x28b
	[0186.142] ReadFile (in: hFile=0x318, lpBuffer=0x2689de8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2689de8*, lpNumberOfBytesRead=0x540efcc*=0x28b, lpOverlapped=0x0) returned 1
	[0186.143] CloseHandle (hObject=0x318) returned 1
	[0186.143] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.143] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.143] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268ae84, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0186.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.143] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0186.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.144] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x268af3c*=0x1, dwFlags=0x0) returned 1
	[0186.144] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x268af08, dwFlags=0x0) returned 1
	[0186.144] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268af4c*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x268af4c*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0186.144] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268b1e8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x268b1e8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.144] CryptDestroyKey (hKey=0x82b540) returned 1
	[0186.144] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.144] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0186.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.144] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.145] GetFileType (hFile=0x318) returned 0x1
	[0186.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.145] GetFileType (hFile=0x318) returned 0x1
	[0186.145] WriteFile (in: hFile=0x318, lpBuffer=0x268b434*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x268b434*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0186.146] CloseHandle (hObject=0x318) returned 1
	[0186.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0186.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0186.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.147] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa94767e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0186.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.147] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.148] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x268ca38 | out: lpFileInformation=0x268ca38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0186.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.148] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.149] GetFileType (hFile=0x318) returned 0x1
	[0186.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.149] GetFileType (hFile=0x318) returned 0x1
	[0186.149] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c9
	[0186.149] ReadFile (in: hFile=0x318, lpBuffer=0x268d1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x268d1b0*, lpNumberOfBytesRead=0x540efcc*=0x2c9, lpOverlapped=0x0) returned 1
	[0186.150] CloseHandle (hObject=0x318) returned 1
	[0186.150] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0186.151] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.151] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268e24c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0186.151] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.151] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.151] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0186.151] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.151] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x268e304*=0x1, dwFlags=0x0) returned 1
	[0186.151] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x268e2d0, dwFlags=0x0) returned 1
	[0186.151] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268e314*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x268e314*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.151] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268e5f0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x268e5f0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.151] CryptDestroyKey (hKey=0x82b280) returned 1
	[0186.151] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.151] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.151] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.151] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.152] GetFileType (hFile=0x318) returned 0x1
	[0186.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.152] GetFileType (hFile=0x318) returned 0x1
	[0186.152] WriteFile (in: hFile=0x318, lpBuffer=0x268e84c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x268e84c*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.153] CloseHandle (hObject=0x318) returned 1
	[0186.154] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.154] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0186.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.154] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa949ca65, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.154] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.155] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.155] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x268fe70 | out: lpFileInformation=0x268fe70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285)) returned 1
	[0186.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.155] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.156] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.156] GetFileType (hFile=0x318) returned 0x1
	[0186.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.156] GetFileType (hFile=0x318) returned 0x1
	[0186.156] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x285
	[0186.156] ReadFile (in: hFile=0x318, lpBuffer=0x2690594, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2690594*, lpNumberOfBytesRead=0x540efcc*=0x285, lpOverlapped=0x0) returned 1
	[0186.157] CloseHandle (hObject=0x318) returned 1
	[0186.157] CryptDestroyKey (hKey=0x82b440) returned 1
	[0186.157] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.157] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2691630, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0186.158] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.158] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.158] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0186.158] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.158] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26916e8*=0x1, dwFlags=0x0) returned 1
	[0186.158] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26916b4, dwFlags=0x0) returned 1
	[0186.158] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26916f8*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x26916f8*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0186.158] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2691994*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2691994*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.158] CryptDestroyKey (hKey=0x82b280) returned 1
	[0186.158] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.158] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.158] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.158] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.159] GetFileType (hFile=0x318) returned 0x1
	[0186.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.159] GetFileType (hFile=0x318) returned 0x1
	[0186.160] WriteFile (in: hFile=0x318, lpBuffer=0x2691be8*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2691be8*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0186.161] CloseHandle (hObject=0x318) returned 1
	[0186.161] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.161] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0186.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.161] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa949ca65, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0186.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.161] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.162] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xbf
	[0186.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.162] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26931f0 | out: lpFileInformation=0x26931f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ed)) returned 1
	[0186.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.163] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xbf
	[0186.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.163] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.163] GetFileType (hFile=0x318) returned 0x1
	[0186.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.163] GetFileType (hFile=0x318) returned 0x1
	[0186.163] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2ed
	[0186.163] ReadFile (in: hFile=0x318, lpBuffer=0x2693a8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2693a8c*, lpNumberOfBytesRead=0x540efcc*=0x2ed, lpOverlapped=0x0) returned 1
	[0186.165] CloseHandle (hObject=0x318) returned 1
	[0186.165] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0186.165] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.165] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2694b28, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0186.165] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.165] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.165] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0186.165] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.165] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2694be0*=0x1, dwFlags=0x0) returned 1
	[0186.165] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2694bac, dwFlags=0x0) returned 1
	[0186.165] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2694bf0*, pdwDataLen=0x540efd4*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x2694bf0*, pdwDataLen=0x540efd4*=0x2f0) returned 1
	[0186.165] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2694eec*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2694eec*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.166] CryptDestroyKey (hKey=0x82b200) returned 1
	[0186.166] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.166] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.166] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xbf
	[0186.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.166] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.167] GetFileType (hFile=0x318) returned 0x1
	[0186.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.167] GetFileType (hFile=0x318) returned 0x1
	[0186.167] WriteFile (in: hFile=0x318, lpBuffer=0x26951c8*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26951c8*, lpNumberOfBytesWritten=0x540ef94*=0x2f0, lpOverlapped=0x0) returned 1
	[0186.168] CloseHandle (hObject=0x318) returned 1
	[0186.168] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xbf
	[0186.168] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xee
	[0186.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.169] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa94c2c24, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0186.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.169] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0186.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.170] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26968ec | out: lpFileInformation=0x26968ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29a)) returned 1
	[0186.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0186.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.171] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.171] GetFileType (hFile=0x318) returned 0x1
	[0186.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.171] GetFileType (hFile=0x318) returned 0x1
	[0186.171] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x29a
	[0186.171] ReadFile (in: hFile=0x318, lpBuffer=0x2697054, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2697054*, lpNumberOfBytesRead=0x540efcc*=0x29a, lpOverlapped=0x0) returned 1
	[0186.195] CloseHandle (hObject=0x318) returned 1
	[0186.195] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.195] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.195] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26980f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0186.195] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.195] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.195] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0186.195] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.195] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26981a8*=0x1, dwFlags=0x0) returned 1
	[0186.195] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2698174, dwFlags=0x0) returned 1
	[0186.196] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26981b8*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x26981b8*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0186.196] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2698464*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2698464*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.196] CryptDestroyKey (hKey=0x82b200) returned 1
	[0186.196] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.196] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.196] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0186.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.196] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.198] GetFileType (hFile=0x318) returned 0x1
	[0186.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.198] GetFileType (hFile=0x318) returned 0x1
	[0186.198] WriteFile (in: hFile=0x318, lpBuffer=0x26986d0*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26986d0*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0186.199] CloseHandle (hObject=0x318) returned 1
	[0186.199] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0186.199] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd2
	[0186.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.199] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa950f196, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0186.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.199] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.200] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0186.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.200] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2699d14 | out: lpFileInformation=0x2699d14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28f)) returned 1
	[0186.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.201] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0186.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.201] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.201] GetFileType (hFile=0x318) returned 0x1
	[0186.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.201] GetFileType (hFile=0x318) returned 0x1
	[0186.201] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x28f
	[0186.201] ReadFile (in: hFile=0x318, lpBuffer=0x269a470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x269a470*, lpNumberOfBytesRead=0x540efcc*=0x28f, lpOverlapped=0x0) returned 1
	[0186.203] CloseHandle (hObject=0x318) returned 1
	[0186.203] CryptDestroyKey (hKey=0x82b040) returned 1
	[0186.204] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.204] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269b50c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0186.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.204] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0186.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.204] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x269b5c4*=0x1, dwFlags=0x0) returned 1
	[0186.204] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x269b590, dwFlags=0x0) returned 1
	[0186.204] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269b5d4*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x269b5d4*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0186.204] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269b870*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x269b870*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.204] CryptDestroyKey (hKey=0x82b000) returned 1
	[0186.204] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.204] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.204] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0186.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.204] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.206] GetFileType (hFile=0x318) returned 0x1
	[0186.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.206] GetFileType (hFile=0x318) returned 0x1
	[0186.206] WriteFile (in: hFile=0x318, lpBuffer=0x269badc*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x269badc*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0186.207] CloseHandle (hObject=0x318) returned 1
	[0186.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0186.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd2
	[0186.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.207] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa950f196, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0186.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.207] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0186.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.209] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x269d120 | out: lpFileInformation=0x269d120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x346)) returned 1
	[0186.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0186.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.209] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.209] GetFileType (hFile=0x318) returned 0x1
	[0186.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.210] GetFileType (hFile=0x318) returned 0x1
	[0186.210] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x346
	[0186.210] ReadFile (in: hFile=0x318, lpBuffer=0x269d914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x269d914*, lpNumberOfBytesRead=0x540efcc*=0x346, lpOverlapped=0x0) returned 1
	[0186.211] CloseHandle (hObject=0x318) returned 1
	[0186.211] CryptDestroyKey (hKey=0x82b480) returned 1
	[0186.211] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.212] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269e9b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.212] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.212] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.212] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0186.212] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.212] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x269ea68*=0x1, dwFlags=0x0) returned 1
	[0186.212] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x269ea34, dwFlags=0x0) returned 1
	[0186.212] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269ea78*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x269ea78*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0186.212] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269edd4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x269edd4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.212] CryptDestroyKey (hKey=0x82b440) returned 1
	[0186.212] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.212] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.212] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0186.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.213] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.214] GetFileType (hFile=0x318) returned 0x1
	[0186.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.214] GetFileType (hFile=0x318) returned 0x1
	[0186.214] WriteFile (in: hFile=0x318, lpBuffer=0x269f030*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x269f030*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0186.215] CloseHandle (hObject=0x318) returned 1
	[0186.215] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0186.215] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0186.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.215] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa953534c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0186.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.216] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.217] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26a0648 | out: lpFileInformation=0x26a0648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x288)) returned 1
	[0186.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.217] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.218] GetFileType (hFile=0x318) returned 0x1
	[0186.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.218] GetFileType (hFile=0x318) returned 0x1
	[0186.218] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x288
	[0186.218] ReadFile (in: hFile=0x318, lpBuffer=0x26a0d6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a0d6c*, lpNumberOfBytesRead=0x540efcc*=0x288, lpOverlapped=0x0) returned 1
	[0186.219] CloseHandle (hObject=0x318) returned 1
	[0186.219] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.219] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.219] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a1e08, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0186.219] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.219] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.219] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0186.219] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.219] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26a1ec0*=0x1, dwFlags=0x0) returned 1
	[0186.220] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26a1e8c, dwFlags=0x0) returned 1
	[0186.220] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a1ed0*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x26a1ed0*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0186.220] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a216c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a216c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.220] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.220] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.220] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.220] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.220] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.221] GetFileType (hFile=0x318) returned 0x1
	[0186.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.221] GetFileType (hFile=0x318) returned 0x1
	[0186.221] WriteFile (in: hFile=0x318, lpBuffer=0x26a23c0*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26a23c0*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0186.222] CloseHandle (hObject=0x318) returned 1
	[0186.222] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.222] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0186.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.222] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa953534c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0186.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.223] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.224] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26a39c8 | out: lpFileInformation=0x26a39c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0186.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.224] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.224] GetFileType (hFile=0x318) returned 0x1
	[0186.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.224] GetFileType (hFile=0x318) returned 0x1
	[0186.224] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x290
	[0186.225] ReadFile (in: hFile=0x318, lpBuffer=0x26a4134, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a4134*, lpNumberOfBytesRead=0x540efcc*=0x290, lpOverlapped=0x0) returned 1
	[0186.226] CloseHandle (hObject=0x318) returned 1
	[0186.226] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0186.226] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.226] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a51d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0186.226] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.226] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.226] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0186.226] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.226] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26a5288*=0x1, dwFlags=0x0) returned 1
	[0186.226] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26a5254, dwFlags=0x0) returned 1
	[0186.226] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a5298*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x26a5298*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0186.226] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a5544*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a5544*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.227] CryptDestroyKey (hKey=0x82b300) returned 1
	[0186.227] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.227] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.227] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.227] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.253] GetFileType (hFile=0x318) returned 0x1
	[0186.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.253] GetFileType (hFile=0x318) returned 0x1
	[0186.253] WriteFile (in: hFile=0x318, lpBuffer=0x26a57b8*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26a57b8*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0186.254] CloseHandle (hObject=0x318) returned 1
	[0186.254] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.254] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0186.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.254] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9581863, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0186.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.254] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.255] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0186.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.256] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26a6e00 | out: lpFileInformation=0x26a6e00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f2)) returned 1
	[0186.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.256] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0186.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.256] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.257] GetFileType (hFile=0x318) returned 0x1
	[0186.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.257] GetFileType (hFile=0x318) returned 0x1
	[0186.257] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1f2
	[0186.257] ReadFile (in: hFile=0x318, lpBuffer=0x26a7510, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a7510*, lpNumberOfBytesRead=0x540efcc*=0x1f2, lpOverlapped=0x0) returned 1
	[0186.258] CloseHandle (hObject=0x318) returned 1
	[0186.258] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.258] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.258] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a85ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0186.258] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.259] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.259] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0186.259] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.259] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26a8664*=0x1, dwFlags=0x0) returned 1
	[0186.259] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26a8630, dwFlags=0x0) returned 1
	[0186.259] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a8674*, pdwDataLen=0x540efd4*=0x200, dwBufLen=0x200 | out: pbData=0x26a8674*, pdwDataLen=0x540efd4*=0x200) returned 1
	[0186.259] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a8880*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a8880*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.259] CryptDestroyKey (hKey=0x82b300) returned 1
	[0186.259] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.259] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.259] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0186.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.259] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.260] GetFileType (hFile=0x318) returned 0x1
	[0186.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.260] GetFileType (hFile=0x318) returned 0x1
	[0186.260] WriteFile (in: hFile=0x318, lpBuffer=0x26a8b14*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26a8b14*, lpNumberOfBytesWritten=0x540ef94*=0x200, lpOverlapped=0x0) returned 1
	[0186.261] CloseHandle (hObject=0x318) returned 1
	[0186.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0186.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdb
	[0186.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.261] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa95a79fd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1
	[0186.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.262] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.263] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.263] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26aa19c | out: lpFileInformation=0x26aa19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x363)) returned 1
	[0186.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.263] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.263] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.264] GetFileType (hFile=0x318) returned 0x1
	[0186.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.264] GetFileType (hFile=0x318) returned 0x1
	[0186.264] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x363
	[0186.264] ReadFile (in: hFile=0x318, lpBuffer=0x26aa9bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26aa9bc*, lpNumberOfBytesRead=0x540efcc*=0x363, lpOverlapped=0x0) returned 1
	[0186.265] CloseHandle (hObject=0x318) returned 1
	[0186.265] CryptDestroyKey (hKey=0x82b540) returned 1
	[0186.265] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.265] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26aba58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0186.265] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.265] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.266] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0186.266] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.266] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x26abb10*=0x1, dwFlags=0x0) returned 1
	[0186.266] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x26abadc, dwFlags=0x0) returned 1
	[0186.266] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26abb20*, pdwDataLen=0x540efd4*=0x370, dwBufLen=0x370 | out: pbData=0x26abb20*, pdwDataLen=0x540efd4*=0x370) returned 1
	[0186.266] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26abe9c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26abe9c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.266] CryptDestroyKey (hKey=0x82b040) returned 1
	[0186.266] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.266] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.266] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.267] GetFileType (hFile=0x318) returned 0x1
	[0186.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.267] GetFileType (hFile=0x318) returned 0x1
	[0186.267] WriteFile (in: hFile=0x318, lpBuffer=0x26ac100*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26ac100*, lpNumberOfBytesWritten=0x540ef94*=0x370, lpOverlapped=0x0) returned 1
	[0186.268] CloseHandle (hObject=0x318) returned 1
	[0186.269] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.269] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0186.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.269] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa95a79fd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1
	[0186.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.269] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.270] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0186.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.270] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26ad734 | out: lpFileInformation=0x26ad734*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8)) returned 1
	[0186.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.270] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0186.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.270] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.270] GetFileType (hFile=0x318) returned 0x1
	[0186.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.271] GetFileType (hFile=0x318) returned 0x1
	[0186.271] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d8
	[0186.271] ReadFile (in: hFile=0x318, lpBuffer=0x26adef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26adef8*, lpNumberOfBytesRead=0x540efcc*=0x2d8, lpOverlapped=0x0) returned 1
	[0186.272] CloseHandle (hObject=0x318) returned 1
	[0186.272] CryptDestroyKey (hKey=0x82b080) returned 1
	[0186.272] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.272] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26aef94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.272] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.272] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.272] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0186.273] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.273] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26af04c*=0x1, dwFlags=0x0) returned 1
	[0186.273] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26af018, dwFlags=0x0) returned 1
	[0186.273] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26af05c*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26af05c*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0186.273] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26af348*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26af348*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.273] CryptDestroyKey (hKey=0x82b200) returned 1
	[0186.273] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.273] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.273] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0186.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.273] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.274] GetFileType (hFile=0x318) returned 0x1
	[0186.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.274] GetFileType (hFile=0x318) returned 0x1
	[0186.274] WriteFile (in: hFile=0x318, lpBuffer=0x26af5c4*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26af5c4*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0186.275] CloseHandle (hObject=0x318) returned 1
	[0186.276] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0186.276] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0186.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.276] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa95cdc48, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0186.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.276] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.277] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0186.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.277] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b0c28 | out: lpFileInformation=0x26b0c28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc)) returned 1
	[0186.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.371] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.371] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.371] GetFileType (hFile=0x318) returned 0x1
	[0186.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.371] GetFileType (hFile=0x318) returned 0x1
	[0186.371] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c9
	[0186.372] ReadFile (in: hFile=0x318, lpBuffer=0x26c1748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c1748*, lpNumberOfBytesRead=0x540efcc*=0x2c9, lpOverlapped=0x0) returned 1
	[0186.373] CloseHandle (hObject=0x318) returned 1
	[0186.373] CryptDestroyKey (hKey=0x82b480) returned 1
	[0186.373] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.373] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c27e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.374] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.374] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.374] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0186.374] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.374] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26c289c*=0x1, dwFlags=0x0) returned 1
	[0186.374] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26c2868, dwFlags=0x0) returned 1
	[0186.374] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c28ac*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26c28ac*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.374] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c2b88*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c2b88*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.374] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.374] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.374] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.374] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.375] GetFileType (hFile=0x318) returned 0x1
	[0186.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.376] GetFileType (hFile=0x318) returned 0x1
	[0186.376] WriteFile (in: hFile=0x318, lpBuffer=0x26c2ddc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26c2ddc*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.377] CloseHandle (hObject=0x318) returned 1
	[0186.377] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.377] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0186.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.377] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa96b2b4f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.377] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.378] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.378] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26c43f0 | out: lpFileInformation=0x26c43f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c1dec7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x292)) returned 1
	[0186.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.379] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.379] GetFileType (hFile=0x318) returned 0x1
	[0186.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.379] GetFileType (hFile=0x318) returned 0x1
	[0186.379] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x292
	[0186.379] ReadFile (in: hFile=0x318, lpBuffer=0x26c4b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c4b30*, lpNumberOfBytesRead=0x540efcc*=0x292, lpOverlapped=0x0) returned 1
	[0186.381] CloseHandle (hObject=0x318) returned 1
	[0186.381] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.381] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c5bcc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0186.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.381] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0186.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.381] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26c5c84*=0x1, dwFlags=0x0) returned 1
	[0186.381] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26c5c50, dwFlags=0x0) returned 1
	[0186.381] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c5c94*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x26c5c94*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0186.381] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c5f40*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c5f40*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.381] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0186.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.382] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.383] GetFileType (hFile=0x318) returned 0x1
	[0186.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.383] GetFileType (hFile=0x318) returned 0x1
	[0186.383] WriteFile (in: hFile=0x318, lpBuffer=0x26c619c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26c619c*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0186.384] CloseHandle (hObject=0x318) returned 1
	[0186.384] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.385] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0186.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.385] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa96b2b4f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0186.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.385] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.386] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26c77c0 | out: lpFileInformation=0x26c77c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c1dec7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e)) returned 1
	[0186.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.387] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.387] GetFileType (hFile=0x318) returned 0x1
	[0186.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.387] GetFileType (hFile=0x318) returned 0x1
	[0186.387] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x28e
	[0186.387] ReadFile (in: hFile=0x318, lpBuffer=0x26c7efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c7efc*, lpNumberOfBytesRead=0x540efcc*=0x28e, lpOverlapped=0x0) returned 1
	[0186.388] CloseHandle (hObject=0x318) returned 1
	[0186.388] CryptDestroyKey (hKey=0x82b280) returned 1
	[0186.389] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.389] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c8f98, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.389] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.389] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.389] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0186.389] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.389] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26c9050*=0x1, dwFlags=0x0) returned 1
	[0186.389] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26c901c, dwFlags=0x0) returned 1
	[0186.389] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c9060*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x26c9060*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0186.389] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c92fc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c92fc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.389] CryptDestroyKey (hKey=0x82b540) returned 1
	[0186.389] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.389] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.389] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.391] GetFileType (hFile=0x318) returned 0x1
	[0186.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.391] GetFileType (hFile=0x318) returned 0x1
	[0186.391] WriteFile (in: hFile=0x318, lpBuffer=0x26c9558*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26c9558*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0186.392] CloseHandle (hObject=0x318) returned 1
	[0186.392] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.392] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0186.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.392] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa96d8d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0186.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.392] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.393] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.393] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26cab7c | out: lpFileInformation=0x26cab7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c44137, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285)) returned 1
	[0186.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.394] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.394] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.394] GetFileType (hFile=0x318) returned 0x1
	[0186.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.394] GetFileType (hFile=0x318) returned 0x1
	[0186.394] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x285
	[0186.394] ReadFile (in: hFile=0x318, lpBuffer=0x26cb2b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26cb2b0*, lpNumberOfBytesRead=0x540efcc*=0x285, lpOverlapped=0x0) returned 1
	[0186.396] CloseHandle (hObject=0x318) returned 1
	[0186.396] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.396] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.396] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26cc34c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0186.396] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.396] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.396] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0186.396] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.396] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26cc404*=0x1, dwFlags=0x0) returned 1
	[0186.396] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26cc3d0, dwFlags=0x0) returned 1
	[0186.396] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26cc414*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x26cc414*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0186.396] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26cc6b0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26cc6b0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.396] CryptDestroyKey (hKey=0x82b540) returned 1
	[0186.396] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.396] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.396] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.396] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.398] GetFileType (hFile=0x318) returned 0x1
	[0186.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.398] GetFileType (hFile=0x318) returned 0x1
	[0186.398] WriteFile (in: hFile=0x318, lpBuffer=0x26cc90c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26cc90c*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0186.398] CloseHandle (hObject=0x318) returned 1
	[0186.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0186.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.399] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa96d8d43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0186.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.399] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0186.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.400] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26cdf30 | out: lpFileInformation=0x26cdf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0186.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0186.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.401] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.401] GetFileType (hFile=0x318) returned 0x1
	[0186.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.401] GetFileType (hFile=0x318) returned 0x1
	[0186.401] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cf
	[0186.401] ReadFile (in: hFile=0x318, lpBuffer=0x26ce6bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ce6bc*, lpNumberOfBytesRead=0x540efcc*=0x2cf, lpOverlapped=0x0) returned 1
	[0186.403] CloseHandle (hObject=0x318) returned 1
	[0186.403] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0186.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.403] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26cf758, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0186.403] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.403] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.403] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0186.403] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.403] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26cf810*=0x1, dwFlags=0x0) returned 1
	[0186.403] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26cf7dc, dwFlags=0x0) returned 1
	[0186.403] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26cf820*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26cf820*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.403] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26cfafc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26cfafc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.403] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0186.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.403] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0186.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.404] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.405] GetFileType (hFile=0x318) returned 0x1
	[0186.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.405] GetFileType (hFile=0x318) returned 0x1
	[0186.405] WriteFile (in: hFile=0x318, lpBuffer=0x26cfd60*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26cfd60*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.406] CloseHandle (hObject=0x318) returned 1
	[0186.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0186.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0186.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.406] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa96ff3df, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.407] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0186.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.408] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26d1388 | out: lpFileInformation=0x26d1388*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c44137, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc)) returned 1
	[0186.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.408] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0186.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.408] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.408] GetFileType (hFile=0x318) returned 0x1
	[0186.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.408] GetFileType (hFile=0x318) returned 0x1
	[0186.408] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2dc
	[0186.408] ReadFile (in: hFile=0x318, lpBuffer=0x26d1b50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d1b50*, lpNumberOfBytesRead=0x540efcc*=0x2dc, lpOverlapped=0x0) returned 1
	[0186.437] CloseHandle (hObject=0x318) returned 1
	[0186.437] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.437] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.437] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d2bec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0186.437] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.437] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.437] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0186.437] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.437] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x26d2ca4*=0x1, dwFlags=0x0) returned 1
	[0186.437] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x26d2c70, dwFlags=0x0) returned 1
	[0186.437] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d2cb4*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26d2cb4*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0186.437] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d2fa0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26d2fa0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.437] CryptDestroyKey (hKey=0x82b000) returned 1
	[0186.438] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.438] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.438] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0186.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.438] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.439] GetFileType (hFile=0x318) returned 0x1
	[0186.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.439] GetFileType (hFile=0x318) returned 0x1
	[0186.439] WriteFile (in: hFile=0x318, lpBuffer=0x26d321c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26d321c*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0186.440] CloseHandle (hObject=0x318) returned 1
	[0186.440] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0186.440] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0186.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.440] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa974b4b3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0186.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.440] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.441] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0186.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.442] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26d4874 | out: lpFileInformation=0x26d4874*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c44137, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34d)) returned 1
	[0186.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.442] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0186.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.442] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.442] GetFileType (hFile=0x318) returned 0x1
	[0186.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.442] GetFileType (hFile=0x318) returned 0x1
	[0186.443] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34d
	[0186.443] ReadFile (in: hFile=0x318, lpBuffer=0x26d5050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d5050*, lpNumberOfBytesRead=0x540efcc*=0x34d, lpOverlapped=0x0) returned 1
	[0186.444] CloseHandle (hObject=0x318) returned 1
	[0186.444] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.444] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.444] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d60ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0186.444] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.444] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.444] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0186.444] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.444] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26d61a4*=0x1, dwFlags=0x0) returned 1
	[0186.444] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26d6170, dwFlags=0x0) returned 1
	[0186.444] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d61b4*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x26d61b4*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0186.444] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d6510*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26d6510*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.444] CryptDestroyKey (hKey=0x82b540) returned 1
	[0186.444] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.444] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.444] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0186.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.445] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.446] GetFileType (hFile=0x318) returned 0x1
	[0186.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.446] GetFileType (hFile=0x318) returned 0x1
	[0186.446] WriteFile (in: hFile=0x318, lpBuffer=0x26d675c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26d675c*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0186.446] CloseHandle (hObject=0x318) returned 1
	[0186.446] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0186.447] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0186.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.447] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa974b4b3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0186.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.447] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.448] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0186.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.448] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26d7d60 | out: lpFileInformation=0x26d7d60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c6a39e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x349)) returned 1
	[0186.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.449] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0186.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.449] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.449] GetFileType (hFile=0x318) returned 0x1
	[0186.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.449] GetFileType (hFile=0x318) returned 0x1
	[0186.449] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x349
	[0186.449] ReadFile (in: hFile=0x318, lpBuffer=0x26d8528, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d8528*, lpNumberOfBytesRead=0x540efcc*=0x349, lpOverlapped=0x0) returned 1
	[0186.450] CloseHandle (hObject=0x318) returned 1
	[0186.450] CryptDestroyKey (hKey=0x82b280) returned 1
	[0186.450] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.450] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d95c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.450] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.450] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.450] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0186.450] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.450] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26d967c*=0x1, dwFlags=0x0) returned 1
	[0186.450] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26d9648, dwFlags=0x0) returned 1
	[0186.451] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d968c*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x26d968c*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0186.451] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d99e8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26d99e8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.451] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.451] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.451] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.451] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0186.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.451] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.452] GetFileType (hFile=0x318) returned 0x1
	[0186.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.452] GetFileType (hFile=0x318) returned 0x1
	[0186.452] WriteFile (in: hFile=0x318, lpBuffer=0x26d9c2c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26d9c2c*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0186.453] CloseHandle (hObject=0x318) returned 1
	[0186.453] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0186.453] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0186.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.453] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9771625, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0186.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.453] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.454] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.454] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26db220 | out: lpFileInformation=0x26db220*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c6a39e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c6a39e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c6a39e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c)) returned 1
	[0186.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.454] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.454] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.454] GetFileType (hFile=0x318) returned 0x1
	[0186.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.454] GetFileType (hFile=0x318) returned 0x1
	[0186.454] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34c
	[0186.455] ReadFile (in: hFile=0x318, lpBuffer=0x26dba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26dba08*, lpNumberOfBytesRead=0x540efcc*=0x34c, lpOverlapped=0x0) returned 1
	[0186.456] CloseHandle (hObject=0x318) returned 1
	[0186.456] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.456] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.456] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26dcaa4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0186.456] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.456] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.456] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0186.456] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.456] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26dcb5c*=0x1, dwFlags=0x0) returned 1
	[0186.456] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26dcb28, dwFlags=0x0) returned 1
	[0186.456] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26dcb6c*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x26dcb6c*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0186.456] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dcec8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26dcec8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.456] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.456] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.456] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.456] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.456] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.457] GetFileType (hFile=0x318) returned 0x1
	[0186.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.457] GetFileType (hFile=0x318) returned 0x1
	[0186.457] WriteFile (in: hFile=0x318, lpBuffer=0x26dd11c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26dd11c*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0186.458] CloseHandle (hObject=0x318) returned 1
	[0186.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0186.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.458] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c6a39e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c6a39e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9771625, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0186.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.459] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.459] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.459] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26de724 | out: lpFileInformation=0x26de724*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c6a39e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c6a39e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c6a39e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0186.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.460] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.460] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.460] GetFileType (hFile=0x318) returned 0x1
	[0186.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.460] GetFileType (hFile=0x318) returned 0x1
	[0186.460] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c9
	[0186.460] ReadFile (in: hFile=0x318, lpBuffer=0x26deecc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26deecc*, lpNumberOfBytesRead=0x540efcc*=0x2c9, lpOverlapped=0x0) returned 1
	[0186.461] CloseHandle (hObject=0x318) returned 1
	[0186.461] CryptDestroyKey (hKey=0x82b480) returned 1
	[0186.461] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.461] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26dff68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.461] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.461] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.461] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0186.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.462] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26e0020*=0x1, dwFlags=0x0) returned 1
	[0186.462] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26dffec, dwFlags=0x0) returned 1
	[0186.462] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e0030*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26e0030*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.462] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e030c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e030c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.462] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.462] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.462] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.463] GetFileType (hFile=0x318) returned 0x1
	[0186.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.463] GetFileType (hFile=0x318) returned 0x1
	[0186.463] WriteFile (in: hFile=0x318, lpBuffer=0x26e0580*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26e0580*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.464] CloseHandle (hObject=0x318) returned 1
	[0186.464] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.464] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0186.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.464] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c6a39e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c6a39e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa979787b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.465] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0186.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.466] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26e1bc8 | out: lpFileInformation=0x26e1bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c6a39e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c6a39e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c6a39e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7)) returned 1
	[0186.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0186.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.467] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.467] GetFileType (hFile=0x318) returned 0x1
	[0186.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.467] GetFileType (hFile=0x318) returned 0x1
	[0186.467] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c7
	[0186.467] ReadFile (in: hFile=0x318, lpBuffer=0x26e233c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e233c*, lpNumberOfBytesRead=0x540efcc*=0x2c7, lpOverlapped=0x0) returned 1
	[0186.469] CloseHandle (hObject=0x318) returned 1
	[0186.469] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.469] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.469] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e33d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0186.469] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.469] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.469] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0186.469] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.469] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26e3490*=0x1, dwFlags=0x0) returned 1
	[0186.469] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26e345c, dwFlags=0x0) returned 1
	[0186.469] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e34a0*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26e34a0*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.469] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e377c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e377c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.469] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0186.469] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.469] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0186.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.469] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.471] GetFileType (hFile=0x318) returned 0x1
	[0186.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.471] GetFileType (hFile=0x318) returned 0x1
	[0186.471] WriteFile (in: hFile=0x318, lpBuffer=0x26e39d8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26e39d8*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.472] CloseHandle (hObject=0x318) returned 1
	[0186.472] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0186.472] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0186.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.472] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c6a39e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c6a39e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa979787b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.472] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0186.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.473] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26e4ff0 | out: lpFileInformation=0x26e4ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0186.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0186.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.474] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.474] GetFileType (hFile=0x318) returned 0x1
	[0186.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.474] GetFileType (hFile=0x318) returned 0x1
	[0186.474] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c8
	[0186.474] ReadFile (in: hFile=0x318, lpBuffer=0x26e5744, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e5744*, lpNumberOfBytesRead=0x540efcc*=0x2c8, lpOverlapped=0x0) returned 1
	[0186.499] CloseHandle (hObject=0x318) returned 1
	[0186.499] CryptDestroyKey (hKey=0x82b040) returned 1
	[0186.499] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.499] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e67e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0186.499] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.499] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.499] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0186.499] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.499] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26e6898*=0x1, dwFlags=0x0) returned 1
	[0186.499] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x26e6864, dwFlags=0x0) returned 1
	[0186.500] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e68a8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26e68a8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.500] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e6b84*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e6b84*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.500] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0186.500] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.500] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0186.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.500] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.501] GetFileType (hFile=0x318) returned 0x1
	[0186.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.501] GetFileType (hFile=0x318) returned 0x1
	[0186.501] WriteFile (in: hFile=0x318, lpBuffer=0x26e6dd0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26e6dd0*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.502] CloseHandle (hObject=0x318) returned 1
	[0186.503] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0186.503] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0186.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.503] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa97e3e12, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.503] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0186.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.504] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26e83c8 | out: lpFileInformation=0x26e83c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb)) returned 1
	[0186.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0186.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.505] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.505] GetFileType (hFile=0x318) returned 0x1
	[0186.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.505] GetFileType (hFile=0x318) returned 0x1
	[0186.505] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cb
	[0186.505] ReadFile (in: hFile=0x318, lpBuffer=0x26e8a40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e8a40*, lpNumberOfBytesRead=0x540efcc*=0x1cb, lpOverlapped=0x0) returned 1
	[0186.506] CloseHandle (hObject=0x318) returned 1
	[0186.506] CryptDestroyKey (hKey=0x82b480) returned 1
	[0186.507] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.507] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e9adc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0186.507] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.507] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.507] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0186.507] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.507] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26e9b94*=0x1, dwFlags=0x0) returned 1
	[0186.507] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26e9b60, dwFlags=0x0) returned 1
	[0186.507] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e9ba4*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26e9ba4*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0186.507] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e9d80*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e9d80*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.507] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0186.507] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.507] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.507] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0186.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.507] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.509] GetFileType (hFile=0x318) returned 0x1
	[0186.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.509] GetFileType (hFile=0x318) returned 0x1
	[0186.509] WriteFile (in: hFile=0x318, lpBuffer=0x26e9fdc*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26e9fdc*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0186.510] CloseHandle (hObject=0x318) returned 1
	[0186.510] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0186.510] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0186.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.510] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa980a0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0186.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.511] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.513] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.513] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26eb5f4 | out: lpFileInformation=0x26eb5f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c8)) returned 1
	[0186.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.513] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.514] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.514] GetFileType (hFile=0x318) returned 0x1
	[0186.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.514] GetFileType (hFile=0x318) returned 0x1
	[0186.514] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1c8
	[0186.514] ReadFile (in: hFile=0x318, lpBuffer=0x26ebbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ebbe8*, lpNumberOfBytesRead=0x540efcc*=0x1c8, lpOverlapped=0x0) returned 1
	[0186.515] CloseHandle (hObject=0x318) returned 1
	[0186.515] CryptDestroyKey (hKey=0x82b340) returned 1
	[0186.515] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.515] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ecc84, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.515] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.515] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.515] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0186.515] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.516] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26ecd3c*=0x1, dwFlags=0x0) returned 1
	[0186.516] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26ecd08, dwFlags=0x0) returned 1
	[0186.516] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ecd4c*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26ecd4c*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0186.516] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ecf28*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26ecf28*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.516] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0186.516] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.516] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.516] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.516] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.517] GetFileType (hFile=0x318) returned 0x1
	[0186.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.517] GetFileType (hFile=0x318) returned 0x1
	[0186.517] WriteFile (in: hFile=0x318, lpBuffer=0x26ed144*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26ed144*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0186.518] CloseHandle (hObject=0x318) returned 1
	[0186.518] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.518] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0186.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.518] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa980a0e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0186.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.519] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.520] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.520] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26ee6e8 | out: lpFileInformation=0x26ee6e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35a)) returned 1
	[0186.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.520] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.521] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.521] GetFileType (hFile=0x318) returned 0x1
	[0186.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.521] GetFileType (hFile=0x318) returned 0x1
	[0186.521] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x35a
	[0186.521] ReadFile (in: hFile=0x318, lpBuffer=0x26eef00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26eef00*, lpNumberOfBytesRead=0x540efcc*=0x35a, lpOverlapped=0x0) returned 1
	[0186.533] CloseHandle (hObject=0x318) returned 1
	[0186.534] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.534] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26eff9c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b0c0) returned 1
	[0186.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.534] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0186.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.534] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26f0054*=0x1, dwFlags=0x0) returned 1
	[0186.534] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26f0020, dwFlags=0x0) returned 1
	[0186.534] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f0064*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x26f0064*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0186.534] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f03d0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f03d0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.534] CryptDestroyKey (hKey=0x82b300) returned 1
	[0186.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.534] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.534] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.536] GetFileType (hFile=0x318) returned 0x1
	[0186.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.536] GetFileType (hFile=0x318) returned 0x1
	[0186.536] WriteFile (in: hFile=0x318, lpBuffer=0x26f0634*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26f0634*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0186.537] CloseHandle (hObject=0x318) returned 1
	[0186.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0186.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.537] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa98302da, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0186.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.537] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.538] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.539] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f1c68 | out: lpFileInformation=0x26f1c68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0186.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.540] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.540] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.540] GetFileType (hFile=0x318) returned 0x1
	[0186.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.540] GetFileType (hFile=0x318) returned 0x1
	[0186.540] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c3
	[0186.540] ReadFile (in: hFile=0x318, lpBuffer=0x26f23d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f23d8*, lpNumberOfBytesRead=0x540efcc*=0x2c3, lpOverlapped=0x0) returned 1
	[0186.542] CloseHandle (hObject=0x318) returned 1
	[0186.542] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0186.542] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.542] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f3474, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0186.542] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.542] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.542] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0186.542] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.542] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26f352c*=0x1, dwFlags=0x0) returned 1
	[0186.542] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26f34f8, dwFlags=0x0) returned 1
	[0186.542] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f353c*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26f353c*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.543] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f3818*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f3818*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.543] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.543] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.543] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.543] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.543] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.544] GetFileType (hFile=0x318) returned 0x1
	[0186.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.544] GetFileType (hFile=0x318) returned 0x1
	[0186.544] WriteFile (in: hFile=0x318, lpBuffer=0x26f3a74*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26f3a74*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.545] CloseHandle (hObject=0x318) returned 1
	[0186.546] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.546] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0186.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.546] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9856474, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.546] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.547] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.547] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f5098 | out: lpFileInformation=0x26f5098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0186.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.568] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.568] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.569] GetFileType (hFile=0x318) returned 0x1
	[0186.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.569] GetFileType (hFile=0x318) returned 0x1
	[0186.569] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1e0
	[0186.569] ReadFile (in: hFile=0x318, lpBuffer=0x26f56a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f56a4*, lpNumberOfBytesRead=0x540efcc*=0x1e0, lpOverlapped=0x0) returned 1
	[0186.570] CloseHandle (hObject=0x318) returned 1
	[0186.570] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.570] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.570] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f6740, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0186.570] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.570] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.570] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0186.570] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.570] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26f67f8*=0x1, dwFlags=0x0) returned 1
	[0186.570] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26f67c4, dwFlags=0x0) returned 1
	[0186.570] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f6808*, pdwDataLen=0x540efd4*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x26f6808*, pdwDataLen=0x540efd4*=0x1f0) returned 1
	[0186.571] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f6a04*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f6a04*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.571] CryptDestroyKey (hKey=0x82b340) returned 1
	[0186.571] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.571] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.571] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.571] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.572] GetFileType (hFile=0x318) returned 0x1
	[0186.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.572] GetFileType (hFile=0x318) returned 0x1
	[0186.573] WriteFile (in: hFile=0x318, lpBuffer=0x26f6c20*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26f6c20*, lpNumberOfBytesWritten=0x540ef94*=0x1f0, lpOverlapped=0x0) returned 1
	[0186.573] CloseHandle (hObject=0x318) returned 1
	[0186.574] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.574] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0186.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.574] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa98a298d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0186.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.574] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.576] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.576] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f81c4 | out: lpFileInformation=0x26f81c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283)) returned 1
	[0186.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.576] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.576] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.577] GetFileType (hFile=0x318) returned 0x1
	[0186.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.577] GetFileType (hFile=0x318) returned 0x1
	[0186.577] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x283
	[0186.577] ReadFile (in: hFile=0x318, lpBuffer=0x26f88f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f88f4*, lpNumberOfBytesRead=0x540efcc*=0x283, lpOverlapped=0x0) returned 1
	[0186.578] CloseHandle (hObject=0x318) returned 1
	[0186.578] CryptDestroyKey (hKey=0x82b300) returned 1
	[0186.578] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.579] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f9990, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0186.579] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.579] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.579] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0186.579] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.579] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x26f9a48*=0x1, dwFlags=0x0) returned 1
	[0186.579] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x26f9a14, dwFlags=0x0) returned 1
	[0186.579] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f9a58*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x26f9a58*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0186.579] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f9cf4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f9cf4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.579] CryptDestroyKey (hKey=0x82b040) returned 1
	[0186.579] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.579] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.579] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.579] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.580] GetFileType (hFile=0x318) returned 0x1
	[0186.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.581] GetFileType (hFile=0x318) returned 0x1
	[0186.581] WriteFile (in: hFile=0x318, lpBuffer=0x26f9f50*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26f9f50*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0186.582] CloseHandle (hObject=0x318) returned 1
	[0186.582] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.582] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0186.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.582] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa98a298d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0186.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.582] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.583] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.583] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26fb574 | out: lpFileInformation=0x26fb574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0186.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.584] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.584] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.584] GetFileType (hFile=0x318) returned 0x1
	[0186.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.584] GetFileType (hFile=0x318) returned 0x1
	[0186.584] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d3
	[0186.584] ReadFile (in: hFile=0x318, lpBuffer=0x26fbcf4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26fbcf4*, lpNumberOfBytesRead=0x540efcc*=0x2d3, lpOverlapped=0x0) returned 1
	[0186.586] CloseHandle (hObject=0x318) returned 1
	[0186.586] CryptDestroyKey (hKey=0x82b080) returned 1
	[0186.586] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.586] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fcd90, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0186.586] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.586] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.586] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0186.586] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.586] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26fce48*=0x1, dwFlags=0x0) returned 1
	[0186.586] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26fce14, dwFlags=0x0) returned 1
	[0186.586] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fce58*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26fce58*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0186.586] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fd144*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26fd144*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.586] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.586] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.586] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.586] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.588] GetFileType (hFile=0x318) returned 0x1
	[0186.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.588] GetFileType (hFile=0x318) returned 0x1
	[0186.588] WriteFile (in: hFile=0x318, lpBuffer=0x26fd3a0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26fd3a0*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0186.589] CloseHandle (hObject=0x318) returned 1
	[0186.589] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.589] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0186.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.589] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa98c8b5d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0186.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.589] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.590] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0186.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.590] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26fe9c4 | out: lpFileInformation=0x26fe9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cb6875, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27f)) returned 1
	[0186.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0186.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.591] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.591] GetFileType (hFile=0x318) returned 0x1
	[0186.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.591] GetFileType (hFile=0x318) returned 0x1
	[0186.591] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x27f
	[0186.591] ReadFile (in: hFile=0x318, lpBuffer=0x26ff0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ff0c0*, lpNumberOfBytesRead=0x540efcc*=0x27f, lpOverlapped=0x0) returned 1
	[0186.593] CloseHandle (hObject=0x318) returned 1
	[0186.593] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.593] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.593] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270015c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.593] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0186.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.593] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2700214*=0x1, dwFlags=0x0) returned 1
	[0186.593] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27001e0, dwFlags=0x0) returned 1
	[0186.593] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2700224*, pdwDataLen=0x540efd4*=0x280, dwBufLen=0x280 | out: pbData=0x2700224*, pdwDataLen=0x540efd4*=0x280) returned 1
	[0186.593] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27004b0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27004b0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.593] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.594] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.594] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0186.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.594] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.595] GetFileType (hFile=0x318) returned 0x1
	[0186.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.595] GetFileType (hFile=0x318) returned 0x1
	[0186.595] WriteFile (in: hFile=0x318, lpBuffer=0x27006f4*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27006f4*, lpNumberOfBytesWritten=0x540ef94*=0x280, lpOverlapped=0x0) returned 1
	[0186.596] CloseHandle (hObject=0x318) returned 1
	[0186.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0186.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0186.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.596] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa98c8b5d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0186.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.597] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.598] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.598] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2701ce8 | out: lpFileInformation=0x2701ce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cb6875, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd)) returned 1
	[0186.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.598] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.598] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.598] GetFileType (hFile=0x318) returned 0x1
	[0186.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.598] GetFileType (hFile=0x318) returned 0x1
	[0186.598] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2dd
	[0186.598] ReadFile (in: hFile=0x318, lpBuffer=0x2702494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2702494*, lpNumberOfBytesRead=0x540efcc*=0x2dd, lpOverlapped=0x0) returned 1
	[0186.600] CloseHandle (hObject=0x318) returned 1
	[0186.600] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.600] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.600] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2703530, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0186.600] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.600] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.600] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0186.600] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.600] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27035e8*=0x1, dwFlags=0x0) returned 1
	[0186.600] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27035b4, dwFlags=0x0) returned 1
	[0186.601] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27035f8*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27035f8*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0186.601] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27038e4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27038e4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.601] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0186.601] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.601] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.601] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.602] GetFileType (hFile=0x318) returned 0x1
	[0186.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.602] GetFileType (hFile=0x318) returned 0x1
	[0186.602] WriteFile (in: hFile=0x318, lpBuffer=0x2703b50*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2703b50*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0186.622] CloseHandle (hObject=0x318) returned 1
	[0186.622] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.622] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0186.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.622] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa99150ba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0186.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.623] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.627] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.627] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2705188 | out: lpFileInformation=0x2705188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cb6875, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5)) returned 1
	[0186.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.627] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.628] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.628] GetFileType (hFile=0x318) returned 0x1
	[0186.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.628] GetFileType (hFile=0x318) returned 0x1
	[0186.628] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d5
	[0186.628] ReadFile (in: hFile=0x318, lpBuffer=0x270592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x270592c*, lpNumberOfBytesRead=0x540efcc*=0x2d5, lpOverlapped=0x0) returned 1
	[0186.629] CloseHandle (hObject=0x318) returned 1
	[0186.630] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.630] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.630] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27069c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.630] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.630] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.630] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b2c0) returned 1
	[0186.630] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.630] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2706a80*=0x1, dwFlags=0x0) returned 1
	[0186.630] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2706a4c, dwFlags=0x0) returned 1
	[0186.630] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2706a90*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2706a90*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0186.630] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2706d7c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2706d7c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.630] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0186.630] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.630] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.630] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.630] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.632] GetFileType (hFile=0x318) returned 0x1
	[0186.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.632] GetFileType (hFile=0x318) returned 0x1
	[0186.632] WriteFile (in: hFile=0x318, lpBuffer=0x2706fe8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2706fe8*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0186.633] CloseHandle (hObject=0x318) returned 1
	[0186.633] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.633] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0186.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.633] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa99150ba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0186.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.633] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.635] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.635] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2708620 | out: lpFileInformation=0x2708620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cb6875, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0186.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.635] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.635] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.635] GetFileType (hFile=0x318) returned 0x1
	[0186.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.635] GetFileType (hFile=0x318) returned 0x1
	[0186.635] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1e0
	[0186.635] ReadFile (in: hFile=0x318, lpBuffer=0x2708c2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2708c2c*, lpNumberOfBytesRead=0x540efcc*=0x1e0, lpOverlapped=0x0) returned 1
	[0186.636] CloseHandle (hObject=0x318) returned 1
	[0186.636] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.636] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.636] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2709cc8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.637] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.637] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.637] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0186.637] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.637] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2709d80*=0x1, dwFlags=0x0) returned 1
	[0186.637] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2709d4c, dwFlags=0x0) returned 1
	[0186.637] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2709d90*, pdwDataLen=0x540efd4*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x2709d90*, pdwDataLen=0x540efd4*=0x1f0) returned 1
	[0186.637] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2709f8c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2709f8c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.637] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0186.637] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.637] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.637] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.637] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.638] GetFileType (hFile=0x318) returned 0x1
	[0186.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.638] GetFileType (hFile=0x318) returned 0x1
	[0186.638] WriteFile (in: hFile=0x318, lpBuffer=0x270a1a8*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x270a1a8*, lpNumberOfBytesWritten=0x540ef94*=0x1f0, lpOverlapped=0x0) returned 1
	[0186.639] CloseHandle (hObject=0x318) returned 1
	[0186.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0186.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.639] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa993bae4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0186.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.640] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.641] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0186.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.641] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x270b74c | out: lpFileInformation=0x270b74c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.641] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0186.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.641] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.641] GetFileType (hFile=0x318) returned 0x1
	[0186.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.642] GetFileType (hFile=0x318) returned 0x1
	[0186.642] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d0
	[0186.642] ReadFile (in: hFile=0x318, lpBuffer=0x270bf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x270bf28*, lpNumberOfBytesRead=0x540efcc*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.643] CloseHandle (hObject=0x318) returned 1
	[0186.643] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.643] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.643] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270cfc4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0186.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.643] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0186.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.643] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x270d07c*=0x1, dwFlags=0x0) returned 1
	[0186.644] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x270d048, dwFlags=0x0) returned 1
	[0186.644] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270d08c*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x270d08c*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0186.644] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270d378*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x270d378*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.644] CryptDestroyKey (hKey=0x82b000) returned 1
	[0186.644] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.644] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0186.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.644] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.645] GetFileType (hFile=0x318) returned 0x1
	[0186.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.645] GetFileType (hFile=0x318) returned 0x1
	[0186.645] WriteFile (in: hFile=0x318, lpBuffer=0x270d604*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x270d604*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0186.646] CloseHandle (hObject=0x318) returned 1
	[0186.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0186.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd9
	[0186.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.646] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa993bae4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0186.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.646] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.647] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.647] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x270ec7c | out: lpFileInformation=0x270ec7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5)) returned 1
	[0186.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.648] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.648] GetFileType (hFile=0x318) returned 0x1
	[0186.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.648] GetFileType (hFile=0x318) returned 0x1
	[0186.648] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c5
	[0186.648] ReadFile (in: hFile=0x318, lpBuffer=0x270f410, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x270f410*, lpNumberOfBytesRead=0x540efcc*=0x2c5, lpOverlapped=0x0) returned 1
	[0186.649] CloseHandle (hObject=0x318) returned 1
	[0186.649] CryptDestroyKey (hKey=0x82b040) returned 1
	[0186.649] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.650] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27104ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0186.650] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.650] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.650] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0186.650] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.650] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2710564*=0x1, dwFlags=0x0) returned 1
	[0186.650] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2710530, dwFlags=0x0) returned 1
	[0186.650] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2710574*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2710574*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.650] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2710850*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2710850*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.650] CryptDestroyKey (hKey=0x82b540) returned 1
	[0186.650] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.650] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.650] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.651] GetFileType (hFile=0x318) returned 0x1
	[0186.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.651] GetFileType (hFile=0x318) returned 0x1
	[0186.651] WriteFile (in: hFile=0x318, lpBuffer=0x2710abc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2710abc*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.652] CloseHandle (hObject=0x318) returned 1
	[0186.652] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.652] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0186.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.653] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9961515, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.653] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.653] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.654] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27120f4 | out: lpFileInformation=0x27120f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0186.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.654] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.654] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.654] GetFileType (hFile=0x318) returned 0x1
	[0186.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.654] GetFileType (hFile=0x318) returned 0x1
	[0186.654] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c3
	[0186.654] ReadFile (in: hFile=0x318, lpBuffer=0x2712884, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2712884*, lpNumberOfBytesRead=0x540efcc*=0x2c3, lpOverlapped=0x0) returned 1
	[0186.686] CloseHandle (hObject=0x318) returned 1
	[0186.687] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0186.687] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.687] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2713920, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0186.687] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.687] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.687] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0186.687] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.687] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27139d8*=0x1, dwFlags=0x0) returned 1
	[0186.687] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27139a4, dwFlags=0x0) returned 1
	[0186.687] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27139e8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27139e8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.687] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2713cc4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2713cc4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.687] CryptDestroyKey (hKey=0x82b300) returned 1
	[0186.687] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.687] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.687] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.687] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.688] GetFileType (hFile=0x318) returned 0x1
	[0186.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.688] GetFileType (hFile=0x318) returned 0x1
	[0186.689] WriteFile (in: hFile=0x318, lpBuffer=0x2713f30*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2713f30*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.689] CloseHandle (hObject=0x318) returned 1
	[0186.690] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.690] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0186.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.690] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa99ada45, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.690] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.691] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.691] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2715568 | out: lpFileInformation=0x2715568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0186.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.691] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.691] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.691] GetFileType (hFile=0x318) returned 0x1
	[0186.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.692] GetFileType (hFile=0x318) returned 0x1
	[0186.692] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cc
	[0186.692] ReadFile (in: hFile=0x318, lpBuffer=0x2715cd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2715cd0*, lpNumberOfBytesRead=0x540efcc*=0x2cc, lpOverlapped=0x0) returned 1
	[0186.693] CloseHandle (hObject=0x318) returned 1
	[0186.693] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0186.693] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.693] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2716d6c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0186.693] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.693] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.693] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0186.693] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.694] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2716e24*=0x1, dwFlags=0x0) returned 1
	[0186.694] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2716df0, dwFlags=0x0) returned 1
	[0186.694] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2716e34*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2716e34*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.694] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2717110*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2717110*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.694] CryptDestroyKey (hKey=0x82b300) returned 1
	[0186.694] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.694] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.694] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.694] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.695] GetFileType (hFile=0x318) returned 0x1
	[0186.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.695] GetFileType (hFile=0x318) returned 0x1
	[0186.695] WriteFile (in: hFile=0x318, lpBuffer=0x2717364*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2717364*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.696] CloseHandle (hObject=0x318) returned 1
	[0186.696] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.696] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0186.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.696] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa99ada45, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.696] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.698] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.698] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x271896c | out: lpFileInformation=0x271896c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2)) returned 1
	[0186.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.699] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.699] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.699] GetFileType (hFile=0x318) returned 0x1
	[0186.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.699] GetFileType (hFile=0x318) returned 0x1
	[0186.699] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d2
	[0186.699] ReadFile (in: hFile=0x318, lpBuffer=0x271910c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271910c*, lpNumberOfBytesRead=0x540efcc*=0x2d2, lpOverlapped=0x0) returned 1
	[0186.701] CloseHandle (hObject=0x318) returned 1
	[0186.701] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.701] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.701] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271a1a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0186.701] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.701] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.701] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0186.701] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.701] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x271a260*=0x1, dwFlags=0x0) returned 1
	[0186.701] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x271a22c, dwFlags=0x0) returned 1
	[0186.701] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271a270*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x271a270*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0186.701] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271a55c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271a55c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.701] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.701] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.701] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.701] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.701] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.703] GetFileType (hFile=0x318) returned 0x1
	[0186.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.703] GetFileType (hFile=0x318) returned 0x1
	[0186.703] WriteFile (in: hFile=0x318, lpBuffer=0x271a7c8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x271a7c8*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0186.704] CloseHandle (hObject=0x318) returned 1
	[0186.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0186.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.704] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa99d3c2e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0186.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.704] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.705] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.705] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x271be00 | out: lpFileInformation=0x271be00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6)) returned 1
	[0186.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.705] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.706] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.706] GetFileType (hFile=0x318) returned 0x1
	[0186.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.706] GetFileType (hFile=0x318) returned 0x1
	[0186.706] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c6
	[0186.706] ReadFile (in: hFile=0x318, lpBuffer=0x271c594, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271c594*, lpNumberOfBytesRead=0x540efcc*=0x2c6, lpOverlapped=0x0) returned 1
	[0186.708] CloseHandle (hObject=0x318) returned 1
	[0186.708] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.708] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.708] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271d630, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0186.708] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.708] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.708] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0186.708] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.708] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x271d6e8*=0x1, dwFlags=0x0) returned 1
	[0186.708] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x271d6b4, dwFlags=0x0) returned 1
	[0186.708] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271d6f8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x271d6f8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.708] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271d9d4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271d9d4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.708] CryptDestroyKey (hKey=0x82b200) returned 1
	[0186.708] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.708] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.709] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.710] GetFileType (hFile=0x318) returned 0x1
	[0186.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.710] GetFileType (hFile=0x318) returned 0x1
	[0186.710] WriteFile (in: hFile=0x318, lpBuffer=0x271dc40*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x271dc40*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.711] CloseHandle (hObject=0x318) returned 1
	[0186.711] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0186.711] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0186.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.711] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa99d3c2e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.712] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.713] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.713] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x271f278 | out: lpFileInformation=0x271f278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d02d4c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d02d4c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d02d4c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0186.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.714] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.714] GetFileType (hFile=0x318) returned 0x1
	[0186.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.714] GetFileType (hFile=0x318) returned 0x1
	[0186.714] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c3
	[0186.714] ReadFile (in: hFile=0x318, lpBuffer=0x271f9d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271f9d8*, lpNumberOfBytesRead=0x540efcc*=0x2c3, lpOverlapped=0x0) returned 1
	[0186.716] CloseHandle (hObject=0x318) returned 1
	[0186.716] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.716] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.716] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2720a74, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0186.716] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.716] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.716] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0186.716] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.716] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2720b2c*=0x1, dwFlags=0x0) returned 1
	[0186.716] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2720af8, dwFlags=0x0) returned 1
	[0186.716] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2720b3c*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2720b3c*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.716] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2720e18*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2720e18*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.716] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.716] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.716] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.717] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.717] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.718] GetFileType (hFile=0x318) returned 0x1
	[0186.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.718] GetFileType (hFile=0x318) returned 0x1
	[0186.718] WriteFile (in: hFile=0x318, lpBuffer=0x272106c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x272106c*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.719] CloseHandle (hObject=0x318) returned 1
	[0186.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0186.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.719] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d02d4c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d02d4c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa99faac7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.720] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.721] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2722674 | out: lpFileInformation=0x2722674*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d02d4c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d02d4c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d02d4c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x314)) returned 1
	[0186.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.721] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.721] GetFileType (hFile=0x318) returned 0x1
	[0186.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.721] GetFileType (hFile=0x318) returned 0x1
	[0186.721] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x314
	[0186.722] ReadFile (in: hFile=0x318, lpBuffer=0x2722e44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2722e44*, lpNumberOfBytesRead=0x540efcc*=0x314, lpOverlapped=0x0) returned 1
	[0186.745] CloseHandle (hObject=0x318) returned 1
	[0186.745] CryptDestroyKey (hKey=0x82b200) returned 1
	[0186.745] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.745] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2723ee0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b000) returned 1
	[0186.745] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.745] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.745] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0186.745] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.745] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2723f98*=0x1, dwFlags=0x0) returned 1
	[0186.746] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2723f64, dwFlags=0x0) returned 1
	[0186.746] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2723fa8*, pdwDataLen=0x540efd4*=0x320, dwBufLen=0x320 | out: pbData=0x2723fa8*, pdwDataLen=0x540efd4*=0x320) returned 1
	[0186.746] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27242d4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27242d4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.746] CryptDestroyKey (hKey=0x82b540) returned 1
	[0186.746] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.746] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.746] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.746] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.747] GetFileType (hFile=0x318) returned 0x1
	[0186.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.747] GetFileType (hFile=0x318) returned 0x1
	[0186.747] WriteFile (in: hFile=0x318, lpBuffer=0x2724538*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2724538*, lpNumberOfBytesWritten=0x540ef94*=0x320, lpOverlapped=0x0) returned 1
	[0186.748] CloseHandle (hObject=0x318) returned 1
	[0186.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0186.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.749] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d02d4c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d02d4c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9a462df, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1
	[0186.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.749] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.750] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.750] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2725b6c | out: lpFileInformation=0x2725b6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d02d4c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d02d4c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d02d4c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x3a6)) returned 1
	[0186.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.750] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.750] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.750] GetFileType (hFile=0x318) returned 0x1
	[0186.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.750] GetFileType (hFile=0x318) returned 0x1
	[0186.750] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x3a6
	[0186.751] ReadFile (in: hFile=0x318, lpBuffer=0x27263d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27263d0*, lpNumberOfBytesRead=0x540efcc*=0x3a6, lpOverlapped=0x0) returned 1
	[0186.752] CloseHandle (hObject=0x318) returned 1
	[0186.752] CryptDestroyKey (hKey=0x82b000) returned 1
	[0186.752] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.752] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272746c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0186.752] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.752] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.752] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0186.752] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.752] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2727524*=0x1, dwFlags=0x0) returned 1
	[0186.752] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27274f0, dwFlags=0x0) returned 1
	[0186.752] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2727534*, pdwDataLen=0x540efd4*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x2727534*, pdwDataLen=0x540efd4*=0x3b0) returned 1
	[0186.752] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27278f0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27278f0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.752] CryptDestroyKey (hKey=0x82b300) returned 1
	[0186.752] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.752] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.753] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.753] GetFileType (hFile=0x318) returned 0x1
	[0186.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.754] GetFileType (hFile=0x318) returned 0x1
	[0186.754] WriteFile (in: hFile=0x318, lpBuffer=0x2727b54*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2727b54*, lpNumberOfBytesWritten=0x540ef94*=0x3b0, lpOverlapped=0x0) returned 1
	[0186.755] CloseHandle (hObject=0x318) returned 1
	[0186.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0186.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.755] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d02d4c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d02d4c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9a462df, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1
	[0186.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.755] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.756] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.756] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2729188 | out: lpFileInformation=0x2729188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x392)) returned 1
	[0186.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.756] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.757] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.757] GetFileType (hFile=0x318) returned 0x1
	[0186.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.757] GetFileType (hFile=0x318) returned 0x1
	[0186.757] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x392
	[0186.757] ReadFile (in: hFile=0x318, lpBuffer=0x27299d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27299d8*, lpNumberOfBytesRead=0x540efcc*=0x392, lpOverlapped=0x0) returned 1
	[0186.758] CloseHandle (hObject=0x318) returned 1
	[0186.758] CryptDestroyKey (hKey=0x82b380) returned 1
	[0186.758] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.759] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272aa74, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0186.759] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.759] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.759] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0186.759] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.759] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x272ab2c*=0x1, dwFlags=0x0) returned 1
	[0186.759] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x272aaf8, dwFlags=0x0) returned 1
	[0186.759] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272ab3c*, pdwDataLen=0x540efd4*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x272ab3c*, pdwDataLen=0x540efd4*=0x3a0) returned 1
	[0186.759] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272aee8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x272aee8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.759] CryptDestroyKey (hKey=0x82b300) returned 1
	[0186.759] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.759] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.759] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.759] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.761] GetFileType (hFile=0x318) returned 0x1
	[0186.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.761] GetFileType (hFile=0x318) returned 0x1
	[0186.761] WriteFile (in: hFile=0x318, lpBuffer=0x272b14c*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x272b14c*, lpNumberOfBytesWritten=0x540ef94*=0x3a0, lpOverlapped=0x0) returned 1
	[0186.762] CloseHandle (hObject=0x318) returned 1
	[0186.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0186.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0186.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.762] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9a6c50a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1
	[0186.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.762] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.763] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.763] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x272c780 | out: lpFileInformation=0x272c780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0186.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.764] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.764] GetFileType (hFile=0x318) returned 0x1
	[0186.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.764] GetFileType (hFile=0x318) returned 0x1
	[0186.764] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1e0
	[0186.764] ReadFile (in: hFile=0x318, lpBuffer=0x272cd8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x272cd8c*, lpNumberOfBytesRead=0x540efcc*=0x1e0, lpOverlapped=0x0) returned 1
	[0186.765] CloseHandle (hObject=0x318) returned 1
	[0186.766] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0186.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.766] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272de28, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b0c0) returned 1
	[0186.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.766] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0186.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.766] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x272dee0*=0x1, dwFlags=0x0) returned 1
	[0186.766] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x272deac, dwFlags=0x0) returned 1
	[0186.766] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272def0*, pdwDataLen=0x540efd4*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x272def0*, pdwDataLen=0x540efd4*=0x1f0) returned 1
	[0186.766] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272e0ec*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x272e0ec*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.766] CryptDestroyKey (hKey=0x82b340) returned 1
	[0186.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.766] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.768] GetFileType (hFile=0x318) returned 0x1
	[0186.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.768] GetFileType (hFile=0x318) returned 0x1
	[0186.768] WriteFile (in: hFile=0x318, lpBuffer=0x272e308*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x272e308*, lpNumberOfBytesWritten=0x540ef94*=0x1f0, lpOverlapped=0x0) returned 1
	[0186.769] CloseHandle (hObject=0x318) returned 1
	[0186.769] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.769] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0186.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.769] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9a6c50a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0186.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.769] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.771] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xc7
	[0186.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.771] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x272f8ac | out: lpFileInformation=0x272f8ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fb)) returned 1
	[0186.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.771] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xc7
	[0186.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.771] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.771] GetFileType (hFile=0x318) returned 0x1
	[0186.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.771] GetFileType (hFile=0x318) returned 0x1
	[0186.771] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2fb
	[0186.772] ReadFile (in: hFile=0x318, lpBuffer=0x2730194, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2730194*, lpNumberOfBytesRead=0x540efcc*=0x2fb, lpOverlapped=0x0) returned 1
	[0186.801] CloseHandle (hObject=0x318) returned 1
	[0186.802] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0186.802] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.802] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2731230, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b0c0) returned 1
	[0186.802] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.802] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.802] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0186.802] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.802] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x27312e8*=0x1, dwFlags=0x0) returned 1
	[0186.802] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x27312b4, dwFlags=0x0) returned 1
	[0186.802] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27312f8*, pdwDataLen=0x540efd4*=0x300, dwBufLen=0x300 | out: pbData=0x27312f8*, pdwDataLen=0x540efd4*=0x300) returned 1
	[0186.802] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2731604*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2731604*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.802] CryptDestroyKey (hKey=0x82b400) returned 1
	[0186.802] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.802] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xc7
	[0186.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.802] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.880] GetFileType (hFile=0x318) returned 0x1
	[0186.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.881] GetFileType (hFile=0x318) returned 0x1
	[0186.881] WriteFile (in: hFile=0x318, lpBuffer=0x2731900*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2731900*, lpNumberOfBytesWritten=0x540ef94*=0x300, lpOverlapped=0x0) returned 1
	[0186.882] CloseHandle (hObject=0x318) returned 1
	[0186.882] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xc7
	[0186.882] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xf6
	[0186.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.882] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9b777b3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x300)) returned 1
	[0186.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.882] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.883] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xc7
	[0186.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.883] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2733064 | out: lpFileInformation=0x2733064*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2b7)) returned 1
	[0186.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.886] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xc7
	[0186.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.886] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.887] GetFileType (hFile=0x318) returned 0x1
	[0186.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.887] GetFileType (hFile=0x318) returned 0x1
	[0186.887] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2b7
	[0186.887] ReadFile (in: hFile=0x318, lpBuffer=0x2733908, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2733908*, lpNumberOfBytesRead=0x540efcc*=0x2b7, lpOverlapped=0x0) returned 1
	[0186.888] CloseHandle (hObject=0x318) returned 1
	[0186.888] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0186.889] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.889] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27349a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0186.889] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.889] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.889] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0186.889] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.889] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2734a5c*=0x1, dwFlags=0x0) returned 1
	[0186.889] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2734a28, dwFlags=0x0) returned 1
	[0186.889] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2734a6c*, pdwDataLen=0x540efd4*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x2734a6c*, pdwDataLen=0x540efd4*=0x2c0) returned 1
	[0186.889] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2734d38*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2734d38*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.889] CryptDestroyKey (hKey=0x82b540) returned 1
	[0186.889] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.889] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.889] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xc7
	[0186.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.889] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.891] GetFileType (hFile=0x318) returned 0x1
	[0186.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.891] GetFileType (hFile=0x318) returned 0x1
	[0186.891] WriteFile (in: hFile=0x318, lpBuffer=0x2735034*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2735034*, lpNumberOfBytesWritten=0x540ef94*=0x2c0, lpOverlapped=0x0) returned 1
	[0186.892] CloseHandle (hObject=0x318) returned 1
	[0186.892] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xc7
	[0186.892] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xf6
	[0186.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.892] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9b9d8c5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0186.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.893] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.894] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0186.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.894] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2736798 | out: lpFileInformation=0x2736798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f1)) returned 1
	[0186.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.894] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0186.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.894] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.895] GetFileType (hFile=0x318) returned 0x1
	[0186.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.895] GetFileType (hFile=0x318) returned 0x1
	[0186.895] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1f1
	[0186.895] ReadFile (in: hFile=0x318, lpBuffer=0x2736e98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2736e98*, lpNumberOfBytesRead=0x540efcc*=0x1f1, lpOverlapped=0x0) returned 1
	[0186.896] CloseHandle (hObject=0x318) returned 1
	[0186.896] CryptDestroyKey (hKey=0x82b280) returned 1
	[0186.896] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.896] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2737f34, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0186.897] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.897] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.897] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0186.897] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.897] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2737fec*=0x1, dwFlags=0x0) returned 1
	[0186.897] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2737fb8, dwFlags=0x0) returned 1
	[0186.897] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2737ffc*, pdwDataLen=0x540efd4*=0x200, dwBufLen=0x200 | out: pbData=0x2737ffc*, pdwDataLen=0x540efd4*=0x200) returned 1
	[0186.897] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2738208*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2738208*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.897] CryptDestroyKey (hKey=0x82b040) returned 1
	[0186.897] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.897] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.897] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0186.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.897] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.898] GetFileType (hFile=0x318) returned 0x1
	[0186.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.898] GetFileType (hFile=0x318) returned 0x1
	[0186.899] WriteFile (in: hFile=0x318, lpBuffer=0x2738494*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2738494*, lpNumberOfBytesWritten=0x540ef94*=0x200, lpOverlapped=0x0) returned 1
	[0186.899] CloseHandle (hObject=0x318) returned 1
	[0186.900] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0186.900] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xda
	[0186.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.900] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9b9d8c5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1
	[0186.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.900] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.901] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.901] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2739b18 | out: lpFileInformation=0x2739b18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901fba3a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901fba3a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901fba3a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x347)) returned 1
	[0186.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.902] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.902] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.902] GetFileType (hFile=0x318) returned 0x1
	[0186.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.902] GetFileType (hFile=0x318) returned 0x1
	[0186.902] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x347
	[0186.902] ReadFile (in: hFile=0x318, lpBuffer=0x273a2fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x273a2fc*, lpNumberOfBytesRead=0x540efcc*=0x347, lpOverlapped=0x0) returned 1
	[0186.904] CloseHandle (hObject=0x318) returned 1
	[0186.904] CryptDestroyKey (hKey=0x82b080) returned 1
	[0186.904] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.904] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273b398, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0186.904] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.904] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.904] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0186.904] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.904] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x273b450*=0x1, dwFlags=0x0) returned 1
	[0186.904] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x273b41c, dwFlags=0x0) returned 1
	[0186.904] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273b460*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x273b460*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0186.904] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273b7bc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x273b7bc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.904] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.904] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.904] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.904] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.905] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.906] GetFileType (hFile=0x318) returned 0x1
	[0186.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.906] GetFileType (hFile=0x318) returned 0x1
	[0186.906] WriteFile (in: hFile=0x318, lpBuffer=0x273ba10*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x273ba10*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0186.907] CloseHandle (hObject=0x318) returned 1
	[0186.907] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.907] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0186.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.907] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901fba3a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901fba3a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9bc3a66, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0186.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.907] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.909] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0186.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.909] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x273d018 | out: lpFileInformation=0x273d018*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x297)) returned 1
	[0186.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.909] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0186.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.909] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.909] GetFileType (hFile=0x318) returned 0x1
	[0186.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.909] GetFileType (hFile=0x318) returned 0x1
	[0186.909] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x297
	[0186.909] ReadFile (in: hFile=0x318, lpBuffer=0x273d7bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x273d7bc*, lpNumberOfBytesRead=0x540efcc*=0x297, lpOverlapped=0x0) returned 1
	[0186.911] CloseHandle (hObject=0x318) returned 1
	[0186.911] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.911] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.911] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273e858, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0186.911] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.911] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.911] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0186.911] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.911] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x273e910*=0x1, dwFlags=0x0) returned 1
	[0186.911] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x273e8dc, dwFlags=0x0) returned 1
	[0186.912] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273e920*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x273e920*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0186.912] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273ebcc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x273ebcc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.912] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.912] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.912] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.912] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0186.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.912] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.913] GetFileType (hFile=0x318) returned 0x1
	[0186.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.913] GetFileType (hFile=0x318) returned 0x1
	[0186.913] WriteFile (in: hFile=0x318, lpBuffer=0x273ee58*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x273ee58*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0186.914] CloseHandle (hObject=0x318) returned 1
	[0186.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0186.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd9
	[0186.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.915] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9bc3a66, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0186.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.915] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.937] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0186.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.937] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27404d0 | out: lpFileInformation=0x27404d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce)) returned 1
	[0186.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.939] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0186.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.939] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.939] GetFileType (hFile=0x318) returned 0x1
	[0186.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.939] GetFileType (hFile=0x318) returned 0x1
	[0186.939] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2ce
	[0186.939] ReadFile (in: hFile=0x318, lpBuffer=0x2740c9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2740c9c*, lpNumberOfBytesRead=0x540efcc*=0x2ce, lpOverlapped=0x0) returned 1
	[0186.941] CloseHandle (hObject=0x318) returned 1
	[0186.941] CryptDestroyKey (hKey=0x82b440) returned 1
	[0186.941] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.941] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2741d38, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0186.941] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.941] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.941] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0186.941] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.941] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2741df0*=0x1, dwFlags=0x0) returned 1
	[0186.941] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2741dbc, dwFlags=0x0) returned 1
	[0186.941] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2741e00*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2741e00*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.941] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27420dc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27420dc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.941] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.942] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.942] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.942] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0186.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.942] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.943] GetFileType (hFile=0x318) returned 0x1
	[0186.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.943] GetFileType (hFile=0x318) returned 0x1
	[0186.943] WriteFile (in: hFile=0x318, lpBuffer=0x2742360*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2742360*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.944] CloseHandle (hObject=0x318) returned 1
	[0186.944] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0186.945] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0186.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.945] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9c30299, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.945] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.946] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.946] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27439c8 | out: lpFileInformation=0x27439c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6)) returned 1
	[0186.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.948] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.948] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.948] GetFileType (hFile=0x318) returned 0x1
	[0186.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.948] GetFileType (hFile=0x318) returned 0x1
	[0186.948] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1c6
	[0186.949] ReadFile (in: hFile=0x318, lpBuffer=0x2743fbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2743fbc*, lpNumberOfBytesRead=0x540efcc*=0x1c6, lpOverlapped=0x0) returned 1
	[0186.950] CloseHandle (hObject=0x318) returned 1
	[0186.950] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0186.950] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.950] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2745058, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.951] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.951] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.951] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0186.951] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.951] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2745110*=0x1, dwFlags=0x0) returned 1
	[0186.951] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27450dc, dwFlags=0x0) returned 1
	[0186.951] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2745120*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x2745120*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0186.951] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27452fc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27452fc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.951] CryptDestroyKey (hKey=0x82b540) returned 1
	[0186.951] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.951] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.951] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.952] GetFileType (hFile=0x318) returned 0x1
	[0186.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.953] GetFileType (hFile=0x318) returned 0x1
	[0186.953] WriteFile (in: hFile=0x318, lpBuffer=0x2745518*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2745518*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0186.954] CloseHandle (hObject=0x318) returned 1
	[0186.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0186.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.954] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9c38bb5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0186.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.955] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.959] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2746abc | out: lpFileInformation=0x2746abc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0186.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0186.959] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0186.959] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.959] GetFileType (hFile=0x318) returned 0x1
	[0186.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0186.959] GetFileType (hFile=0x318) returned 0x1
	[0186.959] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cf
	[0186.959] ReadFile (in: hFile=0x318, lpBuffer=0x2747268, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2747268*, lpNumberOfBytesRead=0x540efcc*=0x2cf, lpOverlapped=0x0) returned 1
	[0186.961] CloseHandle (hObject=0x318) returned 1
	[0186.961] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.961] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.961] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2748304, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0186.961] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.961] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.961] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0186.961] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.961] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27483bc*=0x1, dwFlags=0x0) returned 1
	[0186.961] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2748388, dwFlags=0x0) returned 1
	[0186.961] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27483cc*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27483cc*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0186.961] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27486a8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27486a8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0186.962] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0186.962] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.962] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.962] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0186.962] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.963] GetFileType (hFile=0x318) returned 0x1
	[0186.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0186.963] GetFileType (hFile=0x318) returned 0x1
	[0186.963] WriteFile (in: hFile=0x318, lpBuffer=0x274891c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x274891c*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.964] CloseHandle (hObject=0x318) returned 1
	[0186.964] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.964] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0186.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0186.964] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9c5f03a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0186.964] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.965] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0186.965] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2749f64 | out: lpFileInformation=0x2749f64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8)) returned 1
	[0186.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaf
	[0187.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.118] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.118] GetFileType (hFile=0x318) returned 0x1
	[0187.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.118] GetFileType (hFile=0x318) returned 0x1
	[0187.118] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2de
	[0187.118] ReadFile (in: hFile=0x318, lpBuffer=0x2764b18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2764b18*, lpNumberOfBytesRead=0x540efcc*=0x2de, lpOverlapped=0x0) returned 1
	[0187.120] CloseHandle (hObject=0x318) returned 1
	[0187.120] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0187.120] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.120] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2765bb4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0187.120] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.120] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.120] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0187.121] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.121] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2765c6c*=0x1, dwFlags=0x0) returned 1
	[0187.121] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2765c38, dwFlags=0x0) returned 1
	[0187.121] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2765c7c*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2765c7c*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0187.121] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2765f68*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2765f68*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.121] CryptDestroyKey (hKey=0x82b480) returned 1
	[0187.121] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.121] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.121] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaf
	[0187.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.121] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.122] GetFileType (hFile=0x318) returned 0x1
	[0187.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.122] GetFileType (hFile=0x318) returned 0x1
	[0187.122] WriteFile (in: hFile=0x318, lpBuffer=0x2766204*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2766204*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0187.123] CloseHandle (hObject=0x318) returned 1
	[0187.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaf
	[0187.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xde
	[0187.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.123] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9ddc7b7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0187.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.123] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.124] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.124] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27678a8 | out: lpFileInformation=0x27678a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5)) returned 1
	[0187.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.125] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.125] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.125] GetFileType (hFile=0x318) returned 0x1
	[0187.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.125] GetFileType (hFile=0x318) returned 0x1
	[0187.125] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c5
	[0187.125] ReadFile (in: hFile=0x318, lpBuffer=0x276802c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x276802c*, lpNumberOfBytesRead=0x540efcc*=0x2c5, lpOverlapped=0x0) returned 1
	[0187.127] CloseHandle (hObject=0x318) returned 1
	[0187.127] CryptDestroyKey (hKey=0x82b440) returned 1
	[0187.127] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.127] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27690c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0187.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.127] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0187.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.127] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2769180*=0x1, dwFlags=0x0) returned 1
	[0187.127] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x276914c, dwFlags=0x0) returned 1
	[0187.127] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2769190*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2769190*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.127] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276946c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x276946c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.127] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.127] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.127] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.127] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.129] GetFileType (hFile=0x318) returned 0x1
	[0187.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.129] GetFileType (hFile=0x318) returned 0x1
	[0187.129] WriteFile (in: hFile=0x318, lpBuffer=0x27696d0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27696d0*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.129] CloseHandle (hObject=0x318) returned 1
	[0187.130] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.130] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0187.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.130] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9ddc7b7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.130] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.131] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x276ad04 | out: lpFileInformation=0x276ad04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5)) returned 1
	[0187.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.131] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.132] GetFileType (hFile=0x318) returned 0x1
	[0187.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.132] GetFileType (hFile=0x318) returned 0x1
	[0187.132] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c5
	[0187.132] ReadFile (in: hFile=0x318, lpBuffer=0x276b488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x276b488*, lpNumberOfBytesRead=0x540efcc*=0x2c5, lpOverlapped=0x0) returned 1
	[0187.133] CloseHandle (hObject=0x318) returned 1
	[0187.133] CryptDestroyKey (hKey=0x82b040) returned 1
	[0187.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.133] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276c524, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0187.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.133] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0187.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.133] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x276c5dc*=0x1, dwFlags=0x0) returned 1
	[0187.134] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x276c5a8, dwFlags=0x0) returned 1
	[0187.134] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276c5ec*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x276c5ec*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.134] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276c8c8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x276c8c8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.134] CryptDestroyKey (hKey=0x82b280) returned 1
	[0187.134] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.134] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.134] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.134] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.135] GetFileType (hFile=0x318) returned 0x1
	[0187.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.135] GetFileType (hFile=0x318) returned 0x1
	[0187.135] WriteFile (in: hFile=0x318, lpBuffer=0x276cb2c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x276cb2c*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.136] CloseHandle (hObject=0x318) returned 1
	[0187.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0187.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.136] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9e02a60, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.136] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.137] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x276e160 | out: lpFileInformation=0x276e160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cf)) returned 1
	[0187.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.138] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.138] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.138] GetFileType (hFile=0x318) returned 0x1
	[0187.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.138] GetFileType (hFile=0x318) returned 0x1
	[0187.138] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cf
	[0187.138] ReadFile (in: hFile=0x318, lpBuffer=0x276e75c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x276e75c*, lpNumberOfBytesRead=0x540efcc*=0x1cf, lpOverlapped=0x0) returned 1
	[0187.139] CloseHandle (hObject=0x318) returned 1
	[0187.139] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.139] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.139] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276f7f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0187.139] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.139] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.139] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0187.139] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.139] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x276f8b0*=0x1, dwFlags=0x0) returned 1
	[0187.139] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x276f87c, dwFlags=0x0) returned 1
	[0187.139] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276f8c0*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x276f8c0*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0187.139] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276fa9c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x276fa9c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.139] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.139] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.139] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.140] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.141] GetFileType (hFile=0x318) returned 0x1
	[0187.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.141] GetFileType (hFile=0x318) returned 0x1
	[0187.141] WriteFile (in: hFile=0x318, lpBuffer=0x276fcb8*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x276fcb8*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0187.141] CloseHandle (hObject=0x318) returned 1
	[0187.142] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.142] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0187.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.142] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9e02a60, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0187.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.142] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0187.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.144] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x277125c | out: lpFileInformation=0x277125c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90dc1962, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90dc1962, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90dc1962, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x291)) returned 1
	[0187.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0187.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.144] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.144] GetFileType (hFile=0x318) returned 0x1
	[0187.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.144] GetFileType (hFile=0x318) returned 0x1
	[0187.144] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x291
	[0187.144] ReadFile (in: hFile=0x318, lpBuffer=0x27719fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27719fc*, lpNumberOfBytesRead=0x540efcc*=0x291, lpOverlapped=0x0) returned 1
	[0187.145] CloseHandle (hObject=0x318) returned 1
	[0187.145] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.145] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.146] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2772a98, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0187.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.146] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0187.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.146] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2772b50*=0x1, dwFlags=0x0) returned 1
	[0187.146] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2772b1c, dwFlags=0x0) returned 1
	[0187.146] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2772b60*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x2772b60*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0187.146] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2772e0c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2772e0c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.146] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0187.146] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.146] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0187.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.146] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.147] GetFileType (hFile=0x318) returned 0x1
	[0187.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.147] GetFileType (hFile=0x318) returned 0x1
	[0187.147] WriteFile (in: hFile=0x318, lpBuffer=0x2773098*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2773098*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0187.148] CloseHandle (hObject=0x318) returned 1
	[0187.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0187.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xda
	[0187.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.148] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90dc1962, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90dc1962, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9e02a60, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0187.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.149] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.149] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.149] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x277471c | out: lpFileInformation=0x277471c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90dc1962, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90dc1962, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90dc1962, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b)) returned 1
	[0187.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.150] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.150] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.150] GetFileType (hFile=0x318) returned 0x1
	[0187.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.150] GetFileType (hFile=0x318) returned 0x1
	[0187.150] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x28b
	[0187.150] ReadFile (in: hFile=0x318, lpBuffer=0x2774e54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2774e54*, lpNumberOfBytesRead=0x540efcc*=0x28b, lpOverlapped=0x0) returned 1
	[0187.151] CloseHandle (hObject=0x318) returned 1
	[0187.152] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.152] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.152] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2775ef0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0187.152] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.152] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.152] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0187.152] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.152] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2775fa8*=0x1, dwFlags=0x0) returned 1
	[0187.152] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2775f74, dwFlags=0x0) returned 1
	[0187.152] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2775fb8*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x2775fb8*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0187.152] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2776254*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2776254*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.152] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.152] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.152] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.152] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.152] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.153] GetFileType (hFile=0x318) returned 0x1
	[0187.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.153] GetFileType (hFile=0x318) returned 0x1
	[0187.153] WriteFile (in: hFile=0x318, lpBuffer=0x27764b0*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27764b0*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0187.154] CloseHandle (hObject=0x318) returned 1
	[0187.154] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.154] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0187.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.154] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90dc1962, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90dc1962, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9e28cfb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0187.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.154] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.155] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xbf
	[0187.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.156] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2777ac8 | out: lpFileInformation=0x2777ac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90dc1962, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90dc1962, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90dc1962, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e7)) returned 1
	[0187.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.156] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xbf
	[0187.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.156] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.156] GetFileType (hFile=0x318) returned 0x1
	[0187.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.156] GetFileType (hFile=0x318) returned 0x1
	[0187.156] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2e7
	[0187.156] ReadFile (in: hFile=0x318, lpBuffer=0x277835c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x277835c*, lpNumberOfBytesRead=0x540efcc*=0x2e7, lpOverlapped=0x0) returned 1
	[0187.178] CloseHandle (hObject=0x318) returned 1
	[0187.178] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.178] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.178] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27793f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0187.178] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.178] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.178] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0187.178] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.178] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x27794b0*=0x1, dwFlags=0x0) returned 1
	[0187.178] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x277947c, dwFlags=0x0) returned 1
	[0187.179] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27794c0*, pdwDataLen=0x540efd4*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x27794c0*, pdwDataLen=0x540efd4*=0x2f0) returned 1
	[0187.179] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27797bc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27797bc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.179] CryptDestroyKey (hKey=0x82b400) returned 1
	[0187.179] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.179] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.179] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xbf
	[0187.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.179] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.180] GetFileType (hFile=0x318) returned 0x1
	[0187.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.180] GetFileType (hFile=0x318) returned 0x1
	[0187.180] WriteFile (in: hFile=0x318, lpBuffer=0x2779a98*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2779a98*, lpNumberOfBytesWritten=0x540ef94*=0x2f0, lpOverlapped=0x0) returned 1
	[0187.181] CloseHandle (hObject=0x318) returned 1
	[0187.181] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xbf
	[0187.181] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xee
	[0187.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.181] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90dc1962, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90dc1962, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9e4efa8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0187.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.182] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.184] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.184] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x277b1bc | out: lpFileInformation=0x277b1bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x386)) returned 1
	[0187.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.184] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.185] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.185] GetFileType (hFile=0x318) returned 0x1
	[0187.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.185] GetFileType (hFile=0x318) returned 0x1
	[0187.185] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x386
	[0187.185] ReadFile (in: hFile=0x318, lpBuffer=0x277b9e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x277b9e0*, lpNumberOfBytesRead=0x540efcc*=0x386, lpOverlapped=0x0) returned 1
	[0187.186] CloseHandle (hObject=0x318) returned 1
	[0187.186] CryptDestroyKey (hKey=0x82b540) returned 1
	[0187.186] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.187] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277ca7c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0187.187] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.187] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.187] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0187.187] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.187] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x277cb34*=0x1, dwFlags=0x0) returned 1
	[0187.187] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x277cb00, dwFlags=0x0) returned 1
	[0187.187] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277cb44*, pdwDataLen=0x540efd4*=0x390, dwBufLen=0x390 | out: pbData=0x277cb44*, pdwDataLen=0x540efd4*=0x390) returned 1
	[0187.187] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277cee0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x277cee0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.187] CryptDestroyKey (hKey=0x82b200) returned 1
	[0187.187] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.187] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.187] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.187] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.188] GetFileType (hFile=0x318) returned 0x1
	[0187.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.188] GetFileType (hFile=0x318) returned 0x1
	[0187.188] WriteFile (in: hFile=0x318, lpBuffer=0x277d134*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x277d134*, lpNumberOfBytesWritten=0x540ef94*=0x390, lpOverlapped=0x0) returned 1
	[0187.189] CloseHandle (hObject=0x318) returned 1
	[0187.189] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.190] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0187.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.190] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9e751ef, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x390)) returned 1
	[0187.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.190] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.191] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.191] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x277e73c | out: lpFileInformation=0x277e73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x37c)) returned 1
	[0187.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.191] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.191] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.191] GetFileType (hFile=0x318) returned 0x1
	[0187.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.192] GetFileType (hFile=0x318) returned 0x1
	[0187.192] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x37c
	[0187.192] ReadFile (in: hFile=0x318, lpBuffer=0x277ef54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x277ef54*, lpNumberOfBytesRead=0x540efcc*=0x37c, lpOverlapped=0x0) returned 1
	[0187.193] CloseHandle (hObject=0x318) returned 1
	[0187.193] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.193] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.193] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277fff0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0187.193] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.193] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.194] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0187.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.194] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27800a8*=0x1, dwFlags=0x0) returned 1
	[0187.194] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2780074, dwFlags=0x0) returned 1
	[0187.194] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27800b8*, pdwDataLen=0x540efd4*=0x380, dwBufLen=0x380 | out: pbData=0x27800b8*, pdwDataLen=0x540efd4*=0x380) returned 1
	[0187.194] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2780444*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2780444*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.194] CryptDestroyKey (hKey=0x82b080) returned 1
	[0187.194] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.194] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.194] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.194] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.195] GetFileType (hFile=0x318) returned 0x1
	[0187.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.195] GetFileType (hFile=0x318) returned 0x1
	[0187.195] WriteFile (in: hFile=0x318, lpBuffer=0x2780698*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2780698*, lpNumberOfBytesWritten=0x540ef94*=0x380, lpOverlapped=0x0) returned 1
	[0187.196] CloseHandle (hObject=0x318) returned 1
	[0187.196] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.196] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0187.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.197] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9e751ef, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0187.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.197] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.198] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0187.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.198] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2781ca0 | out: lpFileInformation=0x2781ca0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901fba3a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901fba3a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901fba3a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0187.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.198] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0187.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.199] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.199] GetFileType (hFile=0x318) returned 0x1
	[0187.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.199] GetFileType (hFile=0x318) returned 0x1
	[0187.199] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cb
	[0187.199] ReadFile (in: hFile=0x318, lpBuffer=0x27823e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27823e8*, lpNumberOfBytesRead=0x540efcc*=0x2cb, lpOverlapped=0x0) returned 1
	[0187.200] CloseHandle (hObject=0x318) returned 1
	[0187.200] CryptDestroyKey (hKey=0x82b540) returned 1
	[0187.201] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.201] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2783484, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0187.201] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.201] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.201] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0187.201] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.201] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x278353c*=0x1, dwFlags=0x0) returned 1
	[0187.201] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2783508, dwFlags=0x0) returned 1
	[0187.201] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278354c*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x278354c*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.201] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2783828*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2783828*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.201] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.201] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.201] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.201] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0187.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.201] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.202] GetFileType (hFile=0x318) returned 0x1
	[0187.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.202] GetFileType (hFile=0x318) returned 0x1
	[0187.203] WriteFile (in: hFile=0x318, lpBuffer=0x2783a6c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2783a6c*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.203] CloseHandle (hObject=0x318) returned 1
	[0187.204] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0187.204] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0187.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.204] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901fba3a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901fba3a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9e9b498, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.204] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.205] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.205] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2785060 | out: lpFileInformation=0x2785060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cd)) returned 1
	[0187.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.205] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.205] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.206] GetFileType (hFile=0x318) returned 0x1
	[0187.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.206] GetFileType (hFile=0x318) returned 0x1
	[0187.206] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cd
	[0187.206] ReadFile (in: hFile=0x318, lpBuffer=0x278565c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x278565c*, lpNumberOfBytesRead=0x540efcc*=0x1cd, lpOverlapped=0x0) returned 1
	[0187.207] CloseHandle (hObject=0x318) returned 1
	[0187.207] CryptDestroyKey (hKey=0x82b480) returned 1
	[0187.207] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.207] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27866f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0187.207] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.207] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.207] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0187.207] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.207] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27867b0*=0x1, dwFlags=0x0) returned 1
	[0187.207] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x278677c, dwFlags=0x0) returned 1
	[0187.207] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27867c0*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27867c0*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0187.207] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278699c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x278699c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.207] CryptDestroyKey (hKey=0x82b300) returned 1
	[0187.208] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.208] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.208] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.208] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.209] GetFileType (hFile=0x318) returned 0x1
	[0187.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.209] GetFileType (hFile=0x318) returned 0x1
	[0187.209] WriteFile (in: hFile=0x318, lpBuffer=0x2786bb8*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2786bb8*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0187.210] CloseHandle (hObject=0x318) returned 1
	[0187.210] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.210] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0187.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.210] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9e9b498, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0187.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.210] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.212] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0187.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.212] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278815c | out: lpFileInformation=0x278815c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x31e)) returned 1
	[0187.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.212] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0187.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.213] ReadFile (in: hFile=0x318, lpBuffer=0x27889b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27889b8*, lpNumberOfBytesRead=0x540efcc*=0x31e, lpOverlapped=0x0) returned 1
	[0187.280] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0187.281] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.281] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2789a54, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0187.281] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.281] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.281] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0187.281] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.281] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2789b0c*=0x1, dwFlags=0x0) returned 1
	[0187.281] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2789ad8, dwFlags=0x0) returned 1
	[0187.281] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2789b1c*, pdwDataLen=0x540efd4*=0x320, dwBufLen=0x320 | out: pbData=0x2789b1c*, pdwDataLen=0x540efd4*=0x320) returned 1
	[0187.281] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2789e48*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2789e48*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.281] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.281] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.281] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.281] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0187.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.281] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.282] GetFileType (hFile=0x318) returned 0x1
	[0187.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.283] GetFileType (hFile=0x318) returned 0x1
	[0187.283] WriteFile (in: hFile=0x318, lpBuffer=0x278a0ec*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x278a0ec*, lpNumberOfBytesWritten=0x540ef94*=0x320, lpOverlapped=0x0) returned 1
	[0187.284] CloseHandle (hObject=0x318) returned 1
	[0187.284] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0187.284] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdf
	[0187.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.284] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9f59fc3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1
	[0187.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.284] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.285] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.285] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278b794 | out: lpFileInformation=0x278b794*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.286] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.286] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.286] GetFileType (hFile=0x318) returned 0x1
	[0187.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.286] GetFileType (hFile=0x318) returned 0x1
	[0187.286] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d0
	[0187.286] ReadFile (in: hFile=0x318, lpBuffer=0x278bf20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x278bf20*, lpNumberOfBytesRead=0x540efcc*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.288] CloseHandle (hObject=0x318) returned 1
	[0187.288] CryptDestroyKey (hKey=0x82b300) returned 1
	[0187.288] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.288] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278cfbc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b0c0) returned 1
	[0187.288] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.288] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.288] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0187.288] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.288] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x278d074*=0x1, dwFlags=0x0) returned 1
	[0187.288] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x278d040, dwFlags=0x0) returned 1
	[0187.288] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278d084*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x278d084*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0187.288] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278d370*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x278d370*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.288] CryptDestroyKey (hKey=0x82b400) returned 1
	[0187.289] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.289] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.289] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.289] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.290] GetFileType (hFile=0x318) returned 0x1
	[0187.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.290] GetFileType (hFile=0x318) returned 0x1
	[0187.290] WriteFile (in: hFile=0x318, lpBuffer=0x278d5d4*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x278d5d4*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0187.291] CloseHandle (hObject=0x318) returned 1
	[0187.291] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.291] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0187.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.291] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9f59fc3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0187.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.292] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.293] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278ec08 | out: lpFileInformation=0x278ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0187.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.294] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.294] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.294] GetFileType (hFile=0x318) returned 0x1
	[0187.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.294] GetFileType (hFile=0x318) returned 0x1
	[0187.294] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d3
	[0187.294] ReadFile (in: hFile=0x318, lpBuffer=0x278f398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x278f398*, lpNumberOfBytesRead=0x540efcc*=0x2d3, lpOverlapped=0x0) returned 1
	[0187.298] CloseHandle (hObject=0x318) returned 1
	[0187.298] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0187.298] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.298] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2790434, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0187.298] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.298] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.298] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0187.298] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.298] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27904ec*=0x1, dwFlags=0x0) returned 1
	[0187.299] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27904b8, dwFlags=0x0) returned 1
	[0187.299] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27904fc*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27904fc*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0187.299] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27907e8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27907e8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.299] CryptDestroyKey (hKey=0x82b340) returned 1
	[0187.299] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.299] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.299] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.299] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.300] GetFileType (hFile=0x318) returned 0x1
	[0187.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.301] GetFileType (hFile=0x318) returned 0x1
	[0187.301] WriteFile (in: hFile=0x318, lpBuffer=0x2790a4c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2790a4c*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0187.301] CloseHandle (hObject=0x318) returned 1
	[0187.302] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.302] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0187.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.302] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9f8028d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0187.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.302] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.303] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2792080 | out: lpFileInformation=0x2792080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0187.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.304] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.304] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.304] GetFileType (hFile=0x318) returned 0x1
	[0187.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.304] GetFileType (hFile=0x318) returned 0x1
	[0187.304] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c8
	[0187.304] ReadFile (in: hFile=0x318, lpBuffer=0x27927f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27927f4*, lpNumberOfBytesRead=0x540efcc*=0x2c8, lpOverlapped=0x0) returned 1
	[0187.306] CloseHandle (hObject=0x318) returned 1
	[0187.306] CryptDestroyKey (hKey=0x82b540) returned 1
	[0187.306] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.306] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2793890, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0187.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.306] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0187.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.306] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2793948*=0x1, dwFlags=0x0) returned 1
	[0187.306] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2793914, dwFlags=0x0) returned 1
	[0187.306] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2793958*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2793958*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.306] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2793c34*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2793c34*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.306] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0187.306] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.306] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.306] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.306] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.308] GetFileType (hFile=0x318) returned 0x1
	[0187.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.308] GetFileType (hFile=0x318) returned 0x1
	[0187.308] WriteFile (in: hFile=0x318, lpBuffer=0x2793e90*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2793e90*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.309] CloseHandle (hObject=0x318) returned 1
	[0187.309] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.309] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.309] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9fa645b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.309] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.310] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27954b4 | out: lpFileInformation=0x27954b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0187.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.311] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.311] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.311] GetFileType (hFile=0x318) returned 0x1
	[0187.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.311] GetFileType (hFile=0x318) returned 0x1
	[0187.311] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c9
	[0187.311] ReadFile (in: hFile=0x318, lpBuffer=0x2795c2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2795c2c*, lpNumberOfBytesRead=0x540efcc*=0x2c9, lpOverlapped=0x0) returned 1
	[0187.313] CloseHandle (hObject=0x318) returned 1
	[0187.313] CryptDestroyKey (hKey=0x82b400) returned 1
	[0187.313] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.313] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2796cc8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0187.313] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.313] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.313] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0187.313] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.313] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2796d80*=0x1, dwFlags=0x0) returned 1
	[0187.313] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2796d4c, dwFlags=0x0) returned 1
	[0187.314] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2796d90*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2796d90*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.314] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279706c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x279706c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.314] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.314] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.314] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.314] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.314] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.315] GetFileType (hFile=0x318) returned 0x1
	[0187.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.315] GetFileType (hFile=0x318) returned 0x1
	[0187.315] WriteFile (in: hFile=0x318, lpBuffer=0x27972c8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27972c8*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.316] CloseHandle (hObject=0x318) returned 1
	[0187.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.316] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9fa645b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.316] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.317] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.318] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27988ec | out: lpFileInformation=0x27988ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5)) returned 1
	[0187.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.318] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.318] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.318] GetFileType (hFile=0x318) returned 0x1
	[0187.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.318] GetFileType (hFile=0x318) returned 0x1
	[0187.318] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c5
	[0187.318] ReadFile (in: hFile=0x318, lpBuffer=0x2799060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2799060*, lpNumberOfBytesRead=0x540efcc*=0x2c5, lpOverlapped=0x0) returned 1
	[0187.345] CloseHandle (hObject=0x318) returned 1
	[0187.345] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.345] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.345] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279a0fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0187.345] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.345] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.345] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0187.345] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.345] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x279a1b4*=0x1, dwFlags=0x0) returned 1
	[0187.345] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x279a180, dwFlags=0x0) returned 1
	[0187.345] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279a1c4*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x279a1c4*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.345] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279a4a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x279a4a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.345] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.345] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.345] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.345] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.346] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.347] GetFileType (hFile=0x318) returned 0x1
	[0187.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.347] GetFileType (hFile=0x318) returned 0x1
	[0187.347] WriteFile (in: hFile=0x318, lpBuffer=0x279a6fc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x279a6fc*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.348] CloseHandle (hObject=0x318) returned 1
	[0187.348] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.348] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.348] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9ff29a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.348] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.349] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.349] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x279bd20 | out: lpFileInformation=0x279bd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0187.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.350] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.350] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.350] GetFileType (hFile=0x318) returned 0x1
	[0187.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.350] GetFileType (hFile=0x318) returned 0x1
	[0187.350] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2ca
	[0187.350] ReadFile (in: hFile=0x318, lpBuffer=0x279c498, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x279c498*, lpNumberOfBytesRead=0x540efcc*=0x2ca, lpOverlapped=0x0) returned 1
	[0187.351] CloseHandle (hObject=0x318) returned 1
	[0187.351] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.351] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.352] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279d534, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0187.352] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.352] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.352] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0187.352] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.352] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x279d5ec*=0x1, dwFlags=0x0) returned 1
	[0187.352] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x279d5b8, dwFlags=0x0) returned 1
	[0187.352] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279d5fc*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x279d5fc*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.352] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279d8d8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x279d8d8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.352] CryptDestroyKey (hKey=0x82b100) returned 1
	[0187.352] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.352] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.352] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.353] GetFileType (hFile=0x318) returned 0x1
	[0187.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.353] GetFileType (hFile=0x318) returned 0x1
	[0187.353] WriteFile (in: hFile=0x318, lpBuffer=0x279db34*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x279db34*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.355] CloseHandle (hObject=0x318) returned 1
	[0187.355] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.355] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.355] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa018b8f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.355] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.356] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.356] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x279f158 | out: lpFileInformation=0x279f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e340a5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e340a5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e340a5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f)) returned 1
	[0187.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.357] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.357] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.357] GetFileType (hFile=0x318) returned 0x1
	[0187.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.357] GetFileType (hFile=0x318) returned 0x1
	[0187.357] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34f
	[0187.357] ReadFile (in: hFile=0x318, lpBuffer=0x279f954, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x279f954*, lpNumberOfBytesRead=0x540efcc*=0x34f, lpOverlapped=0x0) returned 1
	[0187.359] CloseHandle (hObject=0x318) returned 1
	[0187.359] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.359] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.359] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a09f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b200) returned 1
	[0187.359] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.359] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.359] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0187.359] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.359] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x27a0aa8*=0x1, dwFlags=0x0) returned 1
	[0187.359] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x27a0a74, dwFlags=0x0) returned 1
	[0187.359] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a0ab8*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x27a0ab8*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0187.359] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a0e14*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a0e14*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.359] CryptDestroyKey (hKey=0x82b040) returned 1
	[0187.359] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.359] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.359] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.359] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.360] GetFileType (hFile=0x318) returned 0x1
	[0187.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.361] GetFileType (hFile=0x318) returned 0x1
	[0187.361] WriteFile (in: hFile=0x318, lpBuffer=0x27a1070*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27a1070*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0187.361] CloseHandle (hObject=0x318) returned 1
	[0187.362] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.362] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.362] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e340a5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e340a5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa018b8f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0187.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.362] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.363] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.363] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a2694 | out: lpFileInformation=0x27a2694*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e340a5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e340a5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e340a5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f)) returned 1
	[0187.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.363] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.363] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.363] GetFileType (hFile=0x318) returned 0x1
	[0187.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.363] GetFileType (hFile=0x318) returned 0x1
	[0187.364] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34f
	[0187.364] ReadFile (in: hFile=0x318, lpBuffer=0x27a2e90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a2e90*, lpNumberOfBytesRead=0x540efcc*=0x34f, lpOverlapped=0x0) returned 1
	[0187.369] CloseHandle (hObject=0x318) returned 1
	[0187.369] CryptDestroyKey (hKey=0x82b200) returned 1
	[0187.369] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.369] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a3f2c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0187.369] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.369] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.369] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0187.369] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.369] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27a3fe4*=0x1, dwFlags=0x0) returned 1
	[0187.369] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27a3fb0, dwFlags=0x0) returned 1
	[0187.369] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a3ff4*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x27a3ff4*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0187.370] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a4350*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a4350*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.370] CryptDestroyKey (hKey=0x82b100) returned 1
	[0187.370] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.370] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.370] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.370] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.371] GetFileType (hFile=0x318) returned 0x1
	[0187.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.371] GetFileType (hFile=0x318) returned 0x1
	[0187.371] WriteFile (in: hFile=0x318, lpBuffer=0x27a45ac*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27a45ac*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0187.372] CloseHandle (hObject=0x318) returned 1
	[0187.372] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.372] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.372] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e340a5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e340a5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa03edb2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0187.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.372] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0187.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.373] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a5bd0 | out: lpFileInformation=0x27a5bd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90221ca6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x319)) returned 1
	[0187.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0187.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.374] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.374] GetFileType (hFile=0x318) returned 0x1
	[0187.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.374] GetFileType (hFile=0x318) returned 0x1
	[0187.374] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x319
	[0187.374] ReadFile (in: hFile=0x318, lpBuffer=0x27a6408, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a6408*, lpNumberOfBytesRead=0x540efcc*=0x319, lpOverlapped=0x0) returned 1
	[0187.376] CloseHandle (hObject=0x318) returned 1
	[0187.376] CryptDestroyKey (hKey=0x82b480) returned 1
	[0187.376] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.376] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a74a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0187.376] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.376] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.376] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0187.376] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.376] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27a755c*=0x1, dwFlags=0x0) returned 1
	[0187.376] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27a7528, dwFlags=0x0) returned 1
	[0187.376] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a756c*, pdwDataLen=0x540efd4*=0x320, dwBufLen=0x320 | out: pbData=0x27a756c*, pdwDataLen=0x540efd4*=0x320) returned 1
	[0187.376] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a7898*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a7898*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.376] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.376] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.376] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.376] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0187.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.376] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.377] GetFileType (hFile=0x318) returned 0x1
	[0187.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.377] GetFileType (hFile=0x318) returned 0x1
	[0187.378] WriteFile (in: hFile=0x318, lpBuffer=0x27a7b2c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27a7b2c*, lpNumberOfBytesWritten=0x540ef94*=0x320, lpOverlapped=0x0) returned 1
	[0187.378] CloseHandle (hObject=0x318) returned 1
	[0187.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0187.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdb
	[0187.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.379] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa03edb2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1
	[0187.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.379] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.381] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a91b4 | out: lpFileInformation=0x27a91b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e340a5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e340a5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e340a5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e)) returned 1
	[0187.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.382] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.382] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.382] GetFileType (hFile=0x318) returned 0x1
	[0187.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.382] GetFileType (hFile=0x318) returned 0x1
	[0187.382] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34e
	[0187.382] ReadFile (in: hFile=0x318, lpBuffer=0x27a99b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a99b0*, lpNumberOfBytesRead=0x540efcc*=0x34e, lpOverlapped=0x0) returned 1
	[0187.402] CloseHandle (hObject=0x318) returned 1
	[0187.402] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.402] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.402] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27aaa4c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0187.402] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.402] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.402] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0187.402] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.402] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27aab04*=0x1, dwFlags=0x0) returned 1
	[0187.402] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27aaad0, dwFlags=0x0) returned 1
	[0187.403] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27aab14*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x27aab14*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0187.403] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27aae70*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27aae70*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.403] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0187.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.403] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.403] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.404] GetFileType (hFile=0x318) returned 0x1
	[0187.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.404] GetFileType (hFile=0x318) returned 0x1
	[0187.404] WriteFile (in: hFile=0x318, lpBuffer=0x27ab0cc*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27ab0cc*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0187.405] CloseHandle (hObject=0x318) returned 1
	[0187.405] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.405] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.405] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e340a5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e340a5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa08b204, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0187.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.406] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0187.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.407] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ac6f0 | out: lpFileInformation=0x27ac6f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e5a314, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x281)) returned 1
	[0187.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0187.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.407] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.408] GetFileType (hFile=0x318) returned 0x1
	[0187.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.408] GetFileType (hFile=0x318) returned 0x1
	[0187.408] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x281
	[0187.408] ReadFile (in: hFile=0x318, lpBuffer=0x27acdf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27acdf0*, lpNumberOfBytesRead=0x540efcc*=0x281, lpOverlapped=0x0) returned 1
	[0187.409] CloseHandle (hObject=0x318) returned 1
	[0187.409] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.409] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.410] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ade8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0187.410] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.410] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.410] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0187.410] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.410] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27adf44*=0x1, dwFlags=0x0) returned 1
	[0187.410] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27adf10, dwFlags=0x0) returned 1
	[0187.410] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27adf54*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x27adf54*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0187.410] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ae1f0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27ae1f0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.410] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.410] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.410] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.410] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0187.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.410] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.412] GetFileType (hFile=0x318) returned 0x1
	[0187.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.412] GetFileType (hFile=0x318) returned 0x1
	[0187.412] WriteFile (in: hFile=0x318, lpBuffer=0x27ae434*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27ae434*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0187.413] CloseHandle (hObject=0x318) returned 1
	[0187.413] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0187.413] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0187.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.413] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa08b204, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0187.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.413] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.414] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0187.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.414] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27afa28 | out: lpFileInformation=0x27afa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e5a314, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0187.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.414] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0187.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.415] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.415] GetFileType (hFile=0x318) returned 0x1
	[0187.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.415] GetFileType (hFile=0x318) returned 0x1
	[0187.415] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c9
	[0187.415] ReadFile (in: hFile=0x318, lpBuffer=0x27b0190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b0190*, lpNumberOfBytesRead=0x540efcc*=0x2c9, lpOverlapped=0x0) returned 1
	[0187.416] CloseHandle (hObject=0x318) returned 1
	[0187.416] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.416] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.417] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b122c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0187.417] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.417] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.417] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0187.417] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.417] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x27b12e4*=0x1, dwFlags=0x0) returned 1
	[0187.417] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x27b12b0, dwFlags=0x0) returned 1
	[0187.417] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b12f4*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27b12f4*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.417] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b15d0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b15d0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.417] CryptDestroyKey (hKey=0x82b200) returned 1
	[0187.417] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.417] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.417] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0187.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.417] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.419] GetFileType (hFile=0x318) returned 0x1
	[0187.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.419] GetFileType (hFile=0x318) returned 0x1
	[0187.419] WriteFile (in: hFile=0x318, lpBuffer=0x27b1824*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27b1824*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.420] CloseHandle (hObject=0x318) returned 1
	[0187.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0187.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0187.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.420] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa0b1531, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.420] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.421] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.422] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b2e38 | out: lpFileInformation=0x27b2e38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e5a314, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2)) returned 1
	[0187.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.422] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.422] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.422] GetFileType (hFile=0x318) returned 0x1
	[0187.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.422] GetFileType (hFile=0x318) returned 0x1
	[0187.422] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d2
	[0187.422] ReadFile (in: hFile=0x318, lpBuffer=0x27b35e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b35e8*, lpNumberOfBytesRead=0x540efcc*=0x2d2, lpOverlapped=0x0) returned 1
	[0187.424] CloseHandle (hObject=0x318) returned 1
	[0187.424] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.424] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b4684, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0187.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.424] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0187.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.424] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27b473c*=0x1, dwFlags=0x0) returned 1
	[0187.425] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27b4708, dwFlags=0x0) returned 1
	[0187.425] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b474c*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27b474c*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0187.425] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b4a38*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b4a38*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.425] CryptDestroyKey (hKey=0x82b340) returned 1
	[0187.425] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.425] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.425] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.425] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.426] GetFileType (hFile=0x318) returned 0x1
	[0187.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.426] GetFileType (hFile=0x318) returned 0x1
	[0187.427] WriteFile (in: hFile=0x318, lpBuffer=0x27b4cac*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27b4cac*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0187.427] CloseHandle (hObject=0x318) returned 1
	[0187.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0187.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.428] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa0b1531, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0187.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.428] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.429] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b6300 | out: lpFileInformation=0x27b6300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285)) returned 1
	[0187.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.430] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.430] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.430] GetFileType (hFile=0x318) returned 0x1
	[0187.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.430] GetFileType (hFile=0x318) returned 0x1
	[0187.430] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x285
	[0187.430] ReadFile (in: hFile=0x318, lpBuffer=0x27b6a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b6a34*, lpNumberOfBytesRead=0x540efcc*=0x285, lpOverlapped=0x0) returned 1
	[0187.431] CloseHandle (hObject=0x318) returned 1
	[0187.431] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.431] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.431] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b7ad0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0187.432] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.432] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.432] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0187.432] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.432] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27b7b88*=0x1, dwFlags=0x0) returned 1
	[0187.432] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27b7b54, dwFlags=0x0) returned 1
	[0187.432] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b7b98*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x27b7b98*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0187.432] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b7e34*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b7e34*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.432] CryptDestroyKey (hKey=0x82b100) returned 1
	[0187.432] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.432] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.432] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.434] GetFileType (hFile=0x318) returned 0x1
	[0187.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.434] GetFileType (hFile=0x318) returned 0x1
	[0187.434] WriteFile (in: hFile=0x318, lpBuffer=0x27b8090*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27b8090*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0187.435] CloseHandle (hObject=0x318) returned 1
	[0187.435] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.435] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.435] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa0d7955, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0187.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.435] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.436] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.436] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b96b4 | out: lpFileInformation=0x27b96b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7)) returned 1
	[0187.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.437] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.437] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.437] GetFileType (hFile=0x318) returned 0x1
	[0187.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.437] GetFileType (hFile=0x318) returned 0x1
	[0187.437] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c7
	[0187.437] ReadFile (in: hFile=0x318, lpBuffer=0x27b9e28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b9e28*, lpNumberOfBytesRead=0x540efcc*=0x2c7, lpOverlapped=0x0) returned 1
	[0187.463] CloseHandle (hObject=0x318) returned 1
	[0187.463] CryptDestroyKey (hKey=0x82b400) returned 1
	[0187.463] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.463] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27baec4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0187.463] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.463] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.463] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0187.463] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.463] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27baf7c*=0x1, dwFlags=0x0) returned 1
	[0187.463] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x27baf48, dwFlags=0x0) returned 1
	[0187.463] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27baf8c*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27baf8c*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.463] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27bb268*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27bb268*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.463] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0187.463] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.463] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.463] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.464] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.465] GetFileType (hFile=0x318) returned 0x1
	[0187.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.465] GetFileType (hFile=0x318) returned 0x1
	[0187.465] WriteFile (in: hFile=0x318, lpBuffer=0x27bb4c4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27bb4c4*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.466] CloseHandle (hObject=0x318) returned 1
	[0187.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0187.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.467] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa123c3e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.467] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.468] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27bcadc | out: lpFileInformation=0x27bcadc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354)) returned 1
	[0187.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.469] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.469] GetFileType (hFile=0x318) returned 0x1
	[0187.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.469] GetFileType (hFile=0x318) returned 0x1
	[0187.469] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x354
	[0187.469] ReadFile (in: hFile=0x318, lpBuffer=0x27bd2dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27bd2dc*, lpNumberOfBytesRead=0x540efcc*=0x354, lpOverlapped=0x0) returned 1
	[0187.471] CloseHandle (hObject=0x318) returned 1
	[0187.471] CryptDestroyKey (hKey=0x82b480) returned 1
	[0187.471] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.471] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27be378, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0187.471] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.471] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.471] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0187.471] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.471] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27be430*=0x1, dwFlags=0x0) returned 1
	[0187.471] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27be3fc, dwFlags=0x0) returned 1
	[0187.471] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27be440*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x27be440*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0187.471] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27be7ac*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27be7ac*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.471] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0187.471] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.471] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.471] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.473] GetFileType (hFile=0x318) returned 0x1
	[0187.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.473] GetFileType (hFile=0x318) returned 0x1
	[0187.473] WriteFile (in: hFile=0x318, lpBuffer=0x27bea08*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27bea08*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0187.474] CloseHandle (hObject=0x318) returned 1
	[0187.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.474] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa123c3e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0187.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.474] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.475] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.475] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c002c | out: lpFileInformation=0x27c002c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8)) returned 1
	[0187.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.476] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.476] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.476] GetFileType (hFile=0x318) returned 0x1
	[0187.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.476] GetFileType (hFile=0x318) returned 0x1
	[0187.476] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1d8
	[0187.476] ReadFile (in: hFile=0x318, lpBuffer=0x27c0630, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c0630*, lpNumberOfBytesRead=0x540efcc*=0x1d8, lpOverlapped=0x0) returned 1
	[0187.477] CloseHandle (hObject=0x318) returned 1
	[0187.477] CryptDestroyKey (hKey=0x82b540) returned 1
	[0187.477] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.477] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c16cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0187.477] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.477] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.477] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0187.478] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.478] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27c1784*=0x1, dwFlags=0x0) returned 1
	[0187.478] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27c1750, dwFlags=0x0) returned 1
	[0187.478] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c1794*, pdwDataLen=0x540efd4*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x27c1794*, pdwDataLen=0x540efd4*=0x1e0) returned 1
	[0187.478] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c1980*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c1980*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.478] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0187.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.478] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.478] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.479] GetFileType (hFile=0x318) returned 0x1
	[0187.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.479] GetFileType (hFile=0x318) returned 0x1
	[0187.480] WriteFile (in: hFile=0x318, lpBuffer=0x27c1b9c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27c1b9c*, lpNumberOfBytesWritten=0x540ef94*=0x1e0, lpOverlapped=0x0) returned 1
	[0187.480] CloseHandle (hObject=0x318) returned 1
	[0187.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0187.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.481] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa14a5a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0187.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.481] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.483] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c3140 | out: lpFileInformation=0x27c3140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0187.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.483] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.483] GetFileType (hFile=0x318) returned 0x1
	[0187.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.483] GetFileType (hFile=0x318) returned 0x1
	[0187.483] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c9
	[0187.483] ReadFile (in: hFile=0x318, lpBuffer=0x27c38c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c38c8*, lpNumberOfBytesRead=0x540efcc*=0x2c9, lpOverlapped=0x0) returned 1
	[0187.485] CloseHandle (hObject=0x318) returned 1
	[0187.485] CryptDestroyKey (hKey=0x82b280) returned 1
	[0187.485] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.485] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c4964, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0187.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.485] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0187.486] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.486] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27c4a1c*=0x1, dwFlags=0x0) returned 1
	[0187.486] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x27c49e8, dwFlags=0x0) returned 1
	[0187.486] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c4a2c*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27c4a2c*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.486] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c4d08*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c4d08*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.486] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0187.486] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.486] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.486] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.486] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.487] GetFileType (hFile=0x318) returned 0x1
	[0187.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.487] GetFileType (hFile=0x318) returned 0x1
	[0187.488] WriteFile (in: hFile=0x318, lpBuffer=0x27c4f6c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27c4f6c*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.488] CloseHandle (hObject=0x318) returned 1
	[0187.489] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.489] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0187.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.489] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa14a5a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.489] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.490] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0187.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.490] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c65a0 | out: lpFileInformation=0x27c65a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ea67ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x291)) returned 1
	[0187.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.491] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0187.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.491] ReadFile (in: hFile=0x318, lpBuffer=0x27c6d40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c6d40*, lpNumberOfBytesRead=0x540efcc*=0x291, lpOverlapped=0x0) returned 1
	[0187.492] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.492] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.493] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c7ddc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0187.493] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.493] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.493] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0187.493] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.493] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27c7e94*=0x1, dwFlags=0x0) returned 1
	[0187.493] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27c7e60, dwFlags=0x0) returned 1
	[0187.493] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c7ea4*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x27c7ea4*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0187.493] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8150*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c8150*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.493] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.493] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.493] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.493] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0187.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.493] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.495] GetFileType (hFile=0x318) returned 0x1
	[0187.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.495] GetFileType (hFile=0x318) returned 0x1
	[0187.495] WriteFile (in: hFile=0x318, lpBuffer=0x27c83dc*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27c83dc*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0187.496] CloseHandle (hObject=0x318) returned 1
	[0187.496] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0187.496] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xda
	[0187.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.496] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa1700c5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0187.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.496] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.497] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.498] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c9a60 | out: lpFileInformation=0x27c9a60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90221ca6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353)) returned 1
	[0187.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.498] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.498] GetFileType (hFile=0x318) returned 0x1
	[0187.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.498] GetFileType (hFile=0x318) returned 0x1
	[0187.498] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x353
	[0187.498] ReadFile (in: hFile=0x318, lpBuffer=0x27ca240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27ca240*, lpNumberOfBytesRead=0x540efcc*=0x353, lpOverlapped=0x0) returned 1
	[0187.521] CloseHandle (hObject=0x318) returned 1
	[0187.522] CryptDestroyKey (hKey=0x82b100) returned 1
	[0187.522] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.522] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27cb2dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0187.522] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.522] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.522] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0187.522] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.522] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27cb394*=0x1, dwFlags=0x0) returned 1
	[0187.522] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27cb360, dwFlags=0x0) returned 1
	[0187.522] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27cb3a4*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x27cb3a4*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0187.522] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb710*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27cb710*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.522] CryptDestroyKey (hKey=0x82b340) returned 1
	[0187.522] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.522] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.522] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.522] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.524] GetFileType (hFile=0x318) returned 0x1
	[0187.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.524] GetFileType (hFile=0x318) returned 0x1
	[0187.524] WriteFile (in: hFile=0x318, lpBuffer=0x27cb95c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27cb95c*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0187.525] CloseHandle (hObject=0x318) returned 1
	[0187.525] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.525] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0187.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.525] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa19633e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0187.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.525] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.527] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.527] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ccf60 | out: lpFileInformation=0x27ccf60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5)) returned 1
	[0187.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.527] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.527] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.528] GetFileType (hFile=0x318) returned 0x1
	[0187.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.528] GetFileType (hFile=0x318) returned 0x1
	[0187.528] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c5
	[0187.528] ReadFile (in: hFile=0x318, lpBuffer=0x27cd6c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27cd6c4*, lpNumberOfBytesRead=0x540efcc*=0x2c5, lpOverlapped=0x0) returned 1
	[0187.529] CloseHandle (hObject=0x318) returned 1
	[0187.529] CryptDestroyKey (hKey=0x82b540) returned 1
	[0187.529] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.530] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ce760, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b040) returned 1
	[0187.530] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.530] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.530] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0187.530] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.530] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27ce818*=0x1, dwFlags=0x0) returned 1
	[0187.530] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27ce7e4, dwFlags=0x0) returned 1
	[0187.530] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ce828*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27ce828*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.530] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ceb04*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27ceb04*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.530] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.530] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.530] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.530] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.530] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.531] GetFileType (hFile=0x318) returned 0x1
	[0187.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.531] GetFileType (hFile=0x318) returned 0x1
	[0187.531] WriteFile (in: hFile=0x318, lpBuffer=0x27ced58*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27ced58*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.532] CloseHandle (hObject=0x318) returned 1
	[0187.533] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.533] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0187.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.533] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa1bc5be, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.533] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.534] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.534] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d0360 | out: lpFileInformation=0x27d0360*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ea67ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6)) returned 1
	[0187.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.535] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.535] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.535] GetFileType (hFile=0x318) returned 0x1
	[0187.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.535] GetFileType (hFile=0x318) returned 0x1
	[0187.535] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d6
	[0187.535] ReadFile (in: hFile=0x318, lpBuffer=0x27d0b14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27d0b14*, lpNumberOfBytesRead=0x540efcc*=0x2d6, lpOverlapped=0x0) returned 1
	[0187.537] CloseHandle (hObject=0x318) returned 1
	[0187.537] CryptDestroyKey (hKey=0x82b040) returned 1
	[0187.537] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.537] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d1bb0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0187.537] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.537] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.537] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0187.537] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.537] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27d1c68*=0x1, dwFlags=0x0) returned 1
	[0187.537] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27d1c34, dwFlags=0x0) returned 1
	[0187.537] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d1c78*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27d1c78*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0187.537] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d1f64*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27d1f64*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.537] CryptDestroyKey (hKey=0x82b380) returned 1
	[0187.537] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.537] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.537] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.539] GetFileType (hFile=0x318) returned 0x1
	[0187.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.539] GetFileType (hFile=0x318) returned 0x1
	[0187.539] WriteFile (in: hFile=0x318, lpBuffer=0x27d21d8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27d21d8*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0187.540] CloseHandle (hObject=0x318) returned 1
	[0187.540] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.540] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0187.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.540] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa1bc5be, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0187.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.540] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.541] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.541] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d382c | out: lpFileInformation=0x27d382c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ea67ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0187.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.542] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.542] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.542] GetFileType (hFile=0x318) returned 0x1
	[0187.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.542] GetFileType (hFile=0x318) returned 0x1
	[0187.542] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cc
	[0187.542] ReadFile (in: hFile=0x318, lpBuffer=0x27d3fd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27d3fd4*, lpNumberOfBytesRead=0x540efcc*=0x2cc, lpOverlapped=0x0) returned 1
	[0187.544] CloseHandle (hObject=0x318) returned 1
	[0187.544] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.544] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.544] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d5070, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0187.544] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.544] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.544] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0187.544] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.544] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27d5128*=0x1, dwFlags=0x0) returned 1
	[0187.545] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27d50f4, dwFlags=0x0) returned 1
	[0187.545] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d5138*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27d5138*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.545] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d5414*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27d5414*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.545] CryptDestroyKey (hKey=0x82b280) returned 1
	[0187.545] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.545] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.545] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.545] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.546] GetFileType (hFile=0x318) returned 0x1
	[0187.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.546] GetFileType (hFile=0x318) returned 0x1
	[0187.546] WriteFile (in: hFile=0x318, lpBuffer=0x27d5688*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27d5688*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.547] CloseHandle (hObject=0x318) returned 1
	[0187.548] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.548] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0187.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.548] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa1e2865, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.548] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.549] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.549] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d6cdc | out: lpFileInformation=0x27d6cdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ea67ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353)) returned 1
	[0187.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.549] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.549] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.549] GetFileType (hFile=0x318) returned 0x1
	[0187.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.550] GetFileType (hFile=0x318) returned 0x1
	[0187.550] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x353
	[0187.550] ReadFile (in: hFile=0x318, lpBuffer=0x27d74cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27d74cc*, lpNumberOfBytesRead=0x540efcc*=0x353, lpOverlapped=0x0) returned 1
	[0187.551] CloseHandle (hObject=0x318) returned 1
	[0187.551] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.551] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.551] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d8568, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0187.551] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.551] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.551] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0187.551] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.551] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27d8620*=0x1, dwFlags=0x0) returned 1
	[0187.551] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27d85ec, dwFlags=0x0) returned 1
	[0187.551] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d8630*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x27d8630*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0187.552] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d899c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27d899c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.552] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.552] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.552] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.552] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.552] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.553] GetFileType (hFile=0x318) returned 0x1
	[0187.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.553] GetFileType (hFile=0x318) returned 0x1
	[0187.553] WriteFile (in: hFile=0x318, lpBuffer=0x27d8bf0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27d8bf0*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0187.554] CloseHandle (hObject=0x318) returned 1
	[0187.554] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.554] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0187.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.554] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa1e2865, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0187.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.554] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.555] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.555] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27da1f8 | out: lpFileInformation=0x27da1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35a)) returned 1
	[0187.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.556] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.556] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.556] GetFileType (hFile=0x318) returned 0x1
	[0187.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.556] GetFileType (hFile=0x318) returned 0x1
	[0187.556] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x35a
	[0187.556] ReadFile (in: hFile=0x318, lpBuffer=0x27da9f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27da9f0*, lpNumberOfBytesRead=0x540efcc*=0x35a, lpOverlapped=0x0) returned 1
	[0187.574] CloseHandle (hObject=0x318) returned 1
	[0187.574] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.574] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.574] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27dba8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0187.574] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.574] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.574] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0187.574] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.574] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27dbb44*=0x1, dwFlags=0x0) returned 1
	[0187.574] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27dbb10, dwFlags=0x0) returned 1
	[0187.575] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27dbb54*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x27dbb54*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0187.575] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27dbec0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27dbec0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.575] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0187.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.575] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.575] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.576] GetFileType (hFile=0x318) returned 0x1
	[0187.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.576] GetFileType (hFile=0x318) returned 0x1
	[0187.576] WriteFile (in: hFile=0x318, lpBuffer=0x27dc114*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27dc114*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0187.577] CloseHandle (hObject=0x318) returned 1
	[0187.578] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.578] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0187.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.578] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa22ed0a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0187.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.578] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.579] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0187.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.579] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27dd71c | out: lpFileInformation=0x27dd71c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x201)) returned 1
	[0187.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.580] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0187.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.580] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.580] GetFileType (hFile=0x318) returned 0x1
	[0187.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.581] GetFileType (hFile=0x318) returned 0x1
	[0187.581] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x201
	[0187.581] ReadFile (in: hFile=0x318, lpBuffer=0x27dddcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27dddcc*, lpNumberOfBytesRead=0x540efcc*=0x201, lpOverlapped=0x0) returned 1
	[0187.583] CloseHandle (hObject=0x318) returned 1
	[0187.583] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.583] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.584] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27dee68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0187.584] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.584] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.584] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0187.584] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.584] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x27def20*=0x1, dwFlags=0x0) returned 1
	[0187.584] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x27deeec, dwFlags=0x0) returned 1
	[0187.584] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27def30*, pdwDataLen=0x540efd4*=0x210, dwBufLen=0x210 | out: pbData=0x27def30*, pdwDataLen=0x540efd4*=0x210) returned 1
	[0187.584] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27df14c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27df14c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.584] CryptDestroyKey (hKey=0x82b440) returned 1
	[0187.584] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.584] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.584] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0187.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.584] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.585] GetFileType (hFile=0x318) returned 0x1
	[0187.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.586] GetFileType (hFile=0x318) returned 0x1
	[0187.586] WriteFile (in: hFile=0x318, lpBuffer=0x27df3a8*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27df3a8*, lpNumberOfBytesWritten=0x540ef94*=0x210, lpOverlapped=0x0) returned 1
	[0187.586] CloseHandle (hObject=0x318) returned 1
	[0187.587] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0187.587] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0187.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.587] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa22ed0a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x210)) returned 1
	[0187.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.587] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.588] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e09c0 | out: lpFileInformation=0x27e09c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1dc)) returned 1
	[0187.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.588] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.588] GetFileType (hFile=0x318) returned 0x1
	[0187.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.589] GetFileType (hFile=0x318) returned 0x1
	[0187.589] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1dc
	[0187.589] ReadFile (in: hFile=0x318, lpBuffer=0x27e0fc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27e0fc8*, lpNumberOfBytesRead=0x540efcc*=0x1dc, lpOverlapped=0x0) returned 1
	[0187.590] CloseHandle (hObject=0x318) returned 1
	[0187.590] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.590] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.590] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e2064, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0187.590] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.590] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.590] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0187.590] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.590] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27e211c*=0x1, dwFlags=0x0) returned 1
	[0187.590] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27e20e8, dwFlags=0x0) returned 1
	[0187.590] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e212c*, pdwDataLen=0x540efd4*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x27e212c*, pdwDataLen=0x540efd4*=0x1e0) returned 1
	[0187.591] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e2318*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27e2318*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.591] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.591] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.591] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.591] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.592] GetFileType (hFile=0x318) returned 0x1
	[0187.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.592] GetFileType (hFile=0x318) returned 0x1
	[0187.592] WriteFile (in: hFile=0x318, lpBuffer=0x27e2534*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27e2534*, lpNumberOfBytesWritten=0x540ef94*=0x1e0, lpOverlapped=0x0) returned 1
	[0187.593] CloseHandle (hObject=0x318) returned 1
	[0187.593] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.593] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0187.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.593] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa254f9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0187.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.594] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.610] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0187.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.610] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e3ad8 | out: lpFileInformation=0x27e3ad8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x348)) returned 1
	[0187.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.610] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0187.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.610] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.611] GetFileType (hFile=0x318) returned 0x1
	[0187.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.611] GetFileType (hFile=0x318) returned 0x1
	[0187.611] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x348
	[0187.611] ReadFile (in: hFile=0x318, lpBuffer=0x27e42ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27e42ac*, lpNumberOfBytesRead=0x540efcc*=0x348, lpOverlapped=0x0) returned 1
	[0187.620] CloseHandle (hObject=0x318) returned 1
	[0187.620] CryptDestroyKey (hKey=0x82b540) returned 1
	[0187.620] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.620] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e5348, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0187.620] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.620] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.620] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0187.620] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.620] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27e5400*=0x1, dwFlags=0x0) returned 1
	[0187.620] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27e53cc, dwFlags=0x0) returned 1
	[0187.621] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e5410*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x27e5410*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0187.621] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e576c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27e576c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.621] CryptDestroyKey (hKey=0x82b280) returned 1
	[0187.621] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.621] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.621] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0187.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.621] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.622] GetFileType (hFile=0x318) returned 0x1
	[0187.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.622] GetFileType (hFile=0x318) returned 0x1
	[0187.622] WriteFile (in: hFile=0x318, lpBuffer=0x27e59b8*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27e59b8*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0187.623] CloseHandle (hObject=0x318) returned 1
	[0187.624] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0187.624] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0187.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.624] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa2a1394, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0187.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.624] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.625] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.625] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e6fb0 | out: lpFileInformation=0x27e6fb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0187.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.626] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.626] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.626] GetFileType (hFile=0x318) returned 0x1
	[0187.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.626] GetFileType (hFile=0x318) returned 0x1
	[0187.626] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2ca
	[0187.626] ReadFile (in: hFile=0x318, lpBuffer=0x27e7728, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27e7728*, lpNumberOfBytesRead=0x540efcc*=0x2ca, lpOverlapped=0x0) returned 1
	[0187.628] CloseHandle (hObject=0x318) returned 1
	[0187.628] CryptDestroyKey (hKey=0x82b400) returned 1
	[0187.628] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.628] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e87c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0187.628] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.628] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.628] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0187.628] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.629] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27e887c*=0x1, dwFlags=0x0) returned 1
	[0187.629] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27e8848, dwFlags=0x0) returned 1
	[0187.629] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e888c*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27e888c*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0187.629] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e8b68*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27e8b68*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.629] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.629] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.629] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.629] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.629] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.660] GetFileType (hFile=0x318) returned 0x1
	[0187.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.660] GetFileType (hFile=0x318) returned 0x1
	[0187.660] WriteFile (in: hFile=0x318, lpBuffer=0x27e8dc4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27e8dc4*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.661] CloseHandle (hObject=0x318) returned 1
	[0187.661] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.661] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0187.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.661] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa2ed8fc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.661] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.663] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.663] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ea3dc | out: lpFileInformation=0x27ea3dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ef2cc3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356)) returned 1
	[0187.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.663] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.663] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.663] GetFileType (hFile=0x318) returned 0x1
	[0187.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.664] GetFileType (hFile=0x318) returned 0x1
	[0187.664] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x356
	[0187.664] ReadFile (in: hFile=0x318, lpBuffer=0x27eabe0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27eabe0*, lpNumberOfBytesRead=0x540efcc*=0x356, lpOverlapped=0x0) returned 1
	[0187.665] CloseHandle (hObject=0x318) returned 1
	[0187.665] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.665] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.666] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ebc7c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0187.666] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.666] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.666] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0187.666] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.666] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27ebd34*=0x1, dwFlags=0x0) returned 1
	[0187.666] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27ebd00, dwFlags=0x0) returned 1
	[0187.666] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ebd44*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x27ebd44*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0187.666] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ec0b0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27ec0b0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.666] CryptDestroyKey (hKey=0x82b100) returned 1
	[0187.666] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.666] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.666] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.666] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.668] GetFileType (hFile=0x318) returned 0x1
	[0187.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.668] GetFileType (hFile=0x318) returned 0x1
	[0187.668] WriteFile (in: hFile=0x318, lpBuffer=0x27ec30c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27ec30c*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0187.669] CloseHandle (hObject=0x318) returned 1
	[0187.669] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.669] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.669] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa313a23, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0187.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.669] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.670] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.670] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ed930 | out: lpFileInformation=0x27ed930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ef2cc3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352)) returned 1
	[0187.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.671] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.671] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.671] GetFileType (hFile=0x318) returned 0x1
	[0187.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.671] GetFileType (hFile=0x318) returned 0x1
	[0187.671] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x352
	[0187.671] ReadFile (in: hFile=0x318, lpBuffer=0x27ee130, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27ee130*, lpNumberOfBytesRead=0x540efcc*=0x352, lpOverlapped=0x0) returned 1
	[0187.673] CloseHandle (hObject=0x318) returned 1
	[0187.673] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.673] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.673] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ef1cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0187.673] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.673] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.673] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0187.673] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.673] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27ef284*=0x1, dwFlags=0x0) returned 1
	[0187.673] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27ef250, dwFlags=0x0) returned 1
	[0187.673] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ef294*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x27ef294*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0187.673] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ef600*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27ef600*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.673] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.673] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.673] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.673] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.673] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.674] GetFileType (hFile=0x318) returned 0x1
	[0187.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.675] GetFileType (hFile=0x318) returned 0x1
	[0187.675] WriteFile (in: hFile=0x318, lpBuffer=0x27ef85c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27ef85c*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0187.676] CloseHandle (hObject=0x318) returned 1
	[0187.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.676] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa313a23, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0187.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.676] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.677] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.677] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f0e80 | out: lpFileInformation=0x27f0e80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90221ca6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353)) returned 1
	[0187.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0187.678] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.678] GetFileType (hFile=0x318) returned 0x1
	[0187.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0187.678] GetFileType (hFile=0x318) returned 0x1
	[0187.678] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x353
	[0187.678] ReadFile (in: hFile=0x318, lpBuffer=0x27f1660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27f1660*, lpNumberOfBytesRead=0x540efcc*=0x353, lpOverlapped=0x0) returned 1
	[0187.680] CloseHandle (hObject=0x318) returned 1
	[0187.680] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.680] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.680] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f26fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0187.680] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.680] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.680] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0187.680] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.680] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27f27b4*=0x1, dwFlags=0x0) returned 1
	[0187.680] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27f2780, dwFlags=0x0) returned 1
	[0187.680] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f27c4*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x27f27c4*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0187.680] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f2b30*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27f2b30*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0187.680] CryptDestroyKey (hKey=0x82b380) returned 1
	[0187.680] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.680] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0187.680] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.682] GetFileType (hFile=0x318) returned 0x1
	[0187.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0187.682] GetFileType (hFile=0x318) returned 0x1
	[0187.682] WriteFile (in: hFile=0x318, lpBuffer=0x27f2d7c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27f2d7c*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0187.683] CloseHandle (hObject=0x318) returned 1
	[0187.683] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.683] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0187.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0187.683] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa339cb2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0187.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0187.683] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.684] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0187.684] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f4380 | out: lpFileInformation=0x27f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ef2cc3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352)) returned 1
	[0187.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0187.864] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.921] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.946] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.975] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.976] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.987] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.025] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.086] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.146] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.178] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.229] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.293] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.358] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.585] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.696] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0188.764] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.764] GetFileType (hFile=0x318) returned 0x1
	[0188.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0188.764] GetFileType (hFile=0x318) returned 0x1
	[0188.764] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1d9
	[0188.764] ReadFile (in: hFile=0x318, lpBuffer=0x270cee0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x270cee0*, lpNumberOfBytesRead=0x540efcc*=0x1d9, lpOverlapped=0x0) returned 1
	[0188.765] CloseHandle (hObject=0x318) returned 1
	[0188.766] CryptDestroyKey (hKey=0x82b280) returned 1
	[0188.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.766] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270df7c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0188.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.766] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0188.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.766] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x270e034*=0x1, dwFlags=0x0) returned 1
	[0188.766] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x270e000, dwFlags=0x0) returned 1
	[0188.766] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270e044*, pdwDataLen=0x540efd4*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x270e044*, pdwDataLen=0x540efd4*=0x1e0) returned 1
	[0188.766] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270e230*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x270e230*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0188.766] CryptDestroyKey (hKey=0x82b100) returned 1
	[0188.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0188.766] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.768] GetFileType (hFile=0x318) returned 0x1
	[0188.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0188.768] GetFileType (hFile=0x318) returned 0x1
	[0188.768] WriteFile (in: hFile=0x318, lpBuffer=0x270e44c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x270e44c*, lpNumberOfBytesWritten=0x540ef94*=0x1e0, lpOverlapped=0x0) returned 1
	[0188.769] CloseHandle (hObject=0x318) returned 1
	[0188.769] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.769] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0188.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0188.769] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaad81f2b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0188.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0188.769] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.784] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0188.784] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x270f9f0 | out: lpFileInformation=0x270f9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0188.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0188.784] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0188.784] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.784] GetFileType (hFile=0x318) returned 0x1
	[0188.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0188.784] GetFileType (hFile=0x318) returned 0x1
	[0188.785] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cf
	[0188.785] ReadFile (in: hFile=0x318, lpBuffer=0x271015c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271015c*, lpNumberOfBytesRead=0x540efcc*=0x2cf, lpOverlapped=0x0) returned 1
	[0188.793] CloseHandle (hObject=0x318) returned 1
	[0188.793] CryptDestroyKey (hKey=0x82b400) returned 1
	[0188.793] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.794] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27111f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0188.794] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.794] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.794] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0188.794] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.794] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27112b0*=0x1, dwFlags=0x0) returned 1
	[0188.794] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x271127c, dwFlags=0x0) returned 1
	[0188.794] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27112c0*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27112c0*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0188.794] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271159c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271159c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0188.794] CryptDestroyKey (hKey=0x82b480) returned 1
	[0188.794] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.794] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0188.794] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.795] GetFileType (hFile=0x318) returned 0x1
	[0188.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0188.796] GetFileType (hFile=0x318) returned 0x1
	[0188.796] WriteFile (in: hFile=0x318, lpBuffer=0x27117f0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27117f0*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.796] CloseHandle (hObject=0x318) returned 1
	[0188.797] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.797] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0188.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0188.797] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaadce3ef, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0188.797] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.798] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb4
	[0188.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0188.798] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2712e04 | out: lpFileInformation=0x2712e04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29f)) returned 1
	[0188.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0188.798] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb4
	[0188.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0188.798] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.799] GetFileType (hFile=0x318) returned 0x1
	[0188.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0188.799] GetFileType (hFile=0x318) returned 0x1
	[0188.799] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x29f
	[0188.799] ReadFile (in: hFile=0x318, lpBuffer=0x2713600, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2713600*, lpNumberOfBytesRead=0x540efcc*=0x29f, lpOverlapped=0x0) returned 1
	[0188.800] CloseHandle (hObject=0x318) returned 1
	[0188.800] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.800] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.800] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271469c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0188.800] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.800] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.800] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0188.800] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.801] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2714754*=0x1, dwFlags=0x0) returned 1
	[0188.801] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2714720, dwFlags=0x0) returned 1
	[0188.801] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2714764*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x2714764*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0188.801] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2714a10*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2714a10*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0188.801] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb4
	[0188.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0188.801] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.802] GetFileType (hFile=0x318) returned 0x1
	[0188.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0188.802] GetFileType (hFile=0x318) returned 0x1
	[0188.802] WriteFile (in: hFile=0x318, lpBuffer=0x2714cc4*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2714cc4*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0188.803] CloseHandle (hObject=0x318) returned 1
	[0188.803] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb4
	[0188.803] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe3
	[0188.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0188.803] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaadce3ef, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0188.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0188.804] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0188.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0188.805] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x271638c | out: lpFileInformation=0x271638c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294)) returned 1
	[0188.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0188.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0188.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0188.805] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.805] GetFileType (hFile=0x318) returned 0x1
	[0188.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0188.805] GetFileType (hFile=0x318) returned 0x1
	[0188.805] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x294
	[0188.806] ReadFile (in: hFile=0x318, lpBuffer=0x2716b3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2716b3c*, lpNumberOfBytesRead=0x540efcc*=0x294, lpOverlapped=0x0) returned 1
	[0188.807] CloseHandle (hObject=0x318) returned 1
	[0188.807] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0188.807] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.807] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2717bd8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0188.807] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.807] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.808] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0188.808] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.808] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2717c90*=0x1, dwFlags=0x0) returned 1
	[0188.808] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2717c5c, dwFlags=0x0) returned 1
	[0188.808] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2717ca0*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x2717ca0*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0188.808] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2717f4c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2717f4c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0188.808] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.808] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.808] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.808] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0188.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0188.808] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.809] GetFileType (hFile=0x318) returned 0x1
	[0188.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0188.809] GetFileType (hFile=0x318) returned 0x1
	[0188.810] WriteFile (in: hFile=0x318, lpBuffer=0x27181e0*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27181e0*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0188.810] CloseHandle (hObject=0x318) returned 1
	[0188.811] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0188.811] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdb
	[0188.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0188.811] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaadf48cd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0188.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0188.811] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.812] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb6
	[0188.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0188.812] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2719868 | out: lpFileInformation=0x2719868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2a2)) returned 1
	[0188.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0188.813] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb6
	[0188.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0188.813] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.813] GetFileType (hFile=0x318) returned 0x1
	[0188.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0188.813] GetFileType (hFile=0x318) returned 0x1
	[0188.813] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2a2
	[0188.813] ReadFile (in: hFile=0x318, lpBuffer=0x271a078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271a078*, lpNumberOfBytesRead=0x540efcc*=0x2a2, lpOverlapped=0x0) returned 1
	[0188.814] CloseHandle (hObject=0x318) returned 1
	[0188.815] CryptDestroyKey (hKey=0x82b480) returned 1
	[0188.815] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.815] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271b114, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0188.815] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.815] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.815] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0188.815] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.815] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x271b1cc*=0x1, dwFlags=0x0) returned 1
	[0188.815] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x271b198, dwFlags=0x0) returned 1
	[0188.815] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271b1dc*, pdwDataLen=0x540efd4*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x271b1dc*, pdwDataLen=0x540efd4*=0x2b0) returned 1
	[0188.815] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271b498*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271b498*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0188.815] CryptDestroyKey (hKey=0x82b380) returned 1
	[0188.815] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.815] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.815] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb6
	[0188.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0188.815] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.816] GetFileType (hFile=0x318) returned 0x1
	[0188.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0188.817] GetFileType (hFile=0x318) returned 0x1
	[0188.817] WriteFile (in: hFile=0x318, lpBuffer=0x271b754*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x271b754*, lpNumberOfBytesWritten=0x540ef94*=0x2b0, lpOverlapped=0x0) returned 1
	[0188.817] CloseHandle (hObject=0x318) returned 1
	[0188.818] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb6
	[0188.818] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe5
	[0188.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0188.818] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaadf48cd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2b0)) returned 1
	[0188.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0188.818] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.819] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0188.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0188.819] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x271ce2c | out: lpFileInformation=0x271ce2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e)) returned 1
	[0188.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0188.819] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0188.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0188.819] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.820] GetFileType (hFile=0x318) returned 0x1
	[0188.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0188.820] GetFileType (hFile=0x318) returned 0x1
	[0188.820] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x28e
	[0188.820] ReadFile (in: hFile=0x318, lpBuffer=0x271d588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271d588*, lpNumberOfBytesRead=0x540efcc*=0x28e, lpOverlapped=0x0) returned 1
	[0188.822] CloseHandle (hObject=0x318) returned 1
	[0188.823] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.823] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.823] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271e624, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0188.823] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.823] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.823] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0188.823] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.823] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x271e6dc*=0x1, dwFlags=0x0) returned 1
	[0188.823] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x271e6a8, dwFlags=0x0) returned 1
	[0188.823] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271e6ec*, pdwDataLen=0x540efd4*=0x290, dwBufLen=0x290 | out: pbData=0x271e6ec*, pdwDataLen=0x540efd4*=0x290) returned 1
	[0188.823] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271e988*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271e988*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0188.823] CryptDestroyKey (hKey=0x82b300) returned 1
	[0188.823] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.823] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.823] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0188.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0188.823] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.825] GetFileType (hFile=0x318) returned 0x1
	[0188.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0188.867] GetFileType (hFile=0x318) returned 0x1
	[0188.867] WriteFile (in: hFile=0x318, lpBuffer=0x271ebf4*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x271ebf4*, lpNumberOfBytesWritten=0x540ef94*=0x290, lpOverlapped=0x0) returned 1
	[0188.868] CloseHandle (hObject=0x318) returned 1
	[0188.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0188.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0188.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0188.869] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaae66e68, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0188.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0188.869] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.870] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0188.870] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x272022c | out: lpFileInformation=0x272022c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911c7ac2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da)) returned 1
	[0188.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0188.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0188.871] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.871] GetFileType (hFile=0x318) returned 0x1
	[0188.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0188.871] GetFileType (hFile=0x318) returned 0x1
	[0188.871] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2da
	[0188.871] ReadFile (in: hFile=0x318, lpBuffer=0x2720a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2720a04*, lpNumberOfBytesRead=0x540efcc*=0x2da, lpOverlapped=0x0) returned 1
	[0188.873] CloseHandle (hObject=0x318) returned 1
	[0188.873] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.873] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.873] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2721aa0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0188.873] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.873] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.873] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0188.873] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.873] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2721b58*=0x1, dwFlags=0x0) returned 1
	[0188.873] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2721b24, dwFlags=0x0) returned 1
	[0188.873] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721b68*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2721b68*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0188.873] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2721e54*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2721e54*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0188.873] CryptDestroyKey (hKey=0x82b300) returned 1
	[0188.873] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.873] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.873] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0188.873] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.875] GetFileType (hFile=0x318) returned 0x1
	[0188.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0188.875] GetFileType (hFile=0x318) returned 0x1
	[0188.875] WriteFile (in: hFile=0x318, lpBuffer=0x27220d8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27220d8*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0188.876] CloseHandle (hObject=0x318) returned 1
	[0188.876] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.876] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0188.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0188.876] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaae8db18, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0188.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0188.877] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0188.878] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2723740 | out: lpFileInformation=0x2723740*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911c7ac2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb)) returned 1
	[0188.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0188.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0188.879] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.879] GetFileType (hFile=0x318) returned 0x1
	[0188.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0188.879] GetFileType (hFile=0x318) returned 0x1
	[0188.879] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cb
	[0188.879] ReadFile (in: hFile=0x318, lpBuffer=0x2723db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2723db8*, lpNumberOfBytesRead=0x540efcc*=0x1cb, lpOverlapped=0x0) returned 1
	[0188.880] CloseHandle (hObject=0x318) returned 1
	[0188.880] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.880] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.880] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2724e54, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0188.880] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.880] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.880] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0188.880] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.881] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2724f0c*=0x1, dwFlags=0x0) returned 1
	[0188.881] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2724ed8, dwFlags=0x0) returned 1
	[0188.881] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2724f1c*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x2724f1c*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0188.881] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27250f8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27250f8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0188.881] CryptDestroyKey (hKey=0x82b040) returned 1
	[0188.881] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.881] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0188.881] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.882] GetFileType (hFile=0x318) returned 0x1
	[0188.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0188.882] GetFileType (hFile=0x318) returned 0x1
	[0188.882] WriteFile (in: hFile=0x318, lpBuffer=0x2725354*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2725354*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0188.883] CloseHandle (hObject=0x318) returned 1
	[0188.883] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.883] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0188.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0188.884] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaae8db18, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0188.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0188.884] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.888] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0188.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0188.888] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x272696c | out: lpFileInformation=0x272696c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911c7ac2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db)) returned 1
	[0188.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0188.888] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0188.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0188.889] ReadFile (in: hFile=0x318, lpBuffer=0x2727194, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2727194*, lpNumberOfBytesRead=0x540efcc*=0x2db, lpOverlapped=0x0) returned 1
	[0188.890] CryptDestroyKey (hKey=0x82b080) returned 1
	[0188.890] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.890] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2728230, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0188.890] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.891] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.891] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0188.891] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.891] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27282e8*=0x1, dwFlags=0x0) returned 1
	[0188.891] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27282b4, dwFlags=0x0) returned 1
	[0188.891] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27282f8*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27282f8*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0188.891] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27285e4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27285e4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0188.891] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.891] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.891] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0188.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0188.891] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.892] GetFileType (hFile=0x318) returned 0x1
	[0188.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0188.893] GetFileType (hFile=0x318) returned 0x1
	[0188.893] WriteFile (in: hFile=0x318, lpBuffer=0x2728890*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2728890*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0188.894] CloseHandle (hObject=0x318) returned 1
	[0188.894] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0188.894] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe1
	[0188.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0188.894] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaaeb72fc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0188.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0188.894] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.895] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0188.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0188.895] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2729f48 | out: lpFileInformation=0x2729f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911c7ac2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7)) returned 1
	[0188.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0188.896] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0188.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0188.896] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.896] GetFileType (hFile=0x318) returned 0x1
	[0188.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0188.896] GetFileType (hFile=0x318) returned 0x1
	[0188.896] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d7
	[0188.896] ReadFile (in: hFile=0x318, lpBuffer=0x272a73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x272a73c*, lpNumberOfBytesRead=0x540efcc*=0x2d7, lpOverlapped=0x0) returned 1
	[0188.898] CloseHandle (hObject=0x318) returned 1
	[0188.898] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0188.898] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.898] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272b7d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0188.898] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.898] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.898] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0188.898] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.898] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x272b890*=0x1, dwFlags=0x0) returned 1
	[0188.898] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x272b85c, dwFlags=0x0) returned 1
	[0188.898] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272b8a0*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x272b8a0*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0188.898] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272bb8c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x272bb8c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0188.898] CryptDestroyKey (hKey=0x82b000) returned 1
	[0188.898] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.898] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.898] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0188.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0188.899] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.900] GetFileType (hFile=0x318) returned 0x1
	[0188.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0188.900] GetFileType (hFile=0x318) returned 0x1
	[0188.900] WriteFile (in: hFile=0x318, lpBuffer=0x272be20*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x272be20*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0188.928] CloseHandle (hObject=0x318) returned 1
	[0188.928] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0188.928] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdc
	[0188.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0188.928] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaaeff809, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0188.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0188.928] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.930] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb7
	[0188.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0188.930] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x272d4b4 | out: lpFileInformation=0x272d4b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911edd2d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8)) returned 1
	[0188.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0189.169] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.203] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.275] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.323] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.347] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.353] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.354] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.361] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.423] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.435] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.443] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.449] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.450] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.561] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.623] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0189.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0189.623] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.623] GetFileType (hFile=0x318) returned 0x1
	[0189.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0189.623] GetFileType (hFile=0x318) returned 0x1
	[0189.623] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x291
	[0189.624] ReadFile (in: hFile=0x318, lpBuffer=0x27a2c7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a2c7c*, lpNumberOfBytesRead=0x540efcc*=0x291, lpOverlapped=0x0) returned 1
	[0189.625] CloseHandle (hObject=0x318) returned 1
	[0189.625] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.625] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.625] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a3d18, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0189.625] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.625] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.625] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0189.626] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.626] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27a3dd0*=0x1, dwFlags=0x0) returned 1
	[0189.626] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27a3d9c, dwFlags=0x0) returned 1
	[0189.626] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a3de0*, pdwDataLen=0x540efd4*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x27a3de0*, pdwDataLen=0x540efd4*=0x2a0) returned 1
	[0189.626] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a408c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a408c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0189.626] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.626] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.626] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.626] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0189.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0189.626] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.627] GetFileType (hFile=0x318) returned 0x1
	[0189.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0189.628] GetFileType (hFile=0x318) returned 0x1
	[0189.628] WriteFile (in: hFile=0x318, lpBuffer=0x27a4310*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27a4310*, lpNumberOfBytesWritten=0x540ef94*=0x2a0, lpOverlapped=0x0) returned 1
	[0189.629] CloseHandle (hObject=0x318) returned 1
	[0189.629] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0189.629] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd8
	[0189.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0189.629] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902943e8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902943e8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab5b4167, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0189.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0189.629] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.631] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0189.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0189.631] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a5984 | out: lpFileInformation=0x27a5984*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912f8e1e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300)) returned 1
	[0189.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0189.631] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0189.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0189.631] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.631] GetFileType (hFile=0x318) returned 0x1
	[0189.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0189.632] GetFileType (hFile=0x318) returned 0x1
	[0189.632] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x300
	[0189.632] ReadFile (in: hFile=0x318, lpBuffer=0x27a6120, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a6120*, lpNumberOfBytesRead=0x540efcc*=0x300, lpOverlapped=0x0) returned 1
	[0189.633] CloseHandle (hObject=0x318) returned 1
	[0189.634] CryptDestroyKey (hKey=0x82b280) returned 1
	[0189.634] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.634] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a71bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0189.634] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.634] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.634] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0189.634] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.634] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27a7274*=0x1, dwFlags=0x0) returned 1
	[0189.634] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27a7240, dwFlags=0x0) returned 1
	[0189.634] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a7284*, pdwDataLen=0x540efd4*=0x310, dwBufLen=0x310 | out: pbData=0x27a7284*, pdwDataLen=0x540efd4*=0x310) returned 1
	[0189.634] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a75a0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27a75a0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0189.634] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.634] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.634] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.634] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0189.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0189.634] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.636] GetFileType (hFile=0x318) returned 0x1
	[0189.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0189.636] GetFileType (hFile=0x318) returned 0x1
	[0189.636] WriteFile (in: hFile=0x318, lpBuffer=0x27a77f4*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27a77f4*, lpNumberOfBytesWritten=0x540ef94*=0x310, lpOverlapped=0x0) returned 1
	[0189.637] CloseHandle (hObject=0x318) returned 1
	[0189.637] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0189.637] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0189.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0189.637] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab5da2ca, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0189.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0189.638] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0189.639] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a8dfc | out: lpFileInformation=0x27a8dfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912f8e1e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0189.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0189.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0189.639] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.639] GetFileType (hFile=0x318) returned 0x1
	[0189.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0189.639] GetFileType (hFile=0x318) returned 0x1
	[0189.639] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c9
	[0189.639] ReadFile (in: hFile=0x318, lpBuffer=0x27a9554, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27a9554*, lpNumberOfBytesRead=0x540efcc*=0x2c9, lpOverlapped=0x0) returned 1
	[0189.641] CloseHandle (hObject=0x318) returned 1
	[0189.641] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.641] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.641] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27aa5f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0189.641] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.641] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.641] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0189.641] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.641] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27aa6a8*=0x1, dwFlags=0x0) returned 1
	[0189.641] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27aa674, dwFlags=0x0) returned 1
	[0189.641] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27aa6b8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27aa6b8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0189.642] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27aa994*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27aa994*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0189.642] CryptDestroyKey (hKey=0x82b340) returned 1
	[0189.642] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.642] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.642] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0189.642] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.643] GetFileType (hFile=0x318) returned 0x1
	[0189.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0189.643] GetFileType (hFile=0x318) returned 0x1
	[0189.643] WriteFile (in: hFile=0x318, lpBuffer=0x27aabe0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27aabe0*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0189.644] CloseHandle (hObject=0x318) returned 1
	[0189.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0189.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0189.644] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab5da2ca, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0189.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0189.645] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0189.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0189.646] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ac1e4 | out: lpFileInformation=0x27ac1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912f8e1e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30b)) returned 1
	[0189.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0189.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0189.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0189.646] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.647] GetFileType (hFile=0x318) returned 0x1
	[0189.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0189.647] GetFileType (hFile=0x318) returned 0x1
	[0189.647] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x30b
	[0189.647] ReadFile (in: hFile=0x318, lpBuffer=0x27ac98c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27ac98c*, lpNumberOfBytesRead=0x540efcc*=0x30b, lpOverlapped=0x0) returned 1
	[0189.648] CloseHandle (hObject=0x318) returned 1
	[0189.648] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.648] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.648] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ada28, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0189.648] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.648] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.649] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0189.649] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.649] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x27adae0*=0x1, dwFlags=0x0) returned 1
	[0189.649] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x27adaac, dwFlags=0x0) returned 1
	[0189.649] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27adaf0*, pdwDataLen=0x540efd4*=0x310, dwBufLen=0x310 | out: pbData=0x27adaf0*, pdwDataLen=0x540efd4*=0x310) returned 1
	[0189.649] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ade0c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27ade0c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0189.649] CryptDestroyKey (hKey=0x82b440) returned 1
	[0189.649] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.649] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.649] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0189.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0189.649] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.650] GetFileType (hFile=0x318) returned 0x1
	[0189.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0189.651] GetFileType (hFile=0x318) returned 0x1
	[0189.651] WriteFile (in: hFile=0x318, lpBuffer=0x27ae060*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27ae060*, lpNumberOfBytesWritten=0x540ef94*=0x310, lpOverlapped=0x0) returned 1
	[0189.652] CloseHandle (hObject=0x318) returned 1
	[0189.652] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0189.652] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0189.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0189.652] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab6005c3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0189.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0189.652] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.654] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0189.654] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27af668 | out: lpFileInformation=0x27af668*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912f8e1e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x363)) returned 1
	[0189.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0189.654] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0189.654] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.654] GetFileType (hFile=0x318) returned 0x1
	[0189.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0189.654] GetFileType (hFile=0x318) returned 0x1
	[0189.654] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x363
	[0189.655] ReadFile (in: hFile=0x318, lpBuffer=0x27afeb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27afeb8*, lpNumberOfBytesRead=0x540efcc*=0x363, lpOverlapped=0x0) returned 1
	[0189.656] CloseHandle (hObject=0x318) returned 1
	[0189.656] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.656] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.656] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b0f54, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0189.656] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.656] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.656] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0189.656] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.656] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x27b100c*=0x1, dwFlags=0x0) returned 1
	[0189.657] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x27b0fd8, dwFlags=0x0) returned 1
	[0189.657] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b101c*, pdwDataLen=0x540efd4*=0x370, dwBufLen=0x370 | out: pbData=0x27b101c*, pdwDataLen=0x540efd4*=0x370) returned 1
	[0189.657] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b1398*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b1398*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0189.657] CryptDestroyKey (hKey=0x82b040) returned 1
	[0189.657] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.657] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.657] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0189.657] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.658] GetFileType (hFile=0x318) returned 0x1
	[0189.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0189.658] GetFileType (hFile=0x318) returned 0x1
	[0189.658] WriteFile (in: hFile=0x318, lpBuffer=0x27b1614*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27b1614*, lpNumberOfBytesWritten=0x540ef94*=0x370, lpOverlapped=0x0) returned 1
	[0189.659] CloseHandle (hObject=0x318) returned 1
	[0189.660] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.660] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0189.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0189.660] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab6005c3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1
	[0189.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0189.660] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.661] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0189.661] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b2c6c | out: lpFileInformation=0x27b2c6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9131f086, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356)) returned 1
	[0189.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0189.689] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0189.689] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.690] GetFileType (hFile=0x318) returned 0x1
	[0189.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0189.690] GetFileType (hFile=0x318) returned 0x1
	[0189.690] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x356
	[0189.690] ReadFile (in: hFile=0x318, lpBuffer=0x27b34b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b34b0*, lpNumberOfBytesRead=0x540efcc*=0x356, lpOverlapped=0x0) returned 1
	[0189.692] CloseHandle (hObject=0x318) returned 1
	[0189.692] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0189.692] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.692] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b454c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0189.692] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.692] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.692] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0189.692] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.692] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27b4604*=0x1, dwFlags=0x0) returned 1
	[0189.692] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27b45d0, dwFlags=0x0) returned 1
	[0189.692] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b4614*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x27b4614*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0189.692] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b4980*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b4980*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0189.692] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.692] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.692] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.692] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0189.693] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.694] GetFileType (hFile=0x318) returned 0x1
	[0189.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0189.694] GetFileType (hFile=0x318) returned 0x1
	[0189.694] WriteFile (in: hFile=0x318, lpBuffer=0x27b4bfc*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27b4bfc*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0189.695] CloseHandle (hObject=0x318) returned 1
	[0189.695] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.695] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0189.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0189.696] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab64caca, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0189.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0189.696] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.697] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0189.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0189.697] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b6254 | out: lpFileInformation=0x27b6254*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9131f086, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2)) returned 1
	[0189.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0189.697] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0189.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0189.698] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.698] GetFileType (hFile=0x318) returned 0x1
	[0189.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0189.698] GetFileType (hFile=0x318) returned 0x1
	[0189.698] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d2
	[0189.698] ReadFile (in: hFile=0x318, lpBuffer=0x27b69c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b69c4*, lpNumberOfBytesRead=0x540efcc*=0x2d2, lpOverlapped=0x0) returned 1
	[0189.700] CloseHandle (hObject=0x318) returned 1
	[0189.700] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0189.700] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.700] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b7a60, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0189.700] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.701] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.701] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0189.701] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.701] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27b7b18*=0x1, dwFlags=0x0) returned 1
	[0189.701] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27b7ae4, dwFlags=0x0) returned 1
	[0189.701] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b7b28*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27b7b28*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0189.701] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b7e14*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27b7e14*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0189.701] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.701] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.701] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.701] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0189.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0189.701] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.703] GetFileType (hFile=0x318) returned 0x1
	[0189.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0189.703] GetFileType (hFile=0x318) returned 0x1
	[0189.703] WriteFile (in: hFile=0x318, lpBuffer=0x27b8068*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27b8068*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.704] CloseHandle (hObject=0x318) returned 1
	[0189.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0189.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0189.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0189.704] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab672ce0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0189.705] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.706] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0189.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0189.706] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b9670 | out: lpFileInformation=0x27b9670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9131f086, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x348)) returned 1
	[0189.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0189.706] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0189.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0189.706] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.706] GetFileType (hFile=0x318) returned 0x1
	[0189.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0189.707] GetFileType (hFile=0x318) returned 0x1
	[0189.707] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x348
	[0189.707] ReadFile (in: hFile=0x318, lpBuffer=0x27b9e44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27b9e44*, lpNumberOfBytesRead=0x540efcc*=0x348, lpOverlapped=0x0) returned 1
	[0189.708] CloseHandle (hObject=0x318) returned 1
	[0189.708] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.708] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.709] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27baee0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0189.709] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.709] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.709] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0189.709] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.709] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x27baf98*=0x1, dwFlags=0x0) returned 1
	[0189.709] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x27baf64, dwFlags=0x0) returned 1
	[0189.709] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27bafa8*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x27bafa8*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0189.709] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27bb304*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27bb304*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0189.709] CryptDestroyKey (hKey=0x82b200) returned 1
	[0189.709] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.709] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.709] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0189.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0189.709] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.711] GetFileType (hFile=0x318) returned 0x1
	[0189.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0189.711] GetFileType (hFile=0x318) returned 0x1
	[0189.711] WriteFile (in: hFile=0x318, lpBuffer=0x27bb550*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27bb550*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0189.712] CloseHandle (hObject=0x318) returned 1
	[0189.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0189.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0189.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0189.712] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab672ce0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0189.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0189.712] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0189.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0189.714] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27bcb48 | out: lpFileInformation=0x27bcb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913452f1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6)) returned 1
	[0189.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0189.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0189.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0189.714] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.715] GetFileType (hFile=0x318) returned 0x1
	[0189.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0189.715] GetFileType (hFile=0x318) returned 0x1
	[0189.715] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d6
	[0189.715] ReadFile (in: hFile=0x318, lpBuffer=0x27bd2bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27bd2bc*, lpNumberOfBytesRead=0x540efcc*=0x2d6, lpOverlapped=0x0) returned 1
	[0189.716] CloseHandle (hObject=0x318) returned 1
	[0189.716] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.717] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27be358, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0189.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.717] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0189.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.717] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27be410*=0x1, dwFlags=0x0) returned 1
	[0189.717] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27be3dc, dwFlags=0x0) returned 1
	[0189.717] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27be420*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27be420*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0189.717] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27be70c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27be70c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0189.717] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.717] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0189.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0189.717] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.719] GetFileType (hFile=0x318) returned 0x1
	[0189.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0189.719] GetFileType (hFile=0x318) returned 0x1
	[0189.719] WriteFile (in: hFile=0x318, lpBuffer=0x27be960*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27be960*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.720] CloseHandle (hObject=0x318) returned 1
	[0189.720] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0189.720] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0189.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0189.720] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab69914e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0189.721] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0189.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0189.722] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27bff74 | out: lpFileInformation=0x27bff74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913452f1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913452f1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913452f1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f)) returned 1
	[0189.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0189.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0189.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0189.722] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.723] GetFileType (hFile=0x318) returned 0x1
	[0189.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0189.723] GetFileType (hFile=0x318) returned 0x1
	[0189.723] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34f
	[0189.723] ReadFile (in: hFile=0x318, lpBuffer=0x27c0760, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x27c0760*, lpNumberOfBytesRead=0x540efcc*=0x34f, lpOverlapped=0x0) returned 1
	[0189.732] CloseHandle (hObject=0x318) returned 1
	[0189.732] CryptDestroyKey (hKey=0x82b400) returned 1
	[0189.732] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.732] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c17fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0189.732] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.732] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.733] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0189.733] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.733] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27c18b4*=0x1, dwFlags=0x0) returned 1
	[0189.733] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27c1880, dwFlags=0x0) returned 1
	[0189.733] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c18c4*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x27c18c4*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0189.733] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c1c20*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27c1c20*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0189.733] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.733] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.733] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.733] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0189.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0189.733] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.735] GetFileType (hFile=0x318) returned 0x1
	[0189.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0189.735] GetFileType (hFile=0x318) returned 0x1
	[0189.735] WriteFile (in: hFile=0x318, lpBuffer=0x27c1e74*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27c1e74*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0189.736] CloseHandle (hObject=0x318) returned 1
	[0189.736] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0189.736] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0189.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0189.736] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913452f1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913452f1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab6c4fd0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0189.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0189.737] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.738] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0189.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0189.738] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c3488 | out: lpFileInformation=0x27c3488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913452f1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913452f1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913452f1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7)) returned 1
	[0189.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0189.774] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.877] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.989] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0190.049] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0190.094] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0190.139] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0190.169] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.169] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.170] GetFileType (hFile=0x318) returned 0x1
	[0190.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.170] GetFileType (hFile=0x318) returned 0x1
	[0190.170] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2db
	[0190.170] ReadFile (in: hFile=0x318, lpBuffer=0x261f7b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x261f7b4*, lpNumberOfBytesRead=0x540efcc*=0x2db, lpOverlapped=0x0) returned 1
	[0190.171] CloseHandle (hObject=0x318) returned 1
	[0190.171] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.171] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.171] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2620850, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0190.171] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.171] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.171] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0190.171] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.171] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2620908*=0x1, dwFlags=0x0) returned 1
	[0190.171] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26208d4, dwFlags=0x0) returned 1
	[0190.171] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2620918*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2620918*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0190.171] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2620c04*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2620c04*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.171] CryptDestroyKey (hKey=0x82b440) returned 1
	[0190.172] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.172] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.172] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.172] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.173] GetFileType (hFile=0x318) returned 0x1
	[0190.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.173] GetFileType (hFile=0x318) returned 0x1
	[0190.173] WriteFile (in: hFile=0x318, lpBuffer=0x2620e58*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2620e58*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.174] CloseHandle (hObject=0x318) returned 1
	[0190.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0190.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.174] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabaeb281, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0190.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.174] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.175] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0190.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.175] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2622460 | out: lpFileInformation=0x2622460*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0190.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.175] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0190.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.175] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.176] GetFileType (hFile=0x318) returned 0x1
	[0190.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.176] GetFileType (hFile=0x318) returned 0x1
	[0190.176] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c8
	[0190.176] ReadFile (in: hFile=0x318, lpBuffer=0x2622bb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2622bb4*, lpNumberOfBytesRead=0x540efcc*=0x2c8, lpOverlapped=0x0) returned 1
	[0190.177] CloseHandle (hObject=0x318) returned 1
	[0190.177] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0190.178] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.178] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2623c50, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0190.178] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.178] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.178] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0190.178] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.178] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2623d08*=0x1, dwFlags=0x0) returned 1
	[0190.178] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2623cd4, dwFlags=0x0) returned 1
	[0190.178] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2623d18*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2623d18*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.178] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2623ff4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2623ff4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.178] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.178] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.178] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0190.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.178] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.180] GetFileType (hFile=0x318) returned 0x1
	[0190.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.180] GetFileType (hFile=0x318) returned 0x1
	[0190.180] WriteFile (in: hFile=0x318, lpBuffer=0x2624240*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2624240*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.181] CloseHandle (hObject=0x318) returned 1
	[0190.181] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0190.181] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0190.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.181] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabaeb281, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.181] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.182] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0190.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.183] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2625844 | out: lpFileInformation=0x2625844*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35a)) returned 1
	[0190.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.183] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0190.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.183] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.183] GetFileType (hFile=0x318) returned 0x1
	[0190.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.183] GetFileType (hFile=0x318) returned 0x1
	[0190.183] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x35a
	[0190.183] ReadFile (in: hFile=0x318, lpBuffer=0x262609c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x262609c*, lpNumberOfBytesRead=0x540efcc*=0x35a, lpOverlapped=0x0) returned 1
	[0190.187] CloseHandle (hObject=0x318) returned 1
	[0190.187] CryptDestroyKey (hKey=0x82b340) returned 1
	[0190.187] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.187] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2627138, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b380) returned 1
	[0190.187] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.187] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.187] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0190.187] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.187] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26271f0*=0x1, dwFlags=0x0) returned 1
	[0190.187] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26271bc, dwFlags=0x0) returned 1
	[0190.187] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2627200*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x2627200*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0190.187] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262756c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x262756c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.187] CryptDestroyKey (hKey=0x82b280) returned 1
	[0190.187] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.187] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.188] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0190.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.188] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.189] GetFileType (hFile=0x318) returned 0x1
	[0190.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.189] GetFileType (hFile=0x318) returned 0x1
	[0190.189] WriteFile (in: hFile=0x318, lpBuffer=0x26277f0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26277f0*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0190.189] CloseHandle (hObject=0x318) returned 1
	[0190.190] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0190.190] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd8
	[0190.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.190] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabb11a39, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0190.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.190] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.191] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0190.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.191] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2628e64 | out: lpFileInformation=0x2628e64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9147664e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9147664e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9147664e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e)) returned 1
	[0190.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.192] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0190.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.192] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.192] GetFileType (hFile=0x318) returned 0x1
	[0190.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.192] GetFileType (hFile=0x318) returned 0x1
	[0190.192] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34e
	[0190.192] ReadFile (in: hFile=0x318, lpBuffer=0x26296b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26296b0*, lpNumberOfBytesRead=0x540efcc*=0x34e, lpOverlapped=0x0) returned 1
	[0190.194] CloseHandle (hObject=0x318) returned 1
	[0190.194] CryptDestroyKey (hKey=0x82b380) returned 1
	[0190.194] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.194] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262a74c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0190.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.194] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0190.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.194] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x262a804*=0x1, dwFlags=0x0) returned 1
	[0190.194] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x262a7d0, dwFlags=0x0) returned 1
	[0190.194] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262a814*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x262a814*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0190.194] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262ab70*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x262ab70*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.194] CryptDestroyKey (hKey=0x82b280) returned 1
	[0190.194] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.194] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.194] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0190.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.194] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.196] GetFileType (hFile=0x318) returned 0x1
	[0190.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.196] GetFileType (hFile=0x318) returned 0x1
	[0190.196] WriteFile (in: hFile=0x318, lpBuffer=0x262adf4*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x262adf4*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0190.197] CloseHandle (hObject=0x318) returned 1
	[0190.197] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0190.197] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd8
	[0190.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.197] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9147664e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9147664e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabb11a39, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0190.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.197] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.199] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.199] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x262c468 | out: lpFileInformation=0x262c468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9147664e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9147664e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9147664e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30f)) returned 1
	[0190.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.199] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.199] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.199] GetFileType (hFile=0x318) returned 0x1
	[0190.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.199] GetFileType (hFile=0x318) returned 0x1
	[0190.200] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x30f
	[0190.200] ReadFile (in: hFile=0x318, lpBuffer=0x262cc34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x262cc34*, lpNumberOfBytesRead=0x540efcc*=0x30f, lpOverlapped=0x0) returned 1
	[0190.201] CloseHandle (hObject=0x318) returned 1
	[0190.201] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0190.201] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.201] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262dcd0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0190.201] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.201] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.201] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0190.201] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.202] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x262dd88*=0x1, dwFlags=0x0) returned 1
	[0190.202] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x262dd54, dwFlags=0x0) returned 1
	[0190.202] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262dd98*, pdwDataLen=0x540efd4*=0x310, dwBufLen=0x310 | out: pbData=0x262dd98*, pdwDataLen=0x540efd4*=0x310) returned 1
	[0190.202] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262e0b4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x262e0b4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.202] CryptDestroyKey (hKey=0x82b200) returned 1
	[0190.202] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.202] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.202] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.202] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.203] GetFileType (hFile=0x318) returned 0x1
	[0190.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.203] GetFileType (hFile=0x318) returned 0x1
	[0190.203] WriteFile (in: hFile=0x318, lpBuffer=0x262e318*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x262e318*, lpNumberOfBytesWritten=0x540ef94*=0x310, lpOverlapped=0x0) returned 1
	[0190.204] CloseHandle (hObject=0x318) returned 1
	[0190.204] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.205] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0190.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.205] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9147664e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9147664e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabb377fa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0190.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.205] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.206] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.206] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x262f940 | out: lpFileInformation=0x262f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9147664e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9147664e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9147664e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30b)) returned 1
	[0190.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.206] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.207] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.207] GetFileType (hFile=0x318) returned 0x1
	[0190.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.207] GetFileType (hFile=0x318) returned 0x1
	[0190.207] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x30b
	[0190.207] ReadFile (in: hFile=0x318, lpBuffer=0x2630108, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2630108*, lpNumberOfBytesRead=0x540efcc*=0x30b, lpOverlapped=0x0) returned 1
	[0190.236] CloseHandle (hObject=0x318) returned 1
	[0190.236] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.236] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.236] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26311a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0190.236] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.236] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.236] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0190.236] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.236] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x263125c*=0x1, dwFlags=0x0) returned 1
	[0190.237] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2631228, dwFlags=0x0) returned 1
	[0190.237] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263126c*, pdwDataLen=0x540efd4*=0x310, dwBufLen=0x310 | out: pbData=0x263126c*, pdwDataLen=0x540efd4*=0x310) returned 1
	[0190.237] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2631588*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2631588*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.237] CryptDestroyKey (hKey=0x82b380) returned 1
	[0190.237] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.237] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.237] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.237] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.238] GetFileType (hFile=0x318) returned 0x1
	[0190.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.238] GetFileType (hFile=0x318) returned 0x1
	[0190.238] WriteFile (in: hFile=0x318, lpBuffer=0x26317ec*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26317ec*, lpNumberOfBytesWritten=0x540ef94*=0x310, lpOverlapped=0x0) returned 1
	[0190.239] CloseHandle (hObject=0x318) returned 1
	[0190.239] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.239] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0190.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.239] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9147664e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9147664e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabb83d0f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0190.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.239] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.240] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0190.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.241] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2632e14 | out: lpFileInformation=0x2632e14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902ba650, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.241] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0190.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.241] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.241] GetFileType (hFile=0x318) returned 0x1
	[0190.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.241] GetFileType (hFile=0x318) returned 0x1
	[0190.241] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d0
	[0190.241] ReadFile (in: hFile=0x318, lpBuffer=0x2633580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2633580*, lpNumberOfBytesRead=0x540efcc*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.243] CloseHandle (hObject=0x318) returned 1
	[0190.243] CryptDestroyKey (hKey=0x82b080) returned 1
	[0190.243] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.243] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263461c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0190.243] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.243] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.243] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0190.243] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.243] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26346d4*=0x1, dwFlags=0x0) returned 1
	[0190.243] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26346a0, dwFlags=0x0) returned 1
	[0190.243] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26346e4*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26346e4*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0190.243] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26349d0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26349d0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.243] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.243] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.243] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.243] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0190.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.243] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.244] GetFileType (hFile=0x318) returned 0x1
	[0190.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.244] GetFileType (hFile=0x318) returned 0x1
	[0190.245] WriteFile (in: hFile=0x318, lpBuffer=0x2634c24*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2634c24*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.245] CloseHandle (hObject=0x318) returned 1
	[0190.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0190.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0190.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.246] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabba9ed4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0190.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.246] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.247] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.247] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2636238 | out: lpFileInformation=0x2636238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9149c8b9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x37c)) returned 1
	[0190.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.247] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.247] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.247] GetFileType (hFile=0x318) returned 0x1
	[0190.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.247] GetFileType (hFile=0x318) returned 0x1
	[0190.247] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x37c
	[0190.247] ReadFile (in: hFile=0x318, lpBuffer=0x2636a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2636a70*, lpNumberOfBytesRead=0x540efcc*=0x37c, lpOverlapped=0x0) returned 1
	[0190.249] CloseHandle (hObject=0x318) returned 1
	[0190.249] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0190.249] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.249] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2637b0c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0190.249] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.249] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.249] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0190.249] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.249] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2637bc4*=0x1, dwFlags=0x0) returned 1
	[0190.249] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2637b90, dwFlags=0x0) returned 1
	[0190.249] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2637bd4*, pdwDataLen=0x540efd4*=0x380, dwBufLen=0x380 | out: pbData=0x2637bd4*, pdwDataLen=0x540efd4*=0x380) returned 1
	[0190.249] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2637f60*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2637f60*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.249] CryptDestroyKey (hKey=0x82b440) returned 1
	[0190.249] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.249] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.249] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.249] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.251] GetFileType (hFile=0x318) returned 0x1
	[0190.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.251] GetFileType (hFile=0x318) returned 0x1
	[0190.251] WriteFile (in: hFile=0x318, lpBuffer=0x26381c4*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26381c4*, lpNumberOfBytesWritten=0x540ef94*=0x380, lpOverlapped=0x0) returned 1
	[0190.252] CloseHandle (hObject=0x318) returned 1
	[0190.252] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.252] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0190.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.252] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabba9ed4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0190.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.252] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.253] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.253] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26397ec | out: lpFileInformation=0x26397ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9149c8b9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x37d)) returned 1
	[0190.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.254] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.254] ReadFile (in: hFile=0x318, lpBuffer=0x263a028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x263a028*, lpNumberOfBytesRead=0x540efcc*=0x37d, lpOverlapped=0x0) returned 1
	[0190.255] CryptDestroyKey (hKey=0x82b100) returned 1
	[0190.255] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.255] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263b0c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0190.255] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.255] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.255] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0190.255] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.255] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x263b17c*=0x1, dwFlags=0x0) returned 1
	[0190.255] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x263b148, dwFlags=0x0) returned 1
	[0190.255] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263b18c*, pdwDataLen=0x540efd4*=0x380, dwBufLen=0x380 | out: pbData=0x263b18c*, pdwDataLen=0x540efd4*=0x380) returned 1
	[0190.255] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263b518*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x263b518*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.255] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.255] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.255] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.255] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.256] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.257] GetFileType (hFile=0x318) returned 0x1
	[0190.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.257] GetFileType (hFile=0x318) returned 0x1
	[0190.257] WriteFile (in: hFile=0x318, lpBuffer=0x263b77c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x263b77c*, lpNumberOfBytesWritten=0x540ef94*=0x380, lpOverlapped=0x0) returned 1
	[0190.257] CloseHandle (hObject=0x318) returned 1
	[0190.258] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.258] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0190.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.258] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabba9ed4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0190.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.258] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.259] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.259] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x263cda4 | out: lpFileInformation=0x263cda4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9149c8b9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0190.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.259] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.259] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.259] GetFileType (hFile=0x318) returned 0x1
	[0190.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.259] GetFileType (hFile=0x318) returned 0x1
	[0190.259] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c0
	[0190.259] ReadFile (in: hFile=0x318, lpBuffer=0x263d4e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x263d4e0*, lpNumberOfBytesRead=0x540efcc*=0x2c0, lpOverlapped=0x0) returned 1
	[0190.261] CloseHandle (hObject=0x318) returned 1
	[0190.261] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.261] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.261] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263e57c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0190.261] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.261] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.261] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0190.261] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.261] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x263e634*=0x1, dwFlags=0x0) returned 1
	[0190.261] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x263e600, dwFlags=0x0) returned 1
	[0190.261] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263e644*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x263e644*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.261] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263e920*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x263e920*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.261] CryptDestroyKey (hKey=0x82b100) returned 1
	[0190.261] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.261] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.262] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.263] GetFileType (hFile=0x318) returned 0x1
	[0190.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.263] GetFileType (hFile=0x318) returned 0x1
	[0190.263] WriteFile (in: hFile=0x318, lpBuffer=0x263eb64*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x263eb64*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.263] CloseHandle (hObject=0x318) returned 1
	[0190.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.264] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabbd004e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.264] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0190.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.266] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x264014c | out: lpFileInformation=0x264014c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9149c8b9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3)) returned 1
	[0190.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0190.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.266] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.266] GetFileType (hFile=0x318) returned 0x1
	[0190.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.266] GetFileType (hFile=0x318) returned 0x1
	[0190.267] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1d3
	[0190.267] ReadFile (in: hFile=0x318, lpBuffer=0x264074c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x264074c*, lpNumberOfBytesRead=0x540efcc*=0x1d3, lpOverlapped=0x0) returned 1
	[0190.267] CloseHandle (hObject=0x318) returned 1
	[0190.267] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.268] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.268] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26417e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0190.268] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.268] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.268] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0190.268] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.268] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26418a0*=0x1, dwFlags=0x0) returned 1
	[0190.268] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x264186c, dwFlags=0x0) returned 1
	[0190.268] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26418b0*, pdwDataLen=0x540efd4*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x26418b0*, pdwDataLen=0x540efd4*=0x1e0) returned 1
	[0190.268] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2641a9c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2641a9c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.268] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0190.268] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.268] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.268] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0190.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.268] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.269] GetFileType (hFile=0x318) returned 0x1
	[0190.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.269] GetFileType (hFile=0x318) returned 0x1
	[0190.269] WriteFile (in: hFile=0x318, lpBuffer=0x2641cb8*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2641cb8*, lpNumberOfBytesWritten=0x540ef94*=0x1e0, lpOverlapped=0x0) returned 1
	[0190.270] CloseHandle (hObject=0x318) returned 1
	[0190.270] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0190.270] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0190.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.270] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabbd004e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0190.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.270] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.291] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.291] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x264325c | out: lpFileInformation=0x264325c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0190.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.292] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.292] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.292] GetFileType (hFile=0x318) returned 0x1
	[0190.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.293] GetFileType (hFile=0x318) returned 0x1
	[0190.293] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cc
	[0190.293] ReadFile (in: hFile=0x318, lpBuffer=0x26439a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26439a4*, lpNumberOfBytesRead=0x540efcc*=0x2cc, lpOverlapped=0x0) returned 1
	[0190.294] CloseHandle (hObject=0x318) returned 1
	[0190.294] CryptDestroyKey (hKey=0x82b480) returned 1
	[0190.294] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.294] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2644a40, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0190.294] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.294] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.294] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0190.294] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.294] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2644af8*=0x1, dwFlags=0x0) returned 1
	[0190.295] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2644ac4, dwFlags=0x0) returned 1
	[0190.295] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2644b08*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2644b08*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.295] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2644de4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2644de4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.295] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.295] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.295] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.295] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.296] GetFileType (hFile=0x318) returned 0x1
	[0190.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.296] GetFileType (hFile=0x318) returned 0x1
	[0190.296] WriteFile (in: hFile=0x318, lpBuffer=0x2645028*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2645028*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.297] CloseHandle (hObject=0x318) returned 1
	[0190.297] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.297] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.297] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabc1c52c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.297] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.298] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0190.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.298] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2646610 | out: lpFileInformation=0x2646610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3)) returned 1
	[0190.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.299] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0190.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.299] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.299] GetFileType (hFile=0x318) returned 0x1
	[0190.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.299] GetFileType (hFile=0x318) returned 0x1
	[0190.299] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1d3
	[0190.299] ReadFile (in: hFile=0x318, lpBuffer=0x2646c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2646c10*, lpNumberOfBytesRead=0x540efcc*=0x1d3, lpOverlapped=0x0) returned 1
	[0190.300] CloseHandle (hObject=0x318) returned 1
	[0190.300] CryptDestroyKey (hKey=0x82b280) returned 1
	[0190.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.300] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2647cac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0190.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.300] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0190.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.300] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2647d64*=0x1, dwFlags=0x0) returned 1
	[0190.300] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2647d30, dwFlags=0x0) returned 1
	[0190.300] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2647d74*, pdwDataLen=0x540efd4*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x2647d74*, pdwDataLen=0x540efd4*=0x1e0) returned 1
	[0190.301] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2647f60*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2647f60*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.301] CryptDestroyKey (hKey=0x82b280) returned 1
	[0190.301] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.301] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.301] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0190.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.301] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.302] GetFileType (hFile=0x318) returned 0x1
	[0190.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.302] GetFileType (hFile=0x318) returned 0x1
	[0190.302] WriteFile (in: hFile=0x318, lpBuffer=0x264817c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x264817c*, lpNumberOfBytesWritten=0x540ef94*=0x1e0, lpOverlapped=0x0) returned 1
	[0190.303] CloseHandle (hObject=0x318) returned 1
	[0190.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0190.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0190.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.303] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabc1c52c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0190.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.303] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.305] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.305] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2649720 | out: lpFileInformation=0x2649720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0190.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.305] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.305] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.305] GetFileType (hFile=0x318) returned 0x1
	[0190.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.305] GetFileType (hFile=0x318) returned 0x1
	[0190.305] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cb
	[0190.305] ReadFile (in: hFile=0x318, lpBuffer=0x2649e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2649e68*, lpNumberOfBytesRead=0x540efcc*=0x2cb, lpOverlapped=0x0) returned 1
	[0190.307] CloseHandle (hObject=0x318) returned 1
	[0190.307] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.307] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264af04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0190.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.307] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0190.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.307] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x264afbc*=0x1, dwFlags=0x0) returned 1
	[0190.307] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x264af88, dwFlags=0x0) returned 1
	[0190.307] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264afcc*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x264afcc*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.307] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264b2a8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x264b2a8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.307] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0190.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.307] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.307] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.309] GetFileType (hFile=0x318) returned 0x1
	[0190.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.309] GetFileType (hFile=0x318) returned 0x1
	[0190.309] WriteFile (in: hFile=0x318, lpBuffer=0x264b4ec*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x264b4ec*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.309] CloseHandle (hObject=0x318) returned 1
	[0190.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.310] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabc42768, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.310] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.311] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.311] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x264cad4 | out: lpFileInformation=0x264cad4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7)) returned 1
	[0190.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.311] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.311] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.311] GetFileType (hFile=0x318) returned 0x1
	[0190.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.311] GetFileType (hFile=0x318) returned 0x1
	[0190.311] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c7
	[0190.312] ReadFile (in: hFile=0x318, lpBuffer=0x264d218, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x264d218*, lpNumberOfBytesRead=0x540efcc*=0x2c7, lpOverlapped=0x0) returned 1
	[0190.313] CloseHandle (hObject=0x318) returned 1
	[0190.313] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.313] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.313] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264e2b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0190.313] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.313] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.313] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0190.313] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.313] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x264e36c*=0x1, dwFlags=0x0) returned 1
	[0190.313] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x264e338, dwFlags=0x0) returned 1
	[0190.313] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264e37c*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x264e37c*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.313] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264e658*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x264e658*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.313] CryptDestroyKey (hKey=0x82b280) returned 1
	[0190.313] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.313] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.313] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.314] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.315] GetFileType (hFile=0x318) returned 0x1
	[0190.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.315] GetFileType (hFile=0x318) returned 0x1
	[0190.315] WriteFile (in: hFile=0x318, lpBuffer=0x264e89c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x264e89c*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.316] CloseHandle (hObject=0x318) returned 1
	[0190.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.316] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabc42768, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.317] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.317] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.318] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x264fe84 | out: lpFileInformation=0x264fe84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0190.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.318] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.318] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.318] GetFileType (hFile=0x318) returned 0x1
	[0190.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.318] GetFileType (hFile=0x318) returned 0x1
	[0190.318] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c9
	[0190.318] ReadFile (in: hFile=0x318, lpBuffer=0x26505cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26505cc*, lpNumberOfBytesRead=0x540efcc*=0x2c9, lpOverlapped=0x0) returned 1
	[0190.320] CloseHandle (hObject=0x318) returned 1
	[0190.320] CryptDestroyKey (hKey=0x82b400) returned 1
	[0190.320] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.320] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2651668, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0190.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.320] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0190.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.320] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2651720*=0x1, dwFlags=0x0) returned 1
	[0190.320] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26516ec, dwFlags=0x0) returned 1
	[0190.320] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2651730*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2651730*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.320] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2651a0c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2651a0c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.320] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0190.320] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.320] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.321] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.322] GetFileType (hFile=0x318) returned 0x1
	[0190.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.322] GetFileType (hFile=0x318) returned 0x1
	[0190.322] WriteFile (in: hFile=0x318, lpBuffer=0x2651c50*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2651c50*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.323] CloseHandle (hObject=0x318) returned 1
	[0190.323] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.323] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.324] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabc68a53, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.324] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.325] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.325] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2653238 | out: lpFileInformation=0x2653238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914e8d94, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0190.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.325] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.325] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.326] GetFileType (hFile=0x318) returned 0x1
	[0190.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.326] GetFileType (hFile=0x318) returned 0x1
	[0190.326] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cd
	[0190.326] ReadFile (in: hFile=0x318, lpBuffer=0x2653984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2653984*, lpNumberOfBytesRead=0x540efcc*=0x2cd, lpOverlapped=0x0) returned 1
	[0190.346] CloseHandle (hObject=0x318) returned 1
	[0190.346] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.346] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.346] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2654a20, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0190.346] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.346] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.347] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0190.347] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.347] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2654ad8*=0x1, dwFlags=0x0) returned 1
	[0190.347] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2654aa4, dwFlags=0x0) returned 1
	[0190.347] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2654ae8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2654ae8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.347] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2654dc4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2654dc4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.347] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.347] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.347] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.347] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.347] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.348] GetFileType (hFile=0x318) returned 0x1
	[0190.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.348] GetFileType (hFile=0x318) returned 0x1
	[0190.348] WriteFile (in: hFile=0x318, lpBuffer=0x2655008*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2655008*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.349] CloseHandle (hObject=0x318) returned 1
	[0190.349] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.349] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.349] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabc8ed5a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.350] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.351] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0190.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.351] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26565f0 | out: lpFileInformation=0x26565f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902ba650, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1
	[0190.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.351] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0190.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.351] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.351] GetFileType (hFile=0x318) returned 0x1
	[0190.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.351] GetFileType (hFile=0x318) returned 0x1
	[0190.351] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x340
	[0190.351] ReadFile (in: hFile=0x318, lpBuffer=0x2656d9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2656d9c*, lpNumberOfBytesRead=0x540efcc*=0x340, lpOverlapped=0x0) returned 1
	[0190.358] CloseHandle (hObject=0x318) returned 1
	[0190.358] CryptDestroyKey (hKey=0x82b100) returned 1
	[0190.358] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.358] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2657e38, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0190.358] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.358] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.358] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0190.359] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.359] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2657ef0*=0x1, dwFlags=0x0) returned 1
	[0190.359] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2657ebc, dwFlags=0x0) returned 1
	[0190.359] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2657f00*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x2657f00*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0190.359] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265825c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x265825c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.359] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0190.359] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.359] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.359] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0190.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.359] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.360] GetFileType (hFile=0x318) returned 0x1
	[0190.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.360] GetFileType (hFile=0x318) returned 0x1
	[0190.360] WriteFile (in: hFile=0x318, lpBuffer=0x2658498*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2658498*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0190.361] CloseHandle (hObject=0x318) returned 1
	[0190.361] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0190.361] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc6
	[0190.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.361] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabcbccc4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0190.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.362] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.362] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.363] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2659a7c | out: lpFileInformation=0x2659a7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914e8d94, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0190.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.363] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.363] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.363] GetFileType (hFile=0x318) returned 0x1
	[0190.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.363] GetFileType (hFile=0x318) returned 0x1
	[0190.363] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cc
	[0190.363] ReadFile (in: hFile=0x318, lpBuffer=0x265a1c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x265a1c4*, lpNumberOfBytesRead=0x540efcc*=0x2cc, lpOverlapped=0x0) returned 1
	[0190.365] CloseHandle (hObject=0x318) returned 1
	[0190.365] CryptDestroyKey (hKey=0x82b280) returned 1
	[0190.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.365] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265b260, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0190.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.365] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b200) returned 1
	[0190.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.365] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x265b318*=0x1, dwFlags=0x0) returned 1
	[0190.365] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x265b2e4, dwFlags=0x0) returned 1
	[0190.365] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265b328*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x265b328*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.365] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265b604*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x265b604*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.365] CryptDestroyKey (hKey=0x82b200) returned 1
	[0190.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.365] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.366] GetFileType (hFile=0x318) returned 0x1
	[0190.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.367] GetFileType (hFile=0x318) returned 0x1
	[0190.367] WriteFile (in: hFile=0x318, lpBuffer=0x265b848*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x265b848*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.367] CloseHandle (hObject=0x318) returned 1
	[0190.368] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.368] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.368] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabcbccc4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.368] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.369] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x265ce30 | out: lpFileInformation=0x265ce30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914e8d94, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6)) returned 1
	[0190.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.369] ReadFile (in: hFile=0x318, lpBuffer=0x265d574, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x265d574*, lpNumberOfBytesRead=0x540efcc*=0x2c6, lpOverlapped=0x0) returned 1
	[0190.371] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.371] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.371] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265e610, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b400) returned 1
	[0190.371] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.371] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.371] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0190.371] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.371] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x265e6c8*=0x1, dwFlags=0x0) returned 1
	[0190.371] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x265e694, dwFlags=0x0) returned 1
	[0190.371] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265e6d8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x265e6d8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.371] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265e9b4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x265e9b4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.371] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.371] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.371] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.371] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.371] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.373] GetFileType (hFile=0x318) returned 0x1
	[0190.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.373] GetFileType (hFile=0x318) returned 0x1
	[0190.373] WriteFile (in: hFile=0x318, lpBuffer=0x265ebf8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x265ebf8*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.374] CloseHandle (hObject=0x318) returned 1
	[0190.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.374] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabcdb1b3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.374] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.375] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.375] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26601e0 | out: lpFileInformation=0x26601e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914e8d94, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0190.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.375] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.375] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.375] GetFileType (hFile=0x318) returned 0x1
	[0190.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.375] GetFileType (hFile=0x318) returned 0x1
	[0190.376] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2ca
	[0190.376] ReadFile (in: hFile=0x318, lpBuffer=0x2660928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2660928*, lpNumberOfBytesRead=0x540efcc*=0x2ca, lpOverlapped=0x0) returned 1
	[0190.377] CloseHandle (hObject=0x318) returned 1
	[0190.377] CryptDestroyKey (hKey=0x82b400) returned 1
	[0190.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.377] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26619c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0190.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.377] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0190.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.377] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2661a7c*=0x1, dwFlags=0x0) returned 1
	[0190.377] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2661a48, dwFlags=0x0) returned 1
	[0190.377] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2661a8c*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2661a8c*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.377] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2661d68*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2661d68*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.377] CryptDestroyKey (hKey=0x82b300) returned 1
	[0190.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.377] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.378] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.379] GetFileType (hFile=0x318) returned 0x1
	[0190.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.379] GetFileType (hFile=0x318) returned 0x1
	[0190.379] WriteFile (in: hFile=0x318, lpBuffer=0x2661fac*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2661fac*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.399] CloseHandle (hObject=0x318) returned 1
	[0190.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.399] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabd013d3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.400] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.401] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.401] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2663594 | out: lpFileInformation=0x2663594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9150effc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0190.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.401] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.401] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.402] GetFileType (hFile=0x318) returned 0x1
	[0190.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.402] GetFileType (hFile=0x318) returned 0x1
	[0190.402] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cb
	[0190.402] ReadFile (in: hFile=0x318, lpBuffer=0x2663cdc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2663cdc*, lpNumberOfBytesRead=0x540efcc*=0x2cb, lpOverlapped=0x0) returned 1
	[0190.403] CloseHandle (hObject=0x318) returned 1
	[0190.403] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0190.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.403] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2664d78, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0190.403] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.403] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.403] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0190.403] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.403] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2664e30*=0x1, dwFlags=0x0) returned 1
	[0190.403] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2664dfc, dwFlags=0x0) returned 1
	[0190.403] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2664e40*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2664e40*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.403] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266511c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x266511c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.403] CryptDestroyKey (hKey=0x82b280) returned 1
	[0190.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.403] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.404] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.405] GetFileType (hFile=0x318) returned 0x1
	[0190.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.405] GetFileType (hFile=0x318) returned 0x1
	[0190.405] WriteFile (in: hFile=0x318, lpBuffer=0x2665360*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2665360*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.405] CloseHandle (hObject=0x318) returned 1
	[0190.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.406] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabd27751, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.406] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.407] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2666948 | out: lpFileInformation=0x2666948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9150effc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0190.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.407] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.407] GetFileType (hFile=0x318) returned 0x1
	[0190.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.407] GetFileType (hFile=0x318) returned 0x1
	[0190.407] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c9
	[0190.407] ReadFile (in: hFile=0x318, lpBuffer=0x2667090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2667090*, lpNumberOfBytesRead=0x540efcc*=0x2c9, lpOverlapped=0x0) returned 1
	[0190.409] CloseHandle (hObject=0x318) returned 1
	[0190.409] CryptDestroyKey (hKey=0x82b100) returned 1
	[0190.409] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.409] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266812c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0190.409] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.409] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.409] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0190.409] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.409] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x26681e4*=0x1, dwFlags=0x0) returned 1
	[0190.409] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x26681b0, dwFlags=0x0) returned 1
	[0190.409] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26681f4*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26681f4*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.409] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26684d0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26684d0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.409] CryptDestroyKey (hKey=0x82b000) returned 1
	[0190.409] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.409] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.409] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.409] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.410] GetFileType (hFile=0x318) returned 0x1
	[0190.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.410] GetFileType (hFile=0x318) returned 0x1
	[0190.410] WriteFile (in: hFile=0x318, lpBuffer=0x2668714*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2668714*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.411] CloseHandle (hObject=0x318) returned 1
	[0190.411] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.411] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.411] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabd27751, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.412] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.413] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.413] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2669cfc | out: lpFileInformation=0x2669cfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9150effc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0190.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.414] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.414] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.414] GetFileType (hFile=0x318) returned 0x1
	[0190.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.414] GetFileType (hFile=0x318) returned 0x1
	[0190.414] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2ca
	[0190.414] ReadFile (in: hFile=0x318, lpBuffer=0x266a444, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x266a444*, lpNumberOfBytesRead=0x540efcc*=0x2ca, lpOverlapped=0x0) returned 1
	[0190.416] CloseHandle (hObject=0x318) returned 1
	[0190.416] CryptDestroyKey (hKey=0x82b480) returned 1
	[0190.416] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.416] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266b4e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0190.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.416] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0190.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.416] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x266b598*=0x1, dwFlags=0x0) returned 1
	[0190.416] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x266b564, dwFlags=0x0) returned 1
	[0190.416] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266b5a8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x266b5a8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.416] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266b884*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x266b884*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.416] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0190.416] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.417] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.417] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.417] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.418] GetFileType (hFile=0x318) returned 0x1
	[0190.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.418] GetFileType (hFile=0x318) returned 0x1
	[0190.418] WriteFile (in: hFile=0x318, lpBuffer=0x266bac8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x266bac8*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.419] CloseHandle (hObject=0x318) returned 1
	[0190.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.419] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabd4d8d4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.419] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.420] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x266d0b0 | out: lpFileInformation=0x266d0b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9150effc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0190.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.420] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.421] GetFileType (hFile=0x318) returned 0x1
	[0190.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.421] GetFileType (hFile=0x318) returned 0x1
	[0190.421] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cf
	[0190.421] ReadFile (in: hFile=0x318, lpBuffer=0x266d7fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x266d7fc*, lpNumberOfBytesRead=0x540efcc*=0x2cf, lpOverlapped=0x0) returned 1
	[0190.422] CloseHandle (hObject=0x318) returned 1
	[0190.422] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0190.422] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.422] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266e898, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0190.422] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.422] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.422] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b000) returned 1
	[0190.422] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.422] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x266e950*=0x1, dwFlags=0x0) returned 1
	[0190.422] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x266e91c, dwFlags=0x0) returned 1
	[0190.422] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266e960*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x266e960*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.422] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266ec3c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x266ec3c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.423] CryptDestroyKey (hKey=0x82b000) returned 1
	[0190.423] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.423] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.423] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.424] GetFileType (hFile=0x318) returned 0x1
	[0190.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.424] GetFileType (hFile=0x318) returned 0x1
	[0190.424] WriteFile (in: hFile=0x318, lpBuffer=0x266ee80*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x266ee80*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.425] CloseHandle (hObject=0x318) returned 1
	[0190.425] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.425] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.425] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabd4d8d4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.425] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.426] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.426] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2670468 | out: lpFileInformation=0x2670468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91535267, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0190.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.427] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.427] GetFileType (hFile=0x318) returned 0x1
	[0190.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.427] GetFileType (hFile=0x318) returned 0x1
	[0190.427] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cb
	[0190.427] ReadFile (in: hFile=0x318, lpBuffer=0x2670bb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2670bb0*, lpNumberOfBytesRead=0x540efcc*=0x2cb, lpOverlapped=0x0) returned 1
	[0190.429] CloseHandle (hObject=0x318) returned 1
	[0190.429] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0190.429] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.429] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2671c4c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0190.429] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.429] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.429] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0190.429] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.429] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2671d04*=0x1, dwFlags=0x0) returned 1
	[0190.429] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2671cd0, dwFlags=0x0) returned 1
	[0190.429] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2671d14*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2671d14*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.429] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2671ff0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2671ff0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.429] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.429] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.429] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.429] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.431] GetFileType (hFile=0x318) returned 0x1
	[0190.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.431] GetFileType (hFile=0x318) returned 0x1
	[0190.431] WriteFile (in: hFile=0x318, lpBuffer=0x2672234*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2672234*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.432] CloseHandle (hObject=0x318) returned 1
	[0190.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.433] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabd4d8d4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.433] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.434] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x267381c | out: lpFileInformation=0x267381c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91535267, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0190.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.434] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.435] GetFileType (hFile=0x318) returned 0x1
	[0190.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.435] GetFileType (hFile=0x318) returned 0x1
	[0190.435] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2ca
	[0190.435] ReadFile (in: hFile=0x318, lpBuffer=0x2673f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2673f64*, lpNumberOfBytesRead=0x540efcc*=0x2ca, lpOverlapped=0x0) returned 1
	[0190.464] CloseHandle (hObject=0x318) returned 1
	[0190.464] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0190.464] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.464] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2675000, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0190.464] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.465] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.465] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b0c0) returned 1
	[0190.465] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.465] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26750b8*=0x1, dwFlags=0x0) returned 1
	[0190.465] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x2675084, dwFlags=0x0) returned 1
	[0190.465] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26750c8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26750c8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.465] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26753a4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26753a4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.465] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0190.465] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.465] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.465] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.467] GetFileType (hFile=0x318) returned 0x1
	[0190.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.467] GetFileType (hFile=0x318) returned 0x1
	[0190.467] WriteFile (in: hFile=0x318, lpBuffer=0x26755e8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26755e8*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.468] CloseHandle (hObject=0x318) returned 1
	[0190.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.468] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabdc0060, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.468] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.470] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.470] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2676bd0 | out: lpFileInformation=0x2676bd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91535267, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0190.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.470] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.470] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.470] GetFileType (hFile=0x318) returned 0x1
	[0190.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.471] GetFileType (hFile=0x318) returned 0x1
	[0190.471] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c8
	[0190.471] ReadFile (in: hFile=0x318, lpBuffer=0x2677314, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2677314*, lpNumberOfBytesRead=0x540efcc*=0x2c8, lpOverlapped=0x0) returned 1
	[0190.472] CloseHandle (hObject=0x318) returned 1
	[0190.472] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.472] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.472] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26783b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0190.473] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.473] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.473] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0190.473] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.473] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2678468*=0x1, dwFlags=0x0) returned 1
	[0190.473] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2678434, dwFlags=0x0) returned 1
	[0190.473] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2678478*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2678478*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.473] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2678754*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2678754*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.473] CryptDestroyKey (hKey=0x82b100) returned 1
	[0190.473] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.473] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.473] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.475] GetFileType (hFile=0x318) returned 0x1
	[0190.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.475] GetFileType (hFile=0x318) returned 0x1
	[0190.475] WriteFile (in: hFile=0x318, lpBuffer=0x2678998*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2678998*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.476] CloseHandle (hObject=0x318) returned 1
	[0190.476] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.476] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.476] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabdc0060, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.476] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.477] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.477] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2679f80 | out: lpFileInformation=0x2679f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902e08bf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x33f)) returned 1
	[0190.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.478] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.478] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.478] GetFileType (hFile=0x318) returned 0x1
	[0190.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.478] GetFileType (hFile=0x318) returned 0x1
	[0190.478] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x33f
	[0190.478] ReadFile (in: hFile=0x318, lpBuffer=0x267a73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x267a73c*, lpNumberOfBytesRead=0x540efcc*=0x33f, lpOverlapped=0x0) returned 1
	[0190.480] CloseHandle (hObject=0x318) returned 1
	[0190.480] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0190.480] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.480] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267b7d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0190.480] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.480] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.480] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0190.480] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.480] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x267b890*=0x1, dwFlags=0x0) returned 1
	[0190.480] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x267b85c, dwFlags=0x0) returned 1
	[0190.480] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267b8a0*, pdwDataLen=0x540efd4*=0x340, dwBufLen=0x340 | out: pbData=0x267b8a0*, pdwDataLen=0x540efd4*=0x340) returned 1
	[0190.481] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267bbec*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x267bbec*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.481] CryptDestroyKey (hKey=0x82b300) returned 1
	[0190.481] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.481] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.481] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.482] GetFileType (hFile=0x318) returned 0x1
	[0190.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.482] GetFileType (hFile=0x318) returned 0x1
	[0190.482] WriteFile (in: hFile=0x318, lpBuffer=0x267be30*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x267be30*, lpNumberOfBytesWritten=0x540ef94*=0x340, lpOverlapped=0x0) returned 1
	[0190.483] CloseHandle (hObject=0x318) returned 1
	[0190.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.483] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabde61ec, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1
	[0190.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.484] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.485] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.485] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x267d418 | out: lpFileInformation=0x267d418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91535267, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc)) returned 1
	[0190.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.485] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.485] ReadFile (in: hFile=0x318, lpBuffer=0x267db50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x267db50*, lpNumberOfBytesRead=0x540efcc*=0x2bc, lpOverlapped=0x0) returned 1
	[0190.487] CryptDestroyKey (hKey=0x82b540) returned 1
	[0190.487] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.487] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267ebec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0190.487] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.487] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.487] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0190.487] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.487] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x267eca4*=0x1, dwFlags=0x0) returned 1
	[0190.487] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x267ec70, dwFlags=0x0) returned 1
	[0190.487] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267ecb4*, pdwDataLen=0x540efd4*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x267ecb4*, pdwDataLen=0x540efd4*=0x2c0) returned 1
	[0190.488] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267ef80*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x267ef80*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.488] CryptDestroyKey (hKey=0x82b380) returned 1
	[0190.488] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.488] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.488] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.488] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.489] GetFileType (hFile=0x318) returned 0x1
	[0190.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.489] GetFileType (hFile=0x318) returned 0x1
	[0190.489] WriteFile (in: hFile=0x318, lpBuffer=0x267f1c4*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x267f1c4*, lpNumberOfBytesWritten=0x540ef94*=0x2c0, lpOverlapped=0x0) returned 1
	[0190.490] CloseHandle (hObject=0x318) returned 1
	[0190.490] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.490] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.491] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabde61ec, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0190.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.491] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.492] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.492] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26807ac | out: lpFileInformation=0x26807ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9155b4d3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9155b4d3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9155b4d3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0190.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.492] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.493] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.493] GetFileType (hFile=0x318) returned 0x1
	[0190.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.493] GetFileType (hFile=0x318) returned 0x1
	[0190.493] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c0
	[0190.493] ReadFile (in: hFile=0x318, lpBuffer=0x2680ee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2680ee8*, lpNumberOfBytesRead=0x540efcc*=0x2c0, lpOverlapped=0x0) returned 1
	[0190.494] CloseHandle (hObject=0x318) returned 1
	[0190.494] CryptDestroyKey (hKey=0x82b080) returned 1
	[0190.495] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.495] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2681f84, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0190.495] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.495] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.495] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0190.495] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.495] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x268203c*=0x1, dwFlags=0x0) returned 1
	[0190.495] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2682008, dwFlags=0x0) returned 1
	[0190.495] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268204c*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x268204c*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.495] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2682328*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2682328*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.495] CryptDestroyKey (hKey=0x82b480) returned 1
	[0190.495] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.495] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.495] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.496] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.497] GetFileType (hFile=0x318) returned 0x1
	[0190.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.497] GetFileType (hFile=0x318) returned 0x1
	[0190.497] WriteFile (in: hFile=0x318, lpBuffer=0x268256c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x268256c*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.498] CloseHandle (hObject=0x318) returned 1
	[0190.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.498] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9155b4d3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9155b4d3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabe0c46e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.498] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.499] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.500] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2683b54 | out: lpFileInformation=0x2683b54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9155b4d3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9155b4d3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9155b4d3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0190.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.500] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.500] GetFileType (hFile=0x318) returned 0x1
	[0190.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.500] GetFileType (hFile=0x318) returned 0x1
	[0190.500] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c3
	[0190.500] ReadFile (in: hFile=0x318, lpBuffer=0x2684294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2684294*, lpNumberOfBytesRead=0x540efcc*=0x2c3, lpOverlapped=0x0) returned 1
	[0190.520] CloseHandle (hObject=0x318) returned 1
	[0190.520] CryptDestroyKey (hKey=0x82b080) returned 1
	[0190.520] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.520] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2685330, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0190.520] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.520] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.520] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0190.521] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.521] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26853e8*=0x1, dwFlags=0x0) returned 1
	[0190.521] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26853b4, dwFlags=0x0) returned 1
	[0190.521] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26853f8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26853f8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.521] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26856d4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26856d4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.521] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.521] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.521] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.521] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.522] GetFileType (hFile=0x318) returned 0x1
	[0190.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.522] GetFileType (hFile=0x318) returned 0x1
	[0190.522] WriteFile (in: hFile=0x318, lpBuffer=0x2685918*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2685918*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.523] CloseHandle (hObject=0x318) returned 1
	[0190.523] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.523] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.523] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9155b4d3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9155b4d3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabe36530, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.523] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.525] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2686f00 | out: lpFileInformation=0x2686f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9155b4d3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9155b4d3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9155b4d3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2)) returned 1
	[0190.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.525] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.525] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.525] GetFileType (hFile=0x318) returned 0x1
	[0190.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.525] GetFileType (hFile=0x318) returned 0x1
	[0190.525] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c2
	[0190.525] ReadFile (in: hFile=0x318, lpBuffer=0x2687640, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2687640*, lpNumberOfBytesRead=0x540efcc*=0x2c2, lpOverlapped=0x0) returned 1
	[0190.527] CloseHandle (hObject=0x318) returned 1
	[0190.527] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0190.527] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.527] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26886dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0190.527] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.527] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.527] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0190.527] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.527] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2688794*=0x1, dwFlags=0x0) returned 1
	[0190.527] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2688760, dwFlags=0x0) returned 1
	[0190.527] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26887a4*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26887a4*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.527] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2688a80*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2688a80*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.527] CryptDestroyKey (hKey=0x82b440) returned 1
	[0190.527] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.527] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.527] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.527] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.529] GetFileType (hFile=0x318) returned 0x1
	[0190.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.529] GetFileType (hFile=0x318) returned 0x1
	[0190.529] WriteFile (in: hFile=0x318, lpBuffer=0x2688cc4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2688cc4*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.530] CloseHandle (hObject=0x318) returned 1
	[0190.530] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.530] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.530] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9155b4d3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9155b4d3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabe58960, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.530] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.531] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.531] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x268a2ac | out: lpFileInformation=0x268a2ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91581742, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0190.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.532] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.532] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.532] GetFileType (hFile=0x318) returned 0x1
	[0190.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.532] GetFileType (hFile=0x318) returned 0x1
	[0190.532] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c3
	[0190.532] ReadFile (in: hFile=0x318, lpBuffer=0x268a9ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x268a9ec*, lpNumberOfBytesRead=0x540efcc*=0x2c3, lpOverlapped=0x0) returned 1
	[0190.533] CloseHandle (hObject=0x318) returned 1
	[0190.533] CryptDestroyKey (hKey=0x82b100) returned 1
	[0190.533] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.534] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268ba88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b480) returned 1
	[0190.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.534] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b5c0) returned 1
	[0190.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.534] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x268bb40*=0x1, dwFlags=0x0) returned 1
	[0190.534] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x268bb0c, dwFlags=0x0) returned 1
	[0190.534] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268bb50*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x268bb50*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.534] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268be2c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x268be2c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.534] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0190.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.534] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.534] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.536] GetFileType (hFile=0x318) returned 0x1
	[0190.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.536] GetFileType (hFile=0x318) returned 0x1
	[0190.536] WriteFile (in: hFile=0x318, lpBuffer=0x268c070*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x268c070*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.537] CloseHandle (hObject=0x318) returned 1
	[0190.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.537] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabe58960, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.537] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.538] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.538] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x268d658 | out: lpFileInformation=0x268d658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91581742, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0190.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.539] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.539] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.539] GetFileType (hFile=0x318) returned 0x1
	[0190.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.539] GetFileType (hFile=0x318) returned 0x1
	[0190.539] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cd
	[0190.539] ReadFile (in: hFile=0x318, lpBuffer=0x268dda4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x268dda4*, lpNumberOfBytesRead=0x540efcc*=0x2cd, lpOverlapped=0x0) returned 1
	[0190.540] CloseHandle (hObject=0x318) returned 1
	[0190.540] CryptDestroyKey (hKey=0x82b480) returned 1
	[0190.540] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.541] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268ee40, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0190.541] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.541] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.541] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0190.541] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.541] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x268eef8*=0x1, dwFlags=0x0) returned 1
	[0190.541] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x268eec4, dwFlags=0x0) returned 1
	[0190.541] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268ef08*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x268ef08*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.541] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268f1e4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x268f1e4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.541] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.541] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.541] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.541] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.541] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.542] GetFileType (hFile=0x318) returned 0x1
	[0190.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.543] GetFileType (hFile=0x318) returned 0x1
	[0190.543] WriteFile (in: hFile=0x318, lpBuffer=0x268f428*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x268f428*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.544] CloseHandle (hObject=0x318) returned 1
	[0190.544] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.544] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.544] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabe7eb2c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.544] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.545] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.545] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2690a10 | out: lpFileInformation=0x2690a10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91581742, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5)) returned 1
	[0190.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.546] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.546] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.546] GetFileType (hFile=0x318) returned 0x1
	[0190.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.546] GetFileType (hFile=0x318) returned 0x1
	[0190.546] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c5
	[0190.547] ReadFile (in: hFile=0x318, lpBuffer=0x2691154, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2691154*, lpNumberOfBytesRead=0x540efcc*=0x2c5, lpOverlapped=0x0) returned 1
	[0190.548] CloseHandle (hObject=0x318) returned 1
	[0190.548] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0190.548] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.548] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26921f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0190.548] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.548] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.548] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0190.548] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.548] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26922a8*=0x1, dwFlags=0x0) returned 1
	[0190.548] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2692274, dwFlags=0x0) returned 1
	[0190.548] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26922b8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26922b8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.548] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2692594*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2692594*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.548] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0190.548] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.548] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.548] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.549] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.550] GetFileType (hFile=0x318) returned 0x1
	[0190.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.550] GetFileType (hFile=0x318) returned 0x1
	[0190.550] WriteFile (in: hFile=0x318, lpBuffer=0x26927d8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26927d8*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.551] CloseHandle (hObject=0x318) returned 1
	[0190.551] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.551] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.551] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabe7eb2c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.551] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.555] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.555] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2693dc0 | out: lpFileInformation=0x2693dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91581742, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7)) returned 1
	[0190.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.555] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.555] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.555] GetFileType (hFile=0x318) returned 0x1
	[0190.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.555] GetFileType (hFile=0x318) returned 0x1
	[0190.555] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c7
	[0190.556] ReadFile (in: hFile=0x318, lpBuffer=0x2694504, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2694504*, lpNumberOfBytesRead=0x540efcc*=0x2c7, lpOverlapped=0x0) returned 1
	[0190.577] CloseHandle (hObject=0x318) returned 1
	[0190.577] CryptDestroyKey (hKey=0x82b100) returned 1
	[0190.577] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.577] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26955a0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0190.577] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.577] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.577] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0190.578] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.578] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2695658*=0x1, dwFlags=0x0) returned 1
	[0190.578] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2695624, dwFlags=0x0) returned 1
	[0190.578] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2695668*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2695668*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.578] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2695944*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2695944*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.578] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.578] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.578] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.578] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.578] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.579] GetFileType (hFile=0x318) returned 0x1
	[0190.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.579] GetFileType (hFile=0x318) returned 0x1
	[0190.580] WriteFile (in: hFile=0x318, lpBuffer=0x2695b88*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2695b88*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.580] CloseHandle (hObject=0x318) returned 1
	[0190.581] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.581] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.581] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabecb0c4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.581] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.582] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.582] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2697170 | out: lpFileInformation=0x2697170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915a79aa, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.583] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.583] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.583] GetFileType (hFile=0x318) returned 0x1
	[0190.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.583] GetFileType (hFile=0x318) returned 0x1
	[0190.583] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d0
	[0190.583] ReadFile (in: hFile=0x318, lpBuffer=0x26978bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26978bc*, lpNumberOfBytesRead=0x540efcc*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.584] CloseHandle (hObject=0x318) returned 1
	[0190.584] CryptDestroyKey (hKey=0x82b440) returned 1
	[0190.584] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.584] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2698958, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0190.584] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.585] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.585] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0190.585] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.585] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2698a10*=0x1, dwFlags=0x0) returned 1
	[0190.585] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26989dc, dwFlags=0x0) returned 1
	[0190.585] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2698a20*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2698a20*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0190.585] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2698d0c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2698d0c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.585] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.585] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.585] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.585] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.586] WriteFile (in: hFile=0x318, lpBuffer=0x2698f50*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2698f50*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.587] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.589] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.589] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.589] GetFileType (hFile=0x318) returned 0x1
	[0190.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.589] GetFileType (hFile=0x318) returned 0x1
	[0190.589] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c6
	[0190.589] ReadFile (in: hFile=0x318, lpBuffer=0x269ac7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x269ac7c*, lpNumberOfBytesRead=0x540efcc*=0x2c6, lpOverlapped=0x0) returned 1
	[0190.590] CloseHandle (hObject=0x318) returned 1
	[0190.590] CryptDestroyKey (hKey=0x82b080) returned 1
	[0190.590] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.590] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269bd18, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0190.591] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.591] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.591] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b340) returned 1
	[0190.591] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.591] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x269bdd0*=0x1, dwFlags=0x0) returned 1
	[0190.591] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x269bd9c, dwFlags=0x0) returned 1
	[0190.591] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269bde0*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x269bde0*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.591] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269c0bc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x269c0bc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.591] CryptDestroyKey (hKey=0x82b340) returned 1
	[0190.591] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.591] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.591] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.592] GetFileType (hFile=0x318) returned 0x1
	[0190.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.592] GetFileType (hFile=0x318) returned 0x1
	[0190.592] WriteFile (in: hFile=0x318, lpBuffer=0x269c300*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x269c300*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.593] CloseHandle (hObject=0x318) returned 1
	[0190.593] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.593] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.593] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabef12ff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.594] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.595] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaf
	[0190.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.595] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x269d8e8 | out: lpFileInformation=0x269d8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902e08bf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0190.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.595] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaf
	[0190.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.596] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.596] GetFileType (hFile=0x318) returned 0x1
	[0190.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.596] GetFileType (hFile=0x318) returned 0x1
	[0190.596] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2a0
	[0190.596] ReadFile (in: hFile=0x318, lpBuffer=0x269e0b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x269e0b4*, lpNumberOfBytesRead=0x540efcc*=0x2a0, lpOverlapped=0x0) returned 1
	[0190.597] CloseHandle (hObject=0x318) returned 1
	[0190.598] CryptDestroyKey (hKey=0x82b100) returned 1
	[0190.598] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.598] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269f150, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0190.598] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.598] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.598] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0190.598] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.598] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x269f208*=0x1, dwFlags=0x0) returned 1
	[0190.598] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x269f1d4, dwFlags=0x0) returned 1
	[0190.598] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269f218*, pdwDataLen=0x540efd4*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x269f218*, pdwDataLen=0x540efd4*=0x2b0) returned 1
	[0190.598] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269f4d4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x269f4d4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.598] CryptDestroyKey (hKey=0x82b400) returned 1
	[0190.598] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.598] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.598] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaf
	[0190.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.598] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.599] GetFileType (hFile=0x318) returned 0x1
	[0190.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.599] GetFileType (hFile=0x318) returned 0x1
	[0190.599] WriteFile (in: hFile=0x318, lpBuffer=0x269f770*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x269f770*, lpNumberOfBytesWritten=0x540ef94*=0x2b0, lpOverlapped=0x0) returned 1
	[0190.600] CloseHandle (hObject=0x318) returned 1
	[0190.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaf
	[0190.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xde
	[0190.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.601] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabef12ff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2b0)) returned 1
	[0190.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.601] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0190.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.602] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26a0e14 | out: lpFileInformation=0x26a0e14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900f0949, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9)) returned 1
	[0190.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.602] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0190.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.602] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.602] GetFileType (hFile=0x318) returned 0x1
	[0190.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.602] GetFileType (hFile=0x318) returned 0x1
	[0190.602] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d9
	[0190.602] ReadFile (in: hFile=0x318, lpBuffer=0x26a15ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a15ec*, lpNumberOfBytesRead=0x540efcc*=0x2d9, lpOverlapped=0x0) returned 1
	[0190.604] CloseHandle (hObject=0x318) returned 1
	[0190.604] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.604] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a2688, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0190.604] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.604] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.604] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b280) returned 1
	[0190.604] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.604] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26a2740*=0x1, dwFlags=0x0) returned 1
	[0190.604] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26a270c, dwFlags=0x0) returned 1
	[0190.604] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a2750*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26a2750*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0190.604] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a2a3c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a2a3c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.604] CryptDestroyKey (hKey=0x82b280) returned 1
	[0190.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.604] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0190.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.604] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.606] GetFileType (hFile=0x318) returned 0x1
	[0190.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.606] GetFileType (hFile=0x318) returned 0x1
	[0190.606] WriteFile (in: hFile=0x318, lpBuffer=0x26a2cc0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26a2cc0*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.607] CloseHandle (hObject=0x318) returned 1
	[0190.607] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0190.607] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd8
	[0190.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.607] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabf1742a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0190.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.607] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.608] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.608] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26a4334 | out: lpFileInformation=0x26a4334*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915a79aa, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2)) returned 1
	[0190.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.608] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.609] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.609] GetFileType (hFile=0x318) returned 0x1
	[0190.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.609] GetFileType (hFile=0x318) returned 0x1
	[0190.609] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c2
	[0190.609] ReadFile (in: hFile=0x318, lpBuffer=0x26a4a74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a4a74*, lpNumberOfBytesRead=0x540efcc*=0x2c2, lpOverlapped=0x0) returned 1
	[0190.620] CloseHandle (hObject=0x318) returned 1
	[0190.620] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.620] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.620] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a5b10, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0190.620] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.620] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.620] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0190.620] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.620] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26a5bc8*=0x1, dwFlags=0x0) returned 1
	[0190.621] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26a5b94, dwFlags=0x0) returned 1
	[0190.621] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a5bd8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26a5bd8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.621] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a5eb4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a5eb4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.621] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0190.621] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.621] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.621] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.621] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.622] GetFileType (hFile=0x318) returned 0x1
	[0190.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.622] GetFileType (hFile=0x318) returned 0x1
	[0190.622] WriteFile (in: hFile=0x318, lpBuffer=0x26a60f8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26a60f8*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.623] CloseHandle (hObject=0x318) returned 1
	[0190.623] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.623] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.623] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabf3d6cc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.624] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.625] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.625] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26a76e0 | out: lpFileInformation=0x26a76e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915a79aa, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0190.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.625] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.625] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.625] GetFileType (hFile=0x318) returned 0x1
	[0190.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.625] GetFileType (hFile=0x318) returned 0x1
	[0190.625] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c0
	[0190.625] ReadFile (in: hFile=0x318, lpBuffer=0x26a7e1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26a7e1c*, lpNumberOfBytesRead=0x540efcc*=0x2c0, lpOverlapped=0x0) returned 1
	[0190.627] CloseHandle (hObject=0x318) returned 1
	[0190.627] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.627] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.627] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a8eb8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0190.627] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.627] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.627] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0190.627] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.627] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26a8f70*=0x1, dwFlags=0x0) returned 1
	[0190.627] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26a8f3c, dwFlags=0x0) returned 1
	[0190.627] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a8f80*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26a8f80*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.628] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a925c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26a925c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.628] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0190.628] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.628] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.628] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.628] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.629] GetFileType (hFile=0x318) returned 0x1
	[0190.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.629] GetFileType (hFile=0x318) returned 0x1
	[0190.629] WriteFile (in: hFile=0x318, lpBuffer=0x26a94a0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26a94a0*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.630] CloseHandle (hObject=0x318) returned 1
	[0190.630] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.630] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.630] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabf3d6cc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.631] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.632] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.632] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26aaa88 | out: lpFileInformation=0x26aaa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0190.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.633] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.633] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.633] GetFileType (hFile=0x318) returned 0x1
	[0190.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.633] GetFileType (hFile=0x318) returned 0x1
	[0190.633] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c3
	[0190.633] ReadFile (in: hFile=0x318, lpBuffer=0x26ab1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ab1c8*, lpNumberOfBytesRead=0x540efcc*=0x2c3, lpOverlapped=0x0) returned 1
	[0190.635] CloseHandle (hObject=0x318) returned 1
	[0190.635] CryptDestroyKey (hKey=0x82b540) returned 1
	[0190.635] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.635] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ac264, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0190.635] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.635] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.635] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0190.635] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.635] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26ac31c*=0x1, dwFlags=0x0) returned 1
	[0190.635] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26ac2e8, dwFlags=0x0) returned 1
	[0190.635] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ac32c*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26ac32c*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.635] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ac608*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26ac608*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.635] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.635] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.635] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.636] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.636] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.637] GetFileType (hFile=0x318) returned 0x1
	[0190.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.637] GetFileType (hFile=0x318) returned 0x1
	[0190.637] WriteFile (in: hFile=0x318, lpBuffer=0x26ac84c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26ac84c*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.638] CloseHandle (hObject=0x318) returned 1
	[0190.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.639] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabf63933, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.639] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.640] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.640] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26ade34 | out: lpFileInformation=0x26ade34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0190.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.640] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.641] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.641] GetFileType (hFile=0x318) returned 0x1
	[0190.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.641] GetFileType (hFile=0x318) returned 0x1
	[0190.641] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cf
	[0190.641] ReadFile (in: hFile=0x318, lpBuffer=0x26ae580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ae580*, lpNumberOfBytesRead=0x540efcc*=0x2cf, lpOverlapped=0x0) returned 1
	[0190.642] CloseHandle (hObject=0x318) returned 1
	[0190.643] CryptDestroyKey (hKey=0x82b280) returned 1
	[0190.643] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.643] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26af61c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0190.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.643] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0190.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.643] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26af6d4*=0x1, dwFlags=0x0) returned 1
	[0190.643] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x26af6a0, dwFlags=0x0) returned 1
	[0190.643] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26af6e4*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26af6e4*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.643] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26af9c0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26af9c0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.643] CryptDestroyKey (hKey=0x82b380) returned 1
	[0190.643] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.643] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.643] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.643] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.645] GetFileType (hFile=0x318) returned 0x1
	[0190.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.645] GetFileType (hFile=0x318) returned 0x1
	[0190.645] WriteFile (in: hFile=0x318, lpBuffer=0x26afc04*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26afc04*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.646] CloseHandle (hObject=0x318) returned 1
	[0190.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0190.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0190.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.646] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabf63933, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.646] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.647] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.648] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b11ec | out: lpFileInformation=0x26b11ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0190.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.648] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.648] GetFileType (hFile=0x318) returned 0x1
	[0190.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.648] GetFileType (hFile=0x318) returned 0x1
	[0190.648] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2ca
	[0190.648] ReadFile (in: hFile=0x318, lpBuffer=0x26b1974, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26b1974*, lpNumberOfBytesRead=0x540efcc*=0x2ca, lpOverlapped=0x0) returned 1
	[0190.650] CloseHandle (hObject=0x318) returned 1
	[0190.650] CryptDestroyKey (hKey=0x82b340) returned 1
	[0190.650] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.650] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b2a10, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0190.650] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.650] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.650] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0190.650] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.650] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26b2ac8*=0x1, dwFlags=0x0) returned 1
	[0190.650] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x26b2a94, dwFlags=0x0) returned 1
	[0190.651] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b2ad8*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26b2ad8*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.651] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b2db4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b2db4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.651] CryptDestroyKey (hKey=0x82b100) returned 1
	[0190.651] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.651] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.651] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.651] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.652] GetFileType (hFile=0x318) returned 0x1
	[0190.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.653] GetFileType (hFile=0x318) returned 0x1
	[0190.653] WriteFile (in: hFile=0x318, lpBuffer=0x26b3018*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26b3018*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.654] CloseHandle (hObject=0x318) returned 1
	[0190.654] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.654] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0190.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.654] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabf89ba3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.654] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.655] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.655] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b4640 | out: lpFileInformation=0x26b4640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2)) returned 1
	[0190.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.656] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.656] ReadFile (in: hFile=0x318, lpBuffer=0x26b4dd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26b4dd0*, lpNumberOfBytesRead=0x540efcc*=0x2d2, lpOverlapped=0x0) returned 1
	[0190.681] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.681] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.681] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b5e6c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0190.681] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.681] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.681] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0190.681] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.681] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26b5f24*=0x1, dwFlags=0x0) returned 1
	[0190.681] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26b5ef0, dwFlags=0x0) returned 1
	[0190.682] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b5f34*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26b5f34*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0190.682] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b6220*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b6220*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.682] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0190.682] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.682] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.682] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.682] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.684] GetFileType (hFile=0x318) returned 0x1
	[0190.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.684] GetFileType (hFile=0x318) returned 0x1
	[0190.684] WriteFile (in: hFile=0x318, lpBuffer=0x26b6484*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26b6484*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.685] CloseHandle (hObject=0x318) returned 1
	[0190.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0190.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0190.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.685] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabfd614a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0190.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.685] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.686] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0190.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.686] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b7aac | out: lpFileInformation=0x26b7aac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc)) returned 1
	[0190.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.687] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0190.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.687] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.687] GetFileType (hFile=0x318) returned 0x1
	[0190.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.687] GetFileType (hFile=0x318) returned 0x1
	[0190.687] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2dc
	[0190.687] ReadFile (in: hFile=0x318, lpBuffer=0x26b8234, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26b8234*, lpNumberOfBytesRead=0x540efcc*=0x2dc, lpOverlapped=0x0) returned 1
	[0190.689] CloseHandle (hObject=0x318) returned 1
	[0190.689] CryptDestroyKey (hKey=0x82b440) returned 1
	[0190.689] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.689] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b92d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b5c0) returned 1
	[0190.689] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.689] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.689] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0190.689] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.689] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26b9388*=0x1, dwFlags=0x0) returned 1
	[0190.689] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26b9354, dwFlags=0x0) returned 1
	[0190.690] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b9398*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26b9398*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0190.690] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b9684*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26b9684*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.690] CryptDestroyKey (hKey=0x82b480) returned 1
	[0190.690] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.690] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.690] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0190.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.690] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.691] GetFileType (hFile=0x318) returned 0x1
	[0190.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.691] GetFileType (hFile=0x318) returned 0x1
	[0190.691] WriteFile (in: hFile=0x318, lpBuffer=0x26b98e0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26b98e0*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.692] CloseHandle (hObject=0x318) returned 1
	[0190.692] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0190.692] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0190.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.693] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabfd614a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0190.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.693] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.694] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.694] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26baf04 | out: lpFileInformation=0x26baf04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915f3e81, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d5)) returned 1
	[0190.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.694] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.695] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.695] GetFileType (hFile=0x318) returned 0x1
	[0190.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.695] GetFileType (hFile=0x318) returned 0x1
	[0190.695] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1d5
	[0190.695] ReadFile (in: hFile=0x318, lpBuffer=0x26bb588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26bb588*, lpNumberOfBytesRead=0x540efcc*=0x1d5, lpOverlapped=0x0) returned 1
	[0190.696] CloseHandle (hObject=0x318) returned 1
	[0190.696] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0190.696] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.696] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bc624, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b4c0) returned 1
	[0190.696] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.696] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.696] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b300) returned 1
	[0190.696] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.696] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26bc6dc*=0x1, dwFlags=0x0) returned 1
	[0190.696] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26bc6a8, dwFlags=0x0) returned 1
	[0190.696] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bc6ec*, pdwDataLen=0x540efd4*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x26bc6ec*, pdwDataLen=0x540efd4*=0x1e0) returned 1
	[0190.697] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bc8d8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26bc8d8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.697] CryptDestroyKey (hKey=0x82b300) returned 1
	[0190.697] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.697] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.697] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.697] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.698] GetFileType (hFile=0x318) returned 0x1
	[0190.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.698] GetFileType (hFile=0x318) returned 0x1
	[0190.698] WriteFile (in: hFile=0x318, lpBuffer=0x26bcb34*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26bcb34*, lpNumberOfBytesWritten=0x540ef94*=0x1e0, lpOverlapped=0x0) returned 1
	[0190.699] CloseHandle (hObject=0x318) returned 1
	[0190.699] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.699] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0190.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.700] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabffd121, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0190.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.700] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.702] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0190.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.702] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26be14c | out: lpFileInformation=0x26be14c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915f3e81, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc)) returned 1
	[0190.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.702] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0190.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.702] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.702] GetFileType (hFile=0x318) returned 0x1
	[0190.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.702] GetFileType (hFile=0x318) returned 0x1
	[0190.702] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2dc
	[0190.703] ReadFile (in: hFile=0x318, lpBuffer=0x26be8d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26be8d4*, lpNumberOfBytesRead=0x540efcc*=0x2dc, lpOverlapped=0x0) returned 1
	[0190.704] CloseHandle (hObject=0x318) returned 1
	[0190.704] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0190.704] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.704] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bf970, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0190.704] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.704] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.704] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0190.704] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.704] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26bfa28*=0x1, dwFlags=0x0) returned 1
	[0190.704] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26bf9f4, dwFlags=0x0) returned 1
	[0190.705] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bfa38*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26bfa38*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0190.705] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bfd24*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26bfd24*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.705] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0190.705] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.705] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.705] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0190.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.705] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.706] GetFileType (hFile=0x318) returned 0x1
	[0190.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.706] GetFileType (hFile=0x318) returned 0x1
	[0190.706] WriteFile (in: hFile=0x318, lpBuffer=0x26bff80*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26bff80*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.707] CloseHandle (hObject=0x318) returned 1
	[0190.707] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0190.707] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0190.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.708] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabffd121, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0190.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.708] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.709] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0190.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.709] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26c15a4 | out: lpFileInformation=0x26c15a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915f3e81, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce)) returned 1
	[0190.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.710] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0190.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.710] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.710] GetFileType (hFile=0x318) returned 0x1
	[0190.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.710] GetFileType (hFile=0x318) returned 0x1
	[0190.710] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2ce
	[0190.710] ReadFile (in: hFile=0x318, lpBuffer=0x26c1d20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c1d20*, lpNumberOfBytesRead=0x540efcc*=0x2ce, lpOverlapped=0x0) returned 1
	[0190.712] CloseHandle (hObject=0x318) returned 1
	[0190.712] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.712] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.712] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c2dbc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0190.712] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.712] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.712] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b380) returned 1
	[0190.712] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.712] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26c2e74*=0x1, dwFlags=0x0) returned 1
	[0190.712] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x26c2e40, dwFlags=0x0) returned 1
	[0190.712] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c2e84*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26c2e84*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.712] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c3160*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c3160*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.712] CryptDestroyKey (hKey=0x82b380) returned 1
	[0190.712] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.712] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0190.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.712] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.714] GetFileType (hFile=0x318) returned 0x1
	[0190.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.714] GetFileType (hFile=0x318) returned 0x1
	[0190.714] WriteFile (in: hFile=0x318, lpBuffer=0x26c33bc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26c33bc*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.715] CloseHandle (hObject=0x318) returned 1
	[0190.716] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0190.716] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0190.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.716] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac0235b4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.716] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.717] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0190.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.717] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26c49e0 | out: lpFileInformation=0x26c49e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902e08bf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5)) returned 1
	[0190.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.718] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0190.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.718] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.718] GetFileType (hFile=0x318) returned 0x1
	[0190.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.718] GetFileType (hFile=0x318) returned 0x1
	[0190.718] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c5
	[0190.718] ReadFile (in: hFile=0x318, lpBuffer=0x26c5134, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c5134*, lpNumberOfBytesRead=0x540efcc*=0x2c5, lpOverlapped=0x0) returned 1
	[0190.741] CloseHandle (hObject=0x318) returned 1
	[0190.741] CryptDestroyKey (hKey=0x82b340) returned 1
	[0190.741] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.741] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c61d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b080) returned 1
	[0190.741] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.741] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.741] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0190.741] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.742] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x26c6288*=0x1, dwFlags=0x0) returned 1
	[0190.742] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x26c6254, dwFlags=0x0) returned 1
	[0190.742] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c6298*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26c6298*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0190.742] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c6574*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c6574*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.742] CryptDestroyKey (hKey=0x82b040) returned 1
	[0190.742] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.742] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.742] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0190.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.742] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.743] GetFileType (hFile=0x318) returned 0x1
	[0190.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.743] GetFileType (hFile=0x318) returned 0x1
	[0190.743] WriteFile (in: hFile=0x318, lpBuffer=0x26c67c0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26c67c0*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.744] CloseHandle (hObject=0x318) returned 1
	[0190.744] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0190.744] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0190.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.744] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac0487c1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.744] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.902] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.902] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26c7db8 | out: lpFileInformation=0x26c7db8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915f3e81, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d5)) returned 1
	[0190.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.903] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.903] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.903] GetFileType (hFile=0x318) returned 0x1
	[0190.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.903] GetFileType (hFile=0x318) returned 0x1
	[0190.903] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1d5
	[0190.903] ReadFile (in: hFile=0x318, lpBuffer=0x26c843c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26c843c*, lpNumberOfBytesRead=0x540efcc*=0x1d5, lpOverlapped=0x0) returned 1
	[0190.904] CloseHandle (hObject=0x318) returned 1
	[0190.904] CryptDestroyKey (hKey=0x82b080) returned 1
	[0190.904] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.904] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c94d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0190.904] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.904] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.904] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0190.904] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.904] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26c9590*=0x1, dwFlags=0x0) returned 1
	[0190.904] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26c955c, dwFlags=0x0) returned 1
	[0190.904] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c95a0*, pdwDataLen=0x540efd4*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x26c95a0*, pdwDataLen=0x540efd4*=0x1e0) returned 1
	[0190.904] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c978c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26c978c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.904] CryptDestroyKey (hKey=0x82b440) returned 1
	[0190.904] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.904] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.904] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.904] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.906] GetFileType (hFile=0x318) returned 0x1
	[0190.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.906] GetFileType (hFile=0x318) returned 0x1
	[0190.906] WriteFile (in: hFile=0x318, lpBuffer=0x26c99e8*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26c99e8*, lpNumberOfBytesWritten=0x540ef94*=0x1e0, lpOverlapped=0x0) returned 1
	[0190.909] CloseHandle (hObject=0x318) returned 1
	[0190.909] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.909] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0190.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.909] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac1ec39b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0190.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.910] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.911] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0190.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.911] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26cb000 | out: lpFileInformation=0x26cb000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915f3e81, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x351)) returned 1
	[0190.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.912] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0190.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.912] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.912] GetFileType (hFile=0x318) returned 0x1
	[0190.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.912] GetFileType (hFile=0x318) returned 0x1
	[0190.912] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x351
	[0190.912] ReadFile (in: hFile=0x318, lpBuffer=0x26cb820, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26cb820*, lpNumberOfBytesRead=0x540efcc*=0x351, lpOverlapped=0x0) returned 1
	[0190.913] CloseHandle (hObject=0x318) returned 1
	[0190.913] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0190.913] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.913] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26cc8bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0190.913] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.913] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.914] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0190.914] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.914] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26cc974*=0x1, dwFlags=0x0) returned 1
	[0190.914] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26cc940, dwFlags=0x0) returned 1
	[0190.914] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26cc984*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x26cc984*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0190.914] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26cccf0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26cccf0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.914] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.914] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.914] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0190.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.914] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.915] GetFileType (hFile=0x318) returned 0x1
	[0190.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.915] GetFileType (hFile=0x318) returned 0x1
	[0190.915] WriteFile (in: hFile=0x318, lpBuffer=0x26ccf5c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26ccf5c*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0190.916] CloseHandle (hObject=0x318) returned 1
	[0190.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0190.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0190.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.916] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac1ec39b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0190.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.917] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.918] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.918] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26ce594 | out: lpFileInformation=0x26ce594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915f3e81, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb)) returned 1
	[0190.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.918] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.918] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.918] GetFileType (hFile=0x318) returned 0x1
	[0190.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.918] GetFileType (hFile=0x318) returned 0x1
	[0190.918] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cb
	[0190.918] ReadFile (in: hFile=0x318, lpBuffer=0x26cec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26cec0c*, lpNumberOfBytesRead=0x540efcc*=0x1cb, lpOverlapped=0x0) returned 1
	[0190.919] CloseHandle (hObject=0x318) returned 1
	[0190.919] CryptDestroyKey (hKey=0x82b280) returned 1
	[0190.919] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.919] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26cfca8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0190.919] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.919] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.919] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0190.919] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.920] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26cfd60*=0x1, dwFlags=0x0) returned 1
	[0190.920] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26cfd2c, dwFlags=0x0) returned 1
	[0190.920] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26cfd70*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26cfd70*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0190.920] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26cff4c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26cff4c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.920] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.920] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.920] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.920] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.921] WriteFile (in: hFile=0x318, lpBuffer=0x26d01a8*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26d01a8*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0190.922] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.924] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0190.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.925] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.925] GetFileType (hFile=0x318) returned 0x1
	[0190.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.925] GetFileType (hFile=0x318) returned 0x1
	[0190.925] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x354
	[0190.925] ReadFile (in: hFile=0x318, lpBuffer=0x26d1ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d1ff0*, lpNumberOfBytesRead=0x540efcc*=0x354, lpOverlapped=0x0) returned 1
	[0190.926] CloseHandle (hObject=0x318) returned 1
	[0190.926] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0190.926] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.926] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d308c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0190.926] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.926] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.926] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0190.927] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.927] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26d3144*=0x1, dwFlags=0x0) returned 1
	[0190.927] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26d3110, dwFlags=0x0) returned 1
	[0190.927] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d3154*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x26d3154*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0190.927] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d34c0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26d34c0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.927] CryptDestroyKey (hKey=0x82b440) returned 1
	[0190.927] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.927] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0190.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.927] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.928] GetFileType (hFile=0x318) returned 0x1
	[0190.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.928] GetFileType (hFile=0x318) returned 0x1
	[0190.928] WriteFile (in: hFile=0x318, lpBuffer=0x26d3734*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26d3734*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0190.929] CloseHandle (hObject=0x318) returned 1
	[0190.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0190.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0190.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.929] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161a0f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9161a0f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac2123e2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0190.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.929] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.931] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.931] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26d4d88 | out: lpFileInformation=0x26d4d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161a0f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9161a0f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9161a0f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb)) returned 1
	[0190.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.931] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.931] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.931] GetFileType (hFile=0x318) returned 0x1
	[0190.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.931] GetFileType (hFile=0x318) returned 0x1
	[0190.931] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cb
	[0190.931] ReadFile (in: hFile=0x318, lpBuffer=0x26d5400, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d5400*, lpNumberOfBytesRead=0x540efcc*=0x1cb, lpOverlapped=0x0) returned 1
	[0190.932] CloseHandle (hObject=0x318) returned 1
	[0190.932] CryptDestroyKey (hKey=0x82b100) returned 1
	[0190.932] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.932] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d649c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0190.933] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.933] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.933] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0190.933] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.933] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26d6554*=0x1, dwFlags=0x0) returned 1
	[0190.933] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26d6520, dwFlags=0x0) returned 1
	[0190.933] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d6564*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26d6564*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0190.933] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d6740*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26d6740*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.933] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.933] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.933] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.933] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.933] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.934] GetFileType (hFile=0x318) returned 0x1
	[0190.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.934] GetFileType (hFile=0x318) returned 0x1
	[0190.934] WriteFile (in: hFile=0x318, lpBuffer=0x26d699c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26d699c*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0190.935] CloseHandle (hObject=0x318) returned 1
	[0190.935] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.935] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0190.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.935] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161a0f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9161a0f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac238713, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0190.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.935] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0190.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.972] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26d7fb4 | out: lpFileInformation=0x26d7fb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161a0f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9161a0f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9161a0f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353)) returned 1
	[0190.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0190.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.973] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.973] GetFileType (hFile=0x318) returned 0x1
	[0190.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.973] GetFileType (hFile=0x318) returned 0x1
	[0190.973] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x353
	[0190.973] ReadFile (in: hFile=0x318, lpBuffer=0x26d87e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26d87e4*, lpNumberOfBytesRead=0x540efcc*=0x353, lpOverlapped=0x0) returned 1
	[0190.975] CloseHandle (hObject=0x318) returned 1
	[0190.975] CryptDestroyKey (hKey=0x82b280) returned 1
	[0190.975] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.975] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d9880, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0190.975] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.975] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.975] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0190.975] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.975] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26d9938*=0x1, dwFlags=0x0) returned 1
	[0190.975] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26d9904, dwFlags=0x0) returned 1
	[0190.975] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d9948*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x26d9948*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0190.975] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d9cb4*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26d9cb4*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.975] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.975] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.975] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0190.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.976] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.977] GetFileType (hFile=0x318) returned 0x1
	[0190.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.977] GetFileType (hFile=0x318) returned 0x1
	[0190.977] WriteFile (in: hFile=0x318, lpBuffer=0x26d9f28*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26d9f28*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0190.978] CloseHandle (hObject=0x318) returned 1
	[0190.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0190.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0190.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.989] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161a0f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9161a0f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac284a8f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0190.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.989] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0190.990] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26db570 | out: lpFileInformation=0x26db570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161a0f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9161a0f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9161a0f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb)) returned 1
	[0190.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0190.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0190.990] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.991] GetFileType (hFile=0x318) returned 0x1
	[0190.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0190.991] GetFileType (hFile=0x318) returned 0x1
	[0190.991] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cb
	[0190.991] ReadFile (in: hFile=0x318, lpBuffer=0x26dbbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26dbbe8*, lpNumberOfBytesRead=0x540efcc*=0x1cb, lpOverlapped=0x0) returned 1
	[0190.992] CloseHandle (hObject=0x318) returned 1
	[0190.992] CryptDestroyKey (hKey=0x82b440) returned 1
	[0190.992] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.992] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26dcc84, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0190.992] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.992] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.992] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0190.992] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.992] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26dcd3c*=0x1, dwFlags=0x0) returned 1
	[0190.992] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x26dcd08, dwFlags=0x0) returned 1
	[0190.992] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26dcd4c*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26dcd4c*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0190.992] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dcf28*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26dcf28*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0190.992] CryptDestroyKey (hKey=0x82b100) returned 1
	[0190.992] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.992] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.992] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0190.993] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.994] GetFileType (hFile=0x318) returned 0x1
	[0190.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0190.994] GetFileType (hFile=0x318) returned 0x1
	[0190.994] WriteFile (in: hFile=0x318, lpBuffer=0x26dd184*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26dd184*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0190.995] CloseHandle (hObject=0x318) returned 1
	[0190.995] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0190.995] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0190.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0190.995] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161a0f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9161a0f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac2d0fa7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0190.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0190.995] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.021] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0191.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.021] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26de79c | out: lpFileInformation=0x26de79c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91640358, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f)) returned 1
	[0191.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.022] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0191.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.022] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.022] GetFileType (hFile=0x318) returned 0x1
	[0191.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.022] GetFileType (hFile=0x318) returned 0x1
	[0191.022] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34f
	[0191.022] ReadFile (in: hFile=0x318, lpBuffer=0x26defa8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26defa8*, lpNumberOfBytesRead=0x540efcc*=0x34f, lpOverlapped=0x0) returned 1
	[0191.024] CloseHandle (hObject=0x318) returned 1
	[0191.024] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.024] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.024] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e0044, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0191.024] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.024] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.024] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b100) returned 1
	[0191.024] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.024] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26e00fc*=0x1, dwFlags=0x0) returned 1
	[0191.024] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x26e00c8, dwFlags=0x0) returned 1
	[0191.024] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e010c*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x26e010c*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0191.024] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e0468*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e0468*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.024] CryptDestroyKey (hKey=0x82b100) returned 1
	[0191.025] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.025] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.025] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0191.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.025] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.026] GetFileType (hFile=0x318) returned 0x1
	[0191.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.026] GetFileType (hFile=0x318) returned 0x1
	[0191.026] WriteFile (in: hFile=0x318, lpBuffer=0x26e06cc*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26e06cc*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0191.027] CloseHandle (hObject=0x318) returned 1
	[0191.027] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0191.027] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0191.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.027] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac31d7e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0191.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.028] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.029] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.029] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26e1cf4 | out: lpFileInformation=0x26e1cf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91640358, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb)) returned 1
	[0191.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.029] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.029] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.029] GetFileType (hFile=0x318) returned 0x1
	[0191.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.029] GetFileType (hFile=0x318) returned 0x1
	[0191.029] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cb
	[0191.029] ReadFile (in: hFile=0x318, lpBuffer=0x26e236c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e236c*, lpNumberOfBytesRead=0x540efcc*=0x1cb, lpOverlapped=0x0) returned 1
	[0191.030] CloseHandle (hObject=0x318) returned 1
	[0191.030] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.030] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.031] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e3408, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b100) returned 1
	[0191.031] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.031] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.031] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0191.031] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.031] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26e34c0*=0x1, dwFlags=0x0) returned 1
	[0191.031] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26e348c, dwFlags=0x0) returned 1
	[0191.031] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e34d0*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26e34d0*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0191.031] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e36ac*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e36ac*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.031] CryptDestroyKey (hKey=0x82b540) returned 1
	[0191.031] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.031] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.031] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.032] GetFileType (hFile=0x318) returned 0x1
	[0191.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.032] GetFileType (hFile=0x318) returned 0x1
	[0191.032] WriteFile (in: hFile=0x318, lpBuffer=0x26e3908*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26e3908*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0191.033] CloseHandle (hObject=0x318) returned 1
	[0191.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0191.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.033] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac31d7e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0191.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.034] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.042] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26e4f20 | out: lpFileInformation=0x26e4f20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91640358, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353)) returned 1
	[0191.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.042] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.043] GetFileType (hFile=0x318) returned 0x1
	[0191.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.043] GetFileType (hFile=0x318) returned 0x1
	[0191.043] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x353
	[0191.043] ReadFile (in: hFile=0x318, lpBuffer=0x26e5750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e5750*, lpNumberOfBytesRead=0x540efcc*=0x353, lpOverlapped=0x0) returned 1
	[0191.044] CloseHandle (hObject=0x318) returned 1
	[0191.044] CryptDestroyKey (hKey=0x82b100) returned 1
	[0191.044] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.044] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e67ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0191.044] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.044] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.044] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0191.044] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.044] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x26e68a4*=0x1, dwFlags=0x0) returned 1
	[0191.045] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26e6870, dwFlags=0x0) returned 1
	[0191.045] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e68b4*, pdwDataLen=0x540efd4*=0x360, dwBufLen=0x360 | out: pbData=0x26e68b4*, pdwDataLen=0x540efd4*=0x360) returned 1
	[0191.045] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e6c20*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26e6c20*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.045] CryptDestroyKey (hKey=0x82b400) returned 1
	[0191.045] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.045] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.045] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.045] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.049] GetFileType (hFile=0x318) returned 0x1
	[0191.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.049] GetFileType (hFile=0x318) returned 0x1
	[0191.049] WriteFile (in: hFile=0x318, lpBuffer=0x26e6e94*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26e6e94*, lpNumberOfBytesWritten=0x540ef94*=0x360, lpOverlapped=0x0) returned 1
	[0191.050] CloseHandle (hObject=0x318) returned 1
	[0191.050] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.050] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0191.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.050] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac343f7e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0191.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.050] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.052] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.052] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26e84dc | out: lpFileInformation=0x26e84dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902e08bf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1)) returned 1
	[0191.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.052] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.052] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.052] GetFileType (hFile=0x318) returned 0x1
	[0191.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.052] GetFileType (hFile=0x318) returned 0x1
	[0191.052] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2d1
	[0191.052] ReadFile (in: hFile=0x318, lpBuffer=0x26e8c4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26e8c4c*, lpNumberOfBytesRead=0x540efcc*=0x2d1, lpOverlapped=0x0) returned 1
	[0191.055] CloseHandle (hObject=0x318) returned 1
	[0191.055] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.055] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.055] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e9ce8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b280) returned 1
	[0191.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.055] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0191.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.055] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x26e9da0*=0x1, dwFlags=0x0) returned 1
	[0191.055] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x26e9d6c, dwFlags=0x0) returned 1
	[0191.055] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e9db0*, pdwDataLen=0x540efd4*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26e9db0*, pdwDataLen=0x540efd4*=0x2e0) returned 1
	[0191.055] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ea09c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26ea09c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.055] CryptDestroyKey (hKey=0x82b040) returned 1
	[0191.055] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.055] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.055] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.056] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.057] GetFileType (hFile=0x318) returned 0x1
	[0191.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.057] GetFileType (hFile=0x318) returned 0x1
	[0191.057] WriteFile (in: hFile=0x318, lpBuffer=0x26ea2f0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26ea2f0*, lpNumberOfBytesWritten=0x540ef94*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.058] CloseHandle (hObject=0x318) returned 1
	[0191.058] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.058] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0191.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.058] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac3698bc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.058] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.059] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.059] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26eb904 | out: lpFileInformation=0x26eb904*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91640358, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb)) returned 1
	[0191.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.060] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.060] ReadFile (in: hFile=0x318, lpBuffer=0x26ebf7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ebf7c*, lpNumberOfBytesRead=0x540efcc*=0x1cb, lpOverlapped=0x0) returned 1
	[0191.061] CryptDestroyKey (hKey=0x82b280) returned 1
	[0191.061] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.061] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ed018, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b2c0) returned 1
	[0191.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.061] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b480) returned 1
	[0191.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.061] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26ed0d0*=0x1, dwFlags=0x0) returned 1
	[0191.061] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26ed09c, dwFlags=0x0) returned 1
	[0191.061] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ed0e0*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26ed0e0*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0191.061] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ed2bc*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26ed2bc*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.061] CryptDestroyKey (hKey=0x82b480) returned 1
	[0191.061] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.061] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.061] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.061] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.063] GetFileType (hFile=0x318) returned 0x1
	[0191.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.063] GetFileType (hFile=0x318) returned 0x1
	[0191.063] WriteFile (in: hFile=0x318, lpBuffer=0x26ed518*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26ed518*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0191.064] CloseHandle (hObject=0x318) returned 1
	[0191.064] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.064] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0191.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.064] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac3698bc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0191.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.064] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0191.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.074] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26eeb30 | out: lpFileInformation=0x26eeb30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91640358, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34d)) returned 1
	[0191.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0191.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.075] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.075] GetFileType (hFile=0x318) returned 0x1
	[0191.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.075] GetFileType (hFile=0x318) returned 0x1
	[0191.075] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34d
	[0191.075] ReadFile (in: hFile=0x318, lpBuffer=0x26ef32c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ef32c*, lpNumberOfBytesRead=0x540efcc*=0x34d, lpOverlapped=0x0) returned 1
	[0191.077] CloseHandle (hObject=0x318) returned 1
	[0191.077] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0191.077] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.077] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f03c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0191.077] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.077] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.077] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0191.077] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.077] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26f0480*=0x1, dwFlags=0x0) returned 1
	[0191.077] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26f044c, dwFlags=0x0) returned 1
	[0191.077] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f0490*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x26f0490*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0191.077] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f07ec*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f07ec*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.077] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.077] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.077] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0191.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.077] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.079] GetFileType (hFile=0x318) returned 0x1
	[0191.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.079] GetFileType (hFile=0x318) returned 0x1
	[0191.079] WriteFile (in: hFile=0x318, lpBuffer=0x26f0a48*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26f0a48*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0191.080] CloseHandle (hObject=0x318) returned 1
	[0191.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0191.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0191.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.080] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac38fbb2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0191.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.080] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.081] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.081] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f2060 | out: lpFileInformation=0x26f2060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91640358, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb)) returned 1
	[0191.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.082] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.082] GetFileType (hFile=0x318) returned 0x1
	[0191.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.082] GetFileType (hFile=0x318) returned 0x1
	[0191.082] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cb
	[0191.082] ReadFile (in: hFile=0x318, lpBuffer=0x26f26d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f26d8*, lpNumberOfBytesRead=0x540efcc*=0x1cb, lpOverlapped=0x0) returned 1
	[0191.083] CloseHandle (hObject=0x318) returned 1
	[0191.083] CryptDestroyKey (hKey=0x82b340) returned 1
	[0191.083] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.083] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f3774, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0191.083] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.083] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.083] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0191.083] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.083] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26f382c*=0x1, dwFlags=0x0) returned 1
	[0191.083] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26f37f8, dwFlags=0x0) returned 1
	[0191.083] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f383c*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26f383c*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0191.083] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f3a18*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f3a18*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.083] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0191.083] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.083] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.084] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.085] GetFileType (hFile=0x318) returned 0x1
	[0191.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.085] GetFileType (hFile=0x318) returned 0x1
	[0191.085] WriteFile (in: hFile=0x318, lpBuffer=0x26f3c74*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26f3c74*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0191.086] CloseHandle (hObject=0x318) returned 1
	[0191.086] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.086] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0191.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.086] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac38fbb2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0191.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.087] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.089] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.089] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f528c | out: lpFileInformation=0x26f528c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916665c7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34b)) returned 1
	[0191.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.089] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.089] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.090] GetFileType (hFile=0x318) returned 0x1
	[0191.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.090] GetFileType (hFile=0x318) returned 0x1
	[0191.090] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34b
	[0191.090] ReadFile (in: hFile=0x318, lpBuffer=0x26f5a74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f5a74*, lpNumberOfBytesRead=0x540efcc*=0x34b, lpOverlapped=0x0) returned 1
	[0191.091] CloseHandle (hObject=0x318) returned 1
	[0191.091] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.091] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.091] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f6b10, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0191.091] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.091] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.091] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0191.091] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.091] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26f6bc8*=0x1, dwFlags=0x0) returned 1
	[0191.091] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26f6b94, dwFlags=0x0) returned 1
	[0191.091] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f6bd8*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x26f6bd8*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0191.091] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f6f34*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26f6f34*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.092] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.092] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.092] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.092] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.092] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.093] GetFileType (hFile=0x318) returned 0x1
	[0191.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.093] GetFileType (hFile=0x318) returned 0x1
	[0191.093] WriteFile (in: hFile=0x318, lpBuffer=0x26f7188*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26f7188*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0191.094] CloseHandle (hObject=0x318) returned 1
	[0191.094] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.094] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0191.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.094] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac3b5d5d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0191.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.094] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.095] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f8790 | out: lpFileInformation=0x26f8790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916665c7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb)) returned 1
	[0191.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.096] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.096] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.096] GetFileType (hFile=0x318) returned 0x1
	[0191.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.096] GetFileType (hFile=0x318) returned 0x1
	[0191.096] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cb
	[0191.096] ReadFile (in: hFile=0x318, lpBuffer=0x26f8e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26f8e08*, lpNumberOfBytesRead=0x540efcc*=0x1cb, lpOverlapped=0x0) returned 1
	[0191.117] CloseHandle (hObject=0x318) returned 1
	[0191.117] CryptDestroyKey (hKey=0x82b300) returned 1
	[0191.117] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.117] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f9ea4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b300) returned 1
	[0191.117] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.117] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.117] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b540) returned 1
	[0191.117] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.117] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26f9f5c*=0x1, dwFlags=0x0) returned 1
	[0191.117] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26f9f28, dwFlags=0x0) returned 1
	[0191.117] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f9f6c*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26f9f6c*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0191.118] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fa148*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26fa148*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.118] CryptDestroyKey (hKey=0x82b540) returned 1
	[0191.118] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.118] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.118] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.119] GetFileType (hFile=0x318) returned 0x1
	[0191.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.119] GetFileType (hFile=0x318) returned 0x1
	[0191.119] WriteFile (in: hFile=0x318, lpBuffer=0x26fa3a4*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26fa3a4*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0191.120] CloseHandle (hObject=0x318) returned 1
	[0191.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0191.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.120] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac4022f0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0191.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.121] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.129] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.129] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26fb9bc | out: lpFileInformation=0x26fb9bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916665c7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c)) returned 1
	[0191.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.129] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.129] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.130] GetFileType (hFile=0x318) returned 0x1
	[0191.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.130] GetFileType (hFile=0x318) returned 0x1
	[0191.130] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x34c
	[0191.130] ReadFile (in: hFile=0x318, lpBuffer=0x26fc1a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26fc1a4*, lpNumberOfBytesRead=0x540efcc*=0x34c, lpOverlapped=0x0) returned 1
	[0191.131] CloseHandle (hObject=0x318) returned 1
	[0191.131] CryptDestroyKey (hKey=0x82b300) returned 1
	[0191.131] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.131] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fd240, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b340) returned 1
	[0191.131] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.131] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.132] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b080) returned 1
	[0191.132] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.132] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x26fd2f8*=0x1, dwFlags=0x0) returned 1
	[0191.132] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x26fd2c4, dwFlags=0x0) returned 1
	[0191.132] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fd308*, pdwDataLen=0x540efd4*=0x350, dwBufLen=0x350 | out: pbData=0x26fd308*, pdwDataLen=0x540efd4*=0x350) returned 1
	[0191.132] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fd664*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x26fd664*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.132] CryptDestroyKey (hKey=0x82b080) returned 1
	[0191.132] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.132] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.132] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.132] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.133] GetFileType (hFile=0x318) returned 0x1
	[0191.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.134] GetFileType (hFile=0x318) returned 0x1
	[0191.134] WriteFile (in: hFile=0x318, lpBuffer=0x26fd8b8*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x26fd8b8*, lpNumberOfBytesWritten=0x540ef94*=0x350, lpOverlapped=0x0) returned 1
	[0191.135] CloseHandle (hObject=0x318) returned 1
	[0191.135] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.135] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0191.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.135] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac4022f0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0191.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.135] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.137] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26feecc | out: lpFileInformation=0x26feecc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916665c7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb)) returned 1
	[0191.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.137] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.138] GetFileType (hFile=0x318) returned 0x1
	[0191.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.138] GetFileType (hFile=0x318) returned 0x1
	[0191.138] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1cb
	[0191.138] ReadFile (in: hFile=0x318, lpBuffer=0x26ff544, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x26ff544*, lpNumberOfBytesRead=0x540efcc*=0x1cb, lpOverlapped=0x0) returned 1
	[0191.139] CloseHandle (hObject=0x318) returned 1
	[0191.139] CryptDestroyKey (hKey=0x82b340) returned 1
	[0191.139] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.139] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27005e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0191.139] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.139] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.139] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0191.139] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.139] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2700698*=0x1, dwFlags=0x0) returned 1
	[0191.139] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2700664, dwFlags=0x0) returned 1
	[0191.139] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27006a8*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27006a8*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0191.139] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2700884*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2700884*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.139] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.140] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.140] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.140] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.141] GetFileType (hFile=0x318) returned 0x1
	[0191.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.141] GetFileType (hFile=0x318) returned 0x1
	[0191.141] WriteFile (in: hFile=0x318, lpBuffer=0x2700ae0*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2700ae0*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0191.142] CloseHandle (hObject=0x318) returned 1
	[0191.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0191.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.143] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac4285c0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0191.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.143] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.145] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27020f8 | out: lpFileInformation=0x27020f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916665c7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0191.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.146] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.146] GetFileType (hFile=0x318) returned 0x1
	[0191.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.146] GetFileType (hFile=0x318) returned 0x1
	[0191.146] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2cb
	[0191.146] ReadFile (in: hFile=0x318, lpBuffer=0x2702860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2702860*, lpNumberOfBytesRead=0x540efcc*=0x2cb, lpOverlapped=0x0) returned 1
	[0191.147] CloseHandle (hObject=0x318) returned 1
	[0191.148] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.148] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.148] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27038fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b000) returned 1
	[0191.148] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.148] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.148] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b440) returned 1
	[0191.148] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.148] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x27039b4*=0x1, dwFlags=0x0) returned 1
	[0191.148] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2703980, dwFlags=0x0) returned 1
	[0191.148] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27039c4*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27039c4*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0191.148] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2703ca0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2703ca0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.148] CryptDestroyKey (hKey=0x82b440) returned 1
	[0191.148] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.148] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.148] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.150] GetFileType (hFile=0x318) returned 0x1
	[0191.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.150] GetFileType (hFile=0x318) returned 0x1
	[0191.150] WriteFile (in: hFile=0x318, lpBuffer=0x2703ef4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2703ef4*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.151] CloseHandle (hObject=0x318) returned 1
	[0191.152] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.152] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0191.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.152] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac44e787, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.152] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.153] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.153] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2705508 | out: lpFileInformation=0x2705508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916665c7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c2)) returned 1
	[0191.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.153] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.153] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.154] GetFileType (hFile=0x318) returned 0x1
	[0191.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.154] GetFileType (hFile=0x318) returned 0x1
	[0191.154] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1c2
	[0191.154] ReadFile (in: hFile=0x318, lpBuffer=0x2705b78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2705b78*, lpNumberOfBytesRead=0x540efcc*=0x1c2, lpOverlapped=0x0) returned 1
	[0191.155] CloseHandle (hObject=0x318) returned 1
	[0191.155] CryptDestroyKey (hKey=0x82b000) returned 1
	[0191.155] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.155] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2706c14, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0191.155] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.155] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.155] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0191.155] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.155] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2706ccc*=0x1, dwFlags=0x0) returned 1
	[0191.155] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2706c98, dwFlags=0x0) returned 1
	[0191.155] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2706cdc*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x2706cdc*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0191.155] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2706eb8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2706eb8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.155] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0191.155] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.155] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.155] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.156] WriteFile (in: hFile=0x318, lpBuffer=0x2707114*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2707114*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0191.158] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.164] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.164] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.165] GetFileType (hFile=0x318) returned 0x1
	[0191.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.165] GetFileType (hFile=0x318) returned 0x1
	[0191.165] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2bd
	[0191.165] ReadFile (in: hFile=0x318, lpBuffer=0x2708e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2708e68*, lpNumberOfBytesRead=0x540efcc*=0x2bd, lpOverlapped=0x0) returned 1
	[0191.166] CloseHandle (hObject=0x318) returned 1
	[0191.166] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.166] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.166] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2709f04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0191.166] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.166] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.167] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0191.167] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.167] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2709fbc*=0x1, dwFlags=0x0) returned 1
	[0191.167] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2709f88, dwFlags=0x0) returned 1
	[0191.167] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2709fcc*, pdwDataLen=0x540efd4*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x2709fcc*, pdwDataLen=0x540efd4*=0x2c0) returned 1
	[0191.167] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270a298*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x270a298*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.167] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.167] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.167] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.167] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.168] GetFileType (hFile=0x318) returned 0x1
	[0191.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.168] GetFileType (hFile=0x318) returned 0x1
	[0191.168] WriteFile (in: hFile=0x318, lpBuffer=0x270a4dc*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x270a4dc*, lpNumberOfBytesWritten=0x540ef94*=0x2c0, lpOverlapped=0x0) returned 1
	[0191.169] CloseHandle (hObject=0x318) returned 1
	[0191.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0191.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.170] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac47494f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0191.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.170] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.171] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.171] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x270bad0 | out: lpFileInformation=0x270bad0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90306b27, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90306b27, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90306b27, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0191.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.172] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.172] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.172] GetFileType (hFile=0x318) returned 0x1
	[0191.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.172] GetFileType (hFile=0x318) returned 0x1
	[0191.172] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c0
	[0191.172] ReadFile (in: hFile=0x318, lpBuffer=0x270c20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x270c20c*, lpNumberOfBytesRead=0x540efcc*=0x2c0, lpOverlapped=0x0) returned 1
	[0191.174] CloseHandle (hObject=0x318) returned 1
	[0191.174] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.174] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.174] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270d2a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0191.174] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.174] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.174] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0191.174] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.174] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x270d360*=0x1, dwFlags=0x0) returned 1
	[0191.174] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x270d32c, dwFlags=0x0) returned 1
	[0191.174] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270d370*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x270d370*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0191.175] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270d64c*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x270d64c*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.175] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.175] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.175] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.175] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.175] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.176] GetFileType (hFile=0x318) returned 0x1
	[0191.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.176] GetFileType (hFile=0x318) returned 0x1
	[0191.176] WriteFile (in: hFile=0x318, lpBuffer=0x270d890*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x270d890*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.177] CloseHandle (hObject=0x318) returned 1
	[0191.177] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.177] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0191.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.177] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90306b27, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90306b27, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac47494f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.178] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.179] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.179] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x270ee84 | out: lpFileInformation=0x270ee84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9168c833, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be)) returned 1
	[0191.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.180] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.180] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.180] GetFileType (hFile=0x318) returned 0x1
	[0191.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.180] GetFileType (hFile=0x318) returned 0x1
	[0191.180] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2be
	[0191.180] ReadFile (in: hFile=0x318, lpBuffer=0x270f5c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x270f5c0*, lpNumberOfBytesRead=0x540efcc*=0x2be, lpOverlapped=0x0) returned 1
	[0191.182] CloseHandle (hObject=0x318) returned 1
	[0191.182] CryptDestroyKey (hKey=0x82b440) returned 1
	[0191.182] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.182] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271065c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0191.182] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.182] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.182] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b040) returned 1
	[0191.182] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.182] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2710714*=0x1, dwFlags=0x0) returned 1
	[0191.182] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x27106e0, dwFlags=0x0) returned 1
	[0191.182] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2710724*, pdwDataLen=0x540efd4*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x2710724*, pdwDataLen=0x540efd4*=0x2c0) returned 1
	[0191.182] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27109f0*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x27109f0*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.183] CryptDestroyKey (hKey=0x82b040) returned 1
	[0191.183] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.183] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.183] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.183] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.184] GetFileType (hFile=0x318) returned 0x1
	[0191.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.184] GetFileType (hFile=0x318) returned 0x1
	[0191.184] WriteFile (in: hFile=0x318, lpBuffer=0x2710c34*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2710c34*, lpNumberOfBytesWritten=0x540ef94*=0x2c0, lpOverlapped=0x0) returned 1
	[0191.185] CloseHandle (hObject=0x318) returned 1
	[0191.186] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.186] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0191.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.186] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac49ac3e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0191.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.186] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.187] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0191.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.187] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2712228 | out: lpFileInformation=0x2712228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9168c833, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1)) returned 1
	[0191.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.188] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0191.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.188] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.188] GetFileType (hFile=0x318) returned 0x1
	[0191.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.188] GetFileType (hFile=0x318) returned 0x1
	[0191.188] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c1
	[0191.188] ReadFile (in: hFile=0x318, lpBuffer=0x2712978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2712978*, lpNumberOfBytesRead=0x540efcc*=0x2c1, lpOverlapped=0x0) returned 1
	[0191.189] CloseHandle (hObject=0x318) returned 1
	[0191.189] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.190] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.190] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2713a14, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b440) returned 1
	[0191.190] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.190] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.190] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b1c0) returned 1
	[0191.190] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.190] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2713acc*=0x1, dwFlags=0x0) returned 1
	[0191.190] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2713a98, dwFlags=0x0) returned 1
	[0191.190] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2713adc*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2713adc*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0191.190] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2713db8*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2713db8*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.190] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.190] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.190] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.190] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0191.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.190] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.191] GetFileType (hFile=0x318) returned 0x1
	[0191.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.191] GetFileType (hFile=0x318) returned 0x1
	[0191.192] WriteFile (in: hFile=0x318, lpBuffer=0x2714004*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2714004*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.192] CloseHandle (hObject=0x318) returned 1
	[0191.192] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0191.193] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0191.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.193] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac49ac3e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.193] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.194] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0191.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.194] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2715608 | out: lpFileInformation=0x2715608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9168c833, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2)) returned 1
	[0191.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.194] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0191.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.195] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.195] GetFileType (hFile=0x318) returned 0x1
	[0191.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.195] GetFileType (hFile=0x318) returned 0x1
	[0191.195] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c2
	[0191.195] ReadFile (in: hFile=0x318, lpBuffer=0x2715d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2715d58*, lpNumberOfBytesRead=0x540efcc*=0x2c2, lpOverlapped=0x0) returned 1
	[0191.196] CloseHandle (hObject=0x318) returned 1
	[0191.196] CryptDestroyKey (hKey=0x82b440) returned 1
	[0191.196] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.196] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2716df4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b6c0) returned 1
	[0191.196] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.196] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.196] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0191.196] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.196] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2716eac*=0x1, dwFlags=0x0) returned 1
	[0191.196] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2716e78, dwFlags=0x0) returned 1
	[0191.197] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2716ebc*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2716ebc*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0191.197] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2717198*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2717198*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.197] CryptDestroyKey (hKey=0x82b400) returned 1
	[0191.197] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.197] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.197] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0191.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.197] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.221] GetFileType (hFile=0x318) returned 0x1
	[0191.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.221] GetFileType (hFile=0x318) returned 0x1
	[0191.221] WriteFile (in: hFile=0x318, lpBuffer=0x27173e4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27173e4*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.222] CloseHandle (hObject=0x318) returned 1
	[0191.222] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0191.222] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0191.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.223] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac4e714b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.223] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.224] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27189e8 | out: lpFileInformation=0x27189e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916b2a9b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf)) returned 1
	[0191.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.224] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.225] GetFileType (hFile=0x318) returned 0x1
	[0191.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.225] GetFileType (hFile=0x318) returned 0x1
	[0191.225] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2bf
	[0191.225] ReadFile (in: hFile=0x318, lpBuffer=0x2719124, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2719124*, lpNumberOfBytesRead=0x540efcc*=0x2bf, lpOverlapped=0x0) returned 1
	[0191.226] CloseHandle (hObject=0x318) returned 1
	[0191.226] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.226] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.226] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271a1c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0191.226] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.226] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.227] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0191.227] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.227] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x271a278*=0x1, dwFlags=0x0) returned 1
	[0191.227] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x271a244, dwFlags=0x0) returned 1
	[0191.227] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271a288*, pdwDataLen=0x540efd4*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x271a288*, pdwDataLen=0x540efd4*=0x2c0) returned 1
	[0191.227] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271a554*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271a554*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.227] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.227] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.227] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.227] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.227] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.228] GetFileType (hFile=0x318) returned 0x1
	[0191.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.229] GetFileType (hFile=0x318) returned 0x1
	[0191.229] WriteFile (in: hFile=0x318, lpBuffer=0x271a798*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x271a798*, lpNumberOfBytesWritten=0x540ef94*=0x2c0, lpOverlapped=0x0) returned 1
	[0191.230] CloseHandle (hObject=0x318) returned 1
	[0191.230] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.230] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0191.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.230] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac50d23f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0191.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.230] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.231] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0191.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.231] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x271bd8c | out: lpFileInformation=0x271bd8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916b2a9b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0191.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.232] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0191.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.232] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.232] GetFileType (hFile=0x318) returned 0x1
	[0191.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.232] GetFileType (hFile=0x318) returned 0x1
	[0191.232] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c9
	[0191.232] ReadFile (in: hFile=0x318, lpBuffer=0x271c504, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271c504*, lpNumberOfBytesRead=0x540efcc*=0x2c9, lpOverlapped=0x0) returned 1
	[0191.234] CloseHandle (hObject=0x318) returned 1
	[0191.234] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.234] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.234] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271d5a0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0191.234] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.234] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.234] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82afc0) returned 1
	[0191.234] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.234] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x271d658*=0x1, dwFlags=0x0) returned 1
	[0191.234] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x271d624, dwFlags=0x0) returned 1
	[0191.234] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271d668*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x271d668*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0191.234] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271d944*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x271d944*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.234] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.234] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.234] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.234] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0191.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.234] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.235] GetFileType (hFile=0x318) returned 0x1
	[0191.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.236] GetFileType (hFile=0x318) returned 0x1
	[0191.236] WriteFile (in: hFile=0x318, lpBuffer=0x271dba0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x271dba0*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.236] CloseHandle (hObject=0x318) returned 1
	[0191.237] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0191.237] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0191.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.237] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac50d23f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.237] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.238] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0191.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.238] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x271f1b8 | out: lpFileInformation=0x271f1b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916b2a9b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0191.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.238] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0191.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.238] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.238] GetFileType (hFile=0x318) returned 0x1
	[0191.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.239] GetFileType (hFile=0x318) returned 0x1
	[0191.239] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x2c0
	[0191.239] ReadFile (in: hFile=0x318, lpBuffer=0x271f924, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x271f924*, lpNumberOfBytesRead=0x540efcc*=0x2c0, lpOverlapped=0x0) returned 1
	[0191.240] CloseHandle (hObject=0x318) returned 1
	[0191.240] CryptDestroyKey (hKey=0x82b540) returned 1
	[0191.240] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.240] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27209c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82afc0) returned 1
	[0191.240] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.240] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.240] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b4c0) returned 1
	[0191.240] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.240] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2720a78*=0x1, dwFlags=0x0) returned 1
	[0191.240] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2720a44, dwFlags=0x0) returned 1
	[0191.240] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2720a88*, pdwDataLen=0x540efd4*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2720a88*, pdwDataLen=0x540efd4*=0x2d0) returned 1
	[0191.240] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2720d64*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2720d64*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.241] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0191.241] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.241] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.241] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0191.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.241] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.242] GetFileType (hFile=0x318) returned 0x1
	[0191.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.242] GetFileType (hFile=0x318) returned 0x1
	[0191.242] WriteFile (in: hFile=0x318, lpBuffer=0x2720fc0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x2720fc0*, lpNumberOfBytesWritten=0x540ef94*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.243] CloseHandle (hObject=0x318) returned 1
	[0191.243] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0191.243] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0191.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.243] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac50d23f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.244] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.245] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27225d8 | out: lpFileInformation=0x27225d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916b2a9b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb)) returned 1
	[0191.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.245] ReadFile (in: hFile=0x318, lpBuffer=0x2722c50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2722c50*, lpNumberOfBytesRead=0x540efcc*=0x1cb, lpOverlapped=0x0) returned 1
	[0191.246] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.246] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.246] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2723cec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b1c0) returned 1
	[0191.246] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.246] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.246] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b6c0) returned 1
	[0191.246] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.246] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2723da4*=0x1, dwFlags=0x0) returned 1
	[0191.246] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2723d70, dwFlags=0x0) returned 1
	[0191.246] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2723db4*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x2723db4*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0191.246] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2723f90*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2723f90*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.246] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.246] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.247] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.247] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.247] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.248] GetFileType (hFile=0x318) returned 0x1
	[0191.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.248] GetFileType (hFile=0x318) returned 0x1
	[0191.248] WriteFile (in: hFile=0x318, lpBuffer=0x27241ec*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x27241ec*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0191.249] CloseHandle (hObject=0x318) returned 1
	[0191.249] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.249] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0191.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.250] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac53a02f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0191.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.250] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.252] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.252] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2725804 | out: lpFileInformation=0x2725804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916b2a9b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c0)) returned 1
	[0191.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.252] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef24) returned 1
	[0191.252] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.252] GetFileType (hFile=0x318) returned 0x1
	[0191.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef20) returned 1
	[0191.253] GetFileType (hFile=0x318) returned 0x1
	[0191.253] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x540f020 | out: lpFileSizeHigh=0x540f020*=0x0) returned 0x1c0
	[0191.253] ReadFile (in: hFile=0x318, lpBuffer=0x2725df0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x540efcc, lpOverlapped=0x0 | out: lpBuffer=0x2725df0*, lpNumberOfBytesRead=0x540efcc*=0x1c0, lpOverlapped=0x0) returned 1
	[0191.254] CloseHandle (hObject=0x318) returned 1
	[0191.254] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.254] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.254] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2726e8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x540ef78 | out: phKey=0x540ef78*=0x82b540) returned 1
	[0191.254] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.254] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.254] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x540ef68 | out: phKey=0x540ef68*=0x82b400) returned 1
	[0191.254] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.254] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2726f44*=0x1, dwFlags=0x0) returned 1
	[0191.254] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2726f10, dwFlags=0x0) returned 1
	[0191.254] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2726f54*, pdwDataLen=0x540efd4*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x2726f54*, pdwDataLen=0x540efd4*=0x1d0) returned 1
	[0191.254] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2727130*, pdwDataLen=0x540efdc*=0x0, dwBufLen=0x10 | out: pbData=0x2727130*, pdwDataLen=0x540efdc*=0x10) returned 1
	[0191.254] CryptDestroyKey (hKey=0x82b400) returned 1
	[0191.254] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.254] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.254] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540ef10) returned 1
	[0191.254] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.255] GetFileType (hFile=0x318) returned 0x1
	[0191.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540ef0c) returned 1
	[0191.256] GetFileType (hFile=0x318) returned 0x1
	[0191.256] WriteFile (in: hFile=0x318, lpBuffer=0x272734c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x540ef94, lpOverlapped=0x0 | out: lpBuffer=0x272734c*, lpNumberOfBytesWritten=0x540ef94*=0x1d0, lpOverlapped=0x0) returned 1
	[0191.256] CloseHandle (hObject=0x318) returned 1
	[0191.256] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.256] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x540eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0191.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540efa4) returned 1
	[0191.257] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x540f020 | out: lpFileInformation=0x540f020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac53a02f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0191.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540efa0) returned 1
	[0191.257] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.279] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x540e9c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x540eec0) returned 1
	[0191.279] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27288f0 | out: lpFileInformation=0x27288f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916b2a9b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0191.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x540eebc) returned 1
	[0191.318] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.433] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.490] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.545] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.604] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0

Thread:
	id = 14
	os_tid = 0x798


Thread:
	id = 15
	os_tid = 0xf44

	[0078.426] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0078.427] CoGetContextToken (in: pToken=0x55cf714 | out: pToken=0x55cf714) returned 0x0
	[0078.427] CObjectContext::QueryInterface () returned 0x0
	[0078.427] CObjectContext::GetCurrentThreadType () returned 0x0
	[0078.427] Release () returned 0x0
	[0078.427] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1
	[0078.427] CoUninitialize () 
	[0078.427] RoInitialize () returned 0x1
	[0078.427] RoUninitialize () returned 0x0
	[0078.427] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.437] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.451] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.507] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.507] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.511] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.511] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.519] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.520] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.520] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.520] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.520] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.520] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.521] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.521] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.521] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.521] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.521] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.521] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.526] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.526] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.526] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.526] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.526] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0078.527] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0079.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0079.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0079.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0079.698] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0079.870] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0080.074] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0080.198] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0080.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0080.464] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0080.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0080.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0080.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0080.948] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0081.133] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0081.262] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0081.554] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0081.705] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0082.058] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0082.281] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0082.456] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0082.652] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0082.875] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0082.925] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0083.069] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0083.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0083.233] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0083.463] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0083.596] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0083.753] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0083.846] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0083.950] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0084.081] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0084.165] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0084.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0084.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0084.456] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0084.654] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0084.792] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0085.077] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0085.190] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0085.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0085.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0085.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0085.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0085.909] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0086.130] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0086.196] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0086.302] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0086.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0086.421] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0086.551] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0097.868] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0097.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0097.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0097.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0097.886] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0097.914] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0097.951] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0097.959] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0097.998] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.094] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.117] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.150] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.169] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.185] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.185] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.201] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.243] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.281] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.326] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.421] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.464] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.698] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.776] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.855] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0098.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.011] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.530] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.551] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.551] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.551] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.551] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.553] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.553] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.559] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.559] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.598] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.614] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.616] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.624] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.629] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.642] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.642] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.643] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.646] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.666] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.681] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.682] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.682] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.682] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.682] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.682] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0099.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0104.484] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0104.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0104.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0104.692] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0104.751] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Setup.exe", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Setup.exe", lpFilePart=0x0) returned 0x1f
	[0104.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0104.751] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0104.751] GetFileType (hFile=0x41c) returned 0x1
	[0104.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0104.751] GetFileType (hFile=0x41c) returned 0x1
	[0104.751] GetFileSize (in: hFile=0x41c, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x13148
	[0104.751] ReadFile (in: hFile=0x41c, lpBuffer=0x25d3e84, nNumberOfBytesToRead=0x13148, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x25d3e84*, lpNumberOfBytesRead=0x55cf1fc*=0x13148, lpOverlapped=0x0) returned 1
	[0104.784] CloseHandle (hObject=0x41c) returned 1
	[0104.784] CryptDestroyKey (hKey=0x82b480) returned 1
	[0104.784] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.785] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25e7068, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0104.785] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.785] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.785] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0104.785] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.785] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x25e7120*=0x1, dwFlags=0x0) returned 1
	[0104.785] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x25e70ec, dwFlags=0x0) returned 1
	[0104.785] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x25e7130*, pdwDataLen=0x55cf204*=0x13150, dwBufLen=0x13150 | out: pbData=0x25e7130*, pdwDataLen=0x55cf204*=0x13150) returned 1
	[0104.785] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25fa28c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x25fa28c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0104.785] CryptDestroyKey (hKey=0x82b080) returned 1
	[0104.785] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.785] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.785] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Setup.exe", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Setup.exe", lpFilePart=0x0) returned 0x1f
	[0104.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0104.785] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0104.787] GetFileType (hFile=0x41c) returned 0x1
	[0104.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0104.787] GetFileType (hFile=0x41c) returned 0x1
	[0104.787] WriteFile (in: hFile=0x41c, lpBuffer=0x25e7130*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x25e7130*, lpNumberOfBytesWritten=0x55cf1f0*=0x13150, lpOverlapped=0x0) returned 1
	[0104.789] CloseHandle (hObject=0x41c) returned 1
	[0104.789] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Setup.exe", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Setup.exe", lpFilePart=0x0) returned 0x1f
	[0104.789] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Setup.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Setup.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x4e
	[0104.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0104.789] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x78c94a64, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13150)) returned 1
	[0104.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0104.789] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), lpNewFileName="C:\\588bce7c90097ed212\\Setup.exe id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\setup.exe id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0104.790] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupEngine.dll", lpFilePart=0x0) returned 0x25
	[0104.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0104.790] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), fInfoLevelId=0x0, lpFileInformation=0x25fa588 | out: lpFileInformation=0x25fa588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158)) returned 1
	[0104.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0104.800] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupEngine.dll", lpFilePart=0x0) returned 0x25
	[0104.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0104.801] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0104.801] GetFileType (hFile=0x41c) returned 0x1
	[0104.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0104.801] GetFileType (hFile=0x41c) returned 0x1
	[0104.801] GetFileSize (in: hFile=0x41c, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xc5158
	[0104.803] ReadFile (in: hFile=0x41c, lpBuffer=0x37f2ba8, nNumberOfBytesToRead=0xc5158, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x37f2ba8*, lpNumberOfBytesRead=0x55cf1fc*=0xc5158, lpOverlapped=0x0) returned 1
	[0104.827] CloseHandle (hObject=0x41c) returned 1
	[0104.827] CryptDestroyKey (hKey=0x82b540) returned 1
	[0104.827] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.827] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26056cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0104.827] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.827] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.827] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b0c0) returned 1
	[0104.827] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.827] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x2605784*=0x1, dwFlags=0x0) returned 1
	[0104.827] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x2605750, dwFlags=0x0) returned 1
	[0104.836] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38b7d20*, pdwDataLen=0x55cf204*=0xc5160, dwBufLen=0xc5160 | out: pbData=0x38b7d20*, pdwDataLen=0x55cf204*=0xc5160) returned 1
	[0104.837] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2605794*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2605794*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0104.837] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0104.837] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.837] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.837] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupEngine.dll", lpFilePart=0x0) returned 0x25
	[0104.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0104.837] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0104.905] GetFileType (hFile=0x41c) returned 0x1
	[0104.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0104.905] GetFileType (hFile=0x41c) returned 0x1
	[0104.905] WriteFile (in: hFile=0x41c, lpBuffer=0x38b7d20*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x38b7d20*, lpNumberOfBytesWritten=0x55cf1f0*=0xc5160, lpOverlapped=0x0) returned 1
	[0104.933] CloseHandle (hObject=0x41c) returned 1
	[0104.933] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupEngine.dll", lpFilePart=0x0) returned 0x25
	[0104.933] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupEngine.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x54
	[0104.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0104.934] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x78e12282, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xc5160)) returned 1
	[0104.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0104.934] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), lpNewFileName="C:\\588bce7c90097ed212\\SetupEngine.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0104.935] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUi.dll", lpFilePart=0x0) returned 0x21
	[0104.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0104.935] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), fInfoLevelId=0x0, lpFileInformation=0x2612428 | out: lpFileInformation=0x2612428*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150)) returned 1
	[0104.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0104.936] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUi.dll", lpFilePart=0x0) returned 0x21
	[0104.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0104.936] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0104.936] GetFileType (hFile=0x41c) returned 0x1
	[0104.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0104.936] GetFileType (hFile=0x41c) returned 0x1
	[0104.936] GetFileSize (in: hFile=0x41c, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x48150
	[0104.937] ReadFile (in: hFile=0x41c, lpBuffer=0x397cea0, nNumberOfBytesToRead=0x48150, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x397cea0*, lpNumberOfBytesRead=0x55cf1fc*=0x48150, lpOverlapped=0x0) returned 1
	[0104.954] CloseHandle (hObject=0x41c) returned 1
	[0104.954] CryptDestroyKey (hKey=0x82b340) returned 1
	[0104.954] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.954] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26197bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0104.954] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.954] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.954] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0104.954] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0104.955] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2619874*=0x1, dwFlags=0x0) returned 1
	[0104.955] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2619840, dwFlags=0x0) returned 1
	[0104.957] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39c5010*, pdwDataLen=0x55cf204*=0x48160, dwBufLen=0x48160 | out: pbData=0x39c5010*, pdwDataLen=0x55cf204*=0x48160) returned 1
	[0104.957] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2619884*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2619884*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0104.957] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0104.957] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.957] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0104.957] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUi.dll", lpFilePart=0x0) returned 0x21
	[0104.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0104.957] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0104.979] GetFileType (hFile=0x5dc) returned 0x1
	[0104.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0104.979] GetFileType (hFile=0x5dc) returned 0x1
	[0104.979] WriteFile (in: hFile=0x5dc, lpBuffer=0x39c5010*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x39c5010*, lpNumberOfBytesWritten=0x55cf1f0*=0x48160, lpOverlapped=0x0) returned 1
	[0104.984] CloseHandle (hObject=0x5dc) returned 1
	[0104.985] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUi.dll", lpFilePart=0x0) returned 0x21
	[0104.985] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUi.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x50
	[0104.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0104.985] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x78e84899, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x48160)) returned 1
	[0104.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0104.985] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), lpNewFileName="C:\\588bce7c90097ed212\\SetupUi.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\setupui.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0104.986] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUi.xsd", lpFilePart=0x0) returned 0x21
	[0104.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0104.986] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), fInfoLevelId=0x0, lpFileInformation=0x262e930 | out: lpFileInformation=0x262e930*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8)) returned 1
	[0104.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0104.986] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUi.xsd", lpFilePart=0x0) returned 0x21
	[0104.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0104.987] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0104.987] GetFileType (hFile=0x5dc) returned 0x1
	[0104.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0104.987] GetFileType (hFile=0x5dc) returned 0x1
	[0104.987] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x75a8
	[0104.987] ReadFile (in: hFile=0x5dc, lpBuffer=0x262eaf0, nNumberOfBytesToRead=0x75a8, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x262eaf0*, lpNumberOfBytesRead=0x55cf1fc*=0x75a8, lpOverlapped=0x0) returned 1
	[0105.012] CloseHandle (hObject=0x5dc) returned 1
	[0105.012] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0105.012] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.012] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2647adc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0105.013] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.013] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.013] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0105.013] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.013] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2647b94*=0x1, dwFlags=0x0) returned 1
	[0105.013] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2647b60, dwFlags=0x0) returned 1
	[0105.013] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2647ba4*, pdwDataLen=0x55cf204*=0x75b0, dwBufLen=0x75b0 | out: pbData=0x2647ba4*, pdwDataLen=0x55cf204*=0x75b0) returned 1
	[0105.013] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264f160*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x264f160*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0105.013] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0105.013] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.013] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.013] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUi.xsd", lpFilePart=0x0) returned 0x21
	[0105.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0105.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.015] GetFileType (hFile=0x5dc) returned 0x1
	[0105.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0105.015] GetFileType (hFile=0x5dc) returned 0x1
	[0105.015] WriteFile (in: hFile=0x5dc, lpBuffer=0x2647ba4*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2647ba4*, lpNumberOfBytesWritten=0x55cf1f0*=0x75b0, lpOverlapped=0x0) returned 1
	[0105.016] CloseHandle (hObject=0x5dc) returned 1
	[0105.016] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUi.xsd", lpFilePart=0x0) returned 0x21
	[0105.016] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUi.xsd id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x50
	[0105.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0105.017] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x78ed0d7c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x75b0)) returned 1
	[0105.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0105.017] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), lpNewFileName="C:\\588bce7c90097ed212\\SetupUi.xsd id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0105.017] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUtility.exe", lpFilePart=0x0) returned 0x26
	[0105.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0105.018] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), fInfoLevelId=0x0, lpFileInformation=0x264f474 | out: lpFileInformation=0x264f474*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758)) returned 1
	[0105.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0105.018] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUtility.exe", lpFilePart=0x0) returned 0x26
	[0105.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0105.018] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.018] GetFileType (hFile=0x5dc) returned 0x1
	[0105.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0105.018] GetFileType (hFile=0x5dc) returned 0x1
	[0105.018] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x17758
	[0105.019] ReadFile (in: hFile=0x5dc, lpBuffer=0x3a0d190, nNumberOfBytesToRead=0x17758, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d190*, lpNumberOfBytesRead=0x55cf1fc*=0x17758, lpOverlapped=0x0) returned 1
	[0105.082] CloseHandle (hObject=0x5dc) returned 1
	[0105.082] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0105.082] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.082] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2684328, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0105.082] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.082] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.082] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0105.082] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.082] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26843e0*=0x1, dwFlags=0x0) returned 1
	[0105.082] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26843ac, dwFlags=0x0) returned 1
	[0105.083] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a24908*, pdwDataLen=0x55cf204*=0x17760, dwBufLen=0x17760 | out: pbData=0x3a24908*, pdwDataLen=0x55cf204*=0x17760) returned 1
	[0105.083] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26843f0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26843f0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0105.083] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0105.083] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.083] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.083] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUtility.exe", lpFilePart=0x0) returned 0x26
	[0105.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0105.084] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.085] GetFileType (hFile=0x5dc) returned 0x1
	[0105.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0105.085] GetFileType (hFile=0x5dc) returned 0x1
	[0105.085] WriteFile (in: hFile=0x5dc, lpBuffer=0x3a24908*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x3a24908*, lpNumberOfBytesWritten=0x55cf1f0*=0x17760, lpOverlapped=0x0) returned 1
	[0105.087] CloseHandle (hObject=0x5dc) returned 1
	[0105.087] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUtility.exe", lpFilePart=0x0) returned 0x26
	[0105.087] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SetupUtility.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0105.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0105.087] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x78f696fa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x17760)) returned 1
	[0105.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0105.088] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), lpNewFileName="C:\\588bce7c90097ed212\\SetupUtility.exe id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0105.088] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SplashScreen.bmp", lpFilePart=0x0) returned 0x26
	[0105.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0105.088] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2684740 | out: lpFileInformation=0x2684740*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078)) returned 1
	[0105.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0105.089] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SplashScreen.bmp", lpFilePart=0x0) returned 0x26
	[0105.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0105.089] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.089] GetFileType (hFile=0x5dc) returned 0x1
	[0105.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0105.089] GetFileType (hFile=0x5dc) returned 0x1
	[0105.089] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xa078
	[0105.089] ReadFile (in: hFile=0x5dc, lpBuffer=0x2684930, nNumberOfBytesToRead=0xa078, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2684930*, lpNumberOfBytesRead=0x55cf1fc*=0xa078, lpOverlapped=0x0) returned 1
	[0105.108] CloseHandle (hObject=0x5dc) returned 1
	[0105.108] CryptDestroyKey (hKey=0x82b280) returned 1
	[0105.108] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.108] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26aea4c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0105.108] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.108] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.108] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0105.108] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.108] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26aeb04*=0x1, dwFlags=0x0) returned 1
	[0105.108] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26aead0, dwFlags=0x0) returned 1
	[0105.108] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26aeb14*, pdwDataLen=0x55cf204*=0xa080, dwBufLen=0xa080 | out: pbData=0x26aeb14*, pdwDataLen=0x55cf204*=0xa080) returned 1
	[0105.108] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b8ba0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26b8ba0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0105.108] CryptDestroyKey (hKey=0x82b280) returned 1
	[0105.108] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.108] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.108] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SplashScreen.bmp", lpFilePart=0x0) returned 0x26
	[0105.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0105.108] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.109] GetFileType (hFile=0x5dc) returned 0x1
	[0105.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0105.110] GetFileType (hFile=0x5dc) returned 0x1
	[0105.110] WriteFile (in: hFile=0x5dc, lpBuffer=0x26aeb14*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26aeb14*, lpNumberOfBytesWritten=0x55cf1f0*=0xa080, lpOverlapped=0x0) returned 1
	[0105.111] CloseHandle (hObject=0x5dc) returned 1
	[0105.111] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SplashScreen.bmp", lpFilePart=0x0) returned 0x26
	[0105.111] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SplashScreen.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0105.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0105.111] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x78fb5acd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xa080)) returned 1
	[0105.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0105.111] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0105.112] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\sqmapi.dll", lpFilePart=0x0) returned 0x20
	[0105.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0105.112] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), fInfoLevelId=0x0, lpFileInformation=0x26b8ef0 | out: lpFileInformation=0x26b8ef0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420)) returned 1
	[0105.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0105.112] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\sqmapi.dll", lpFilePart=0x0) returned 0x20
	[0105.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0105.112] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.113] GetFileType (hFile=0x5dc) returned 0x1
	[0105.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0105.113] GetFileType (hFile=0x5dc) returned 0x1
	[0105.113] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x23420
	[0105.113] ReadFile (in: hFile=0x5dc, lpBuffer=0x3a3c088, nNumberOfBytesToRead=0x23420, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x3a3c088*, lpNumberOfBytesRead=0x55cf1fc*=0x23420, lpOverlapped=0x0) returned 1
	[0105.135] CloseHandle (hObject=0x5dc) returned 1
	[0105.135] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0105.135] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.135] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e1ff8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0105.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.135] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b0c0) returned 1
	[0105.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.135] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26e20b0*=0x1, dwFlags=0x0) returned 1
	[0105.135] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x26e207c, dwFlags=0x0) returned 1
	[0105.136] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a5f4c8*, pdwDataLen=0x55cf204*=0x23430, dwBufLen=0x23430 | out: pbData=0x3a5f4c8*, pdwDataLen=0x55cf204*=0x23430) returned 1
	[0105.136] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e20c0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26e20c0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0105.136] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0105.137] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.137] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.137] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\sqmapi.dll", lpFilePart=0x0) returned 0x20
	[0105.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0105.137] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.138] GetFileType (hFile=0x5dc) returned 0x1
	[0105.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0105.138] GetFileType (hFile=0x5dc) returned 0x1
	[0105.138] WriteFile (in: hFile=0x5dc, lpBuffer=0x3a5f4c8*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x3a5f4c8*, lpNumberOfBytesWritten=0x55cf1f0*=0x23430, lpOverlapped=0x0) returned 1
	[0105.141] CloseHandle (hObject=0x5dc) returned 1
	[0105.141] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\sqmapi.dll", lpFilePart=0x0) returned 0x20
	[0105.141] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\sqmapi.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x4f
	[0105.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0105.141] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x790020ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x23430)) returned 1
	[0105.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0105.141] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), lpNewFileName="C:\\588bce7c90097ed212\\sqmapi.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0105.142] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Strings.xml", lpFilePart=0x0) returned 0x21
	[0105.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0105.142] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), fInfoLevelId=0x0, lpFileInformation=0x26e23c8 | out: lpFileInformation=0x26e23c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704)) returned 1
	[0105.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0105.142] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Strings.xml", lpFilePart=0x0) returned 0x21
	[0105.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0105.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.142] GetFileType (hFile=0x5dc) returned 0x1
	[0105.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0105.142] GetFileType (hFile=0x5dc) returned 0x1
	[0105.142] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x3704
	[0105.142] ReadFile (in: hFile=0x5dc, lpBuffer=0x26e2588, nNumberOfBytesToRead=0x3704, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26e2588*, lpNumberOfBytesRead=0x55cf1fc*=0x3704, lpOverlapped=0x0) returned 1
	[0105.152] CloseHandle (hObject=0x5dc) returned 1
	[0105.152] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0105.152] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.152] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f4ab8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0105.152] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.152] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.157] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0105.157] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.157] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26f4b70*=0x1, dwFlags=0x0) returned 1
	[0105.157] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26f4b3c, dwFlags=0x0) returned 1
	[0105.157] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f4b80*, pdwDataLen=0x55cf204*=0x3710, dwBufLen=0x3710 | out: pbData=0x26f4b80*, pdwDataLen=0x55cf204*=0x3710) returned 1
	[0105.157] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f829c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26f829c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0105.157] CryptDestroyKey (hKey=0x82b300) returned 1
	[0105.157] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.158] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.158] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Strings.xml", lpFilePart=0x0) returned 0x21
	[0105.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0105.158] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.159] GetFileType (hFile=0x5dc) returned 0x1
	[0105.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0105.159] GetFileType (hFile=0x5dc) returned 0x1
	[0105.159] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f4b80*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26f4b80*, lpNumberOfBytesWritten=0x55cf1f0*=0x3710, lpOverlapped=0x0) returned 1
	[0105.160] CloseHandle (hObject=0x5dc) returned 1
	[0105.160] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Strings.xml", lpFilePart=0x0) returned 0x21
	[0105.160] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Strings.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x50
	[0105.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0105.160] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x790282ef, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3710)) returned 1
	[0105.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0105.160] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Strings.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\strings.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0105.161] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\UiInfo.xml", lpFilePart=0x0) returned 0x20
	[0105.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0105.161] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x26f85b0 | out: lpFileInformation=0x26f85b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2)) returned 1
	[0105.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0105.161] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\UiInfo.xml", lpFilePart=0x0) returned 0x20
	[0105.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0105.161] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.161] GetFileType (hFile=0x5dc) returned 0x1
	[0105.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0105.161] GetFileType (hFile=0x5dc) returned 0x1
	[0105.161] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x97f2
	[0105.161] ReadFile (in: hFile=0x5dc, lpBuffer=0x26f8770, nNumberOfBytesToRead=0x97f2, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26f8770*, lpNumberOfBytesRead=0x55cf1fc*=0x97f2, lpOverlapped=0x0) returned 1
	[0105.174] CloseHandle (hObject=0x5dc) returned 1
	[0105.174] CryptDestroyKey (hKey=0x82b540) returned 1
	[0105.174] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.174] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271af24, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0105.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.175] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0105.175] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.175] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x271afdc*=0x1, dwFlags=0x0) returned 1
	[0105.175] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x271afa8, dwFlags=0x0) returned 1
	[0105.175] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271afec*, pdwDataLen=0x55cf204*=0x9800, dwBufLen=0x9800 | out: pbData=0x271afec*, pdwDataLen=0x55cf204*=0x9800) returned 1
	[0105.175] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27247f8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27247f8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0105.175] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0105.175] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.175] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.175] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\UiInfo.xml", lpFilePart=0x0) returned 0x20
	[0105.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0105.175] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.176] GetFileType (hFile=0x5dc) returned 0x1
	[0105.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0105.176] GetFileType (hFile=0x5dc) returned 0x1
	[0105.177] WriteFile (in: hFile=0x5dc, lpBuffer=0x271afec*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x271afec*, lpNumberOfBytesWritten=0x55cf1f0*=0x9800, lpOverlapped=0x0) returned 1
	[0105.178] CloseHandle (hObject=0x5dc) returned 1
	[0105.178] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\UiInfo.xml", lpFilePart=0x0) returned 0x20
	[0105.178] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\UiInfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x4f
	[0105.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0105.178] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x7904e511, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9800)) returned 1
	[0105.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0105.179] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\UiInfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0105.179] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\watermark.bmp", lpFilePart=0x0) returned 0x23
	[0105.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0105.179] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2724b00 | out: lpFileInformation=0x2724b00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688)) returned 1
	[0105.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0105.179] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\watermark.bmp", lpFilePart=0x0) returned 0x23
	[0105.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0105.180] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.180] GetFileType (hFile=0x5dc) returned 0x1
	[0105.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0105.180] GetFileType (hFile=0x5dc) returned 0x1
	[0105.180] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x19688
	[0105.180] ReadFile (in: hFile=0x5dc, lpBuffer=0x3a82918, nNumberOfBytesToRead=0x19688, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x3a82918*, lpNumberOfBytesRead=0x55cf1fc*=0x19688, lpOverlapped=0x0) returned 1
	[0105.196] CloseHandle (hObject=0x5dc) returned 1
	[0105.196] CryptDestroyKey (hKey=0x82b380) returned 1
	[0105.196] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.196] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2730008, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0105.196] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.196] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.196] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b0c0) returned 1
	[0105.196] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.196] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27300c0*=0x1, dwFlags=0x0) returned 1
	[0105.197] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x273008c, dwFlags=0x0) returned 1
	[0105.198] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a9bfc0*, pdwDataLen=0x55cf204*=0x19690, dwBufLen=0x19690 | out: pbData=0x3a9bfc0*, pdwDataLen=0x55cf204*=0x19690) returned 1
	[0105.198] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27300d0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27300d0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0105.198] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0105.198] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.198] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.198] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\watermark.bmp", lpFilePart=0x0) returned 0x23
	[0105.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0105.198] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.200] GetFileType (hFile=0x5dc) returned 0x1
	[0105.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0105.200] GetFileType (hFile=0x5dc) returned 0x1
	[0105.200] WriteFile (in: hFile=0x5dc, lpBuffer=0x3a9bfc0*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x3a9bfc0*, lpNumberOfBytesWritten=0x55cf1f0*=0x19690, lpOverlapped=0x0) returned 1
	[0105.202] CloseHandle (hObject=0x5dc) returned 1
	[0105.202] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\watermark.bmp", lpFilePart=0x0) returned 0x23
	[0105.202] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\watermark.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0105.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0105.202] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x7909a8b6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x19690)) returned 1
	[0105.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0105.203] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\watermark.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0105.203] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", lpFilePart=0x0) returned 0x37
	[0105.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0105.203] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), fInfoLevelId=0x0, lpFileInformation=0x27303fc | out: lpFileInformation=0x27303fc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113)) returned 1
	[0105.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0105.207] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", lpFilePart=0x0) returned 0x37
	[0105.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0105.207] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.207] GetFileType (hFile=0x5dc) returned 0x1
	[0105.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0105.207] GetFileType (hFile=0x5dc) returned 0x1
	[0105.207] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x4f5113
	[0105.218] ReadFile (in: hFile=0x5dc, lpBuffer=0x3ab5670, nNumberOfBytesToRead=0x4f5113, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x3ab5670*, lpNumberOfBytesRead=0x55cf1fc*=0x4f5113, lpOverlapped=0x0) returned 1
	[0105.514] CloseHandle (hObject=0x5dc) returned 1
	[0105.514] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0105.514] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.514] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27bcb80, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0105.514] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.514] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.514] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0105.514] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0105.514] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27bcc38*=0x1, dwFlags=0x0) returned 1
	[0105.514] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27bcc04, dwFlags=0x0) returned 1
	[0105.592] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x91d3300*, pdwDataLen=0x55cf204*=0x4f5120, dwBufLen=0x4f5120 | out: pbData=0x91d3300*, pdwDataLen=0x55cf204*=0x4f5120) returned 1
	[0105.596] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f4378*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27f4378*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0105.596] CryptDestroyKey (hKey=0x82b380) returned 1
	[0105.596] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.596] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0105.596] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", lpFilePart=0x0) returned 0x37
	[0105.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0105.596] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0105.604] GetFileType (hFile=0x5dc) returned 0x1
	[0105.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0105.604] GetFileType (hFile=0x5dc) returned 0x1
	[0105.604] WriteFile (in: hFile=0x5dc, lpBuffer=0x91d3300*, nNumberOfBytesToWrite=0x4f5120, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x91d3300*, lpNumberOfBytesWritten=0x55cf1f0*=0x4f5120, lpOverlapped=0x0) returned 1
	[0105.760] CloseHandle (hObject=0x5dc) returned 1
	[0105.760] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", lpFilePart=0x0) returned 0x37
	[0105.760] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0105.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0105.760] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x795d1e72, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4f5120)) returned 1
	[0105.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0105.760] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0105.761] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", lpFilePart=0x0) returned 0x37
	[0105.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0105.761] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), fInfoLevelId=0x0, lpFileInformation=0x25aa1c4 | out: lpFileInformation=0x25aa1c4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520)) returned 1
	[0105.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0105.798] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.798] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.814] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0105.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.159] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.229] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.231] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.231] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.253] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.254] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.255] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.257] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.261] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.261] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.262] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.387] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.465] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.560] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.607] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.676] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.751] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.803] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.870] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.883] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0106.931] GetFullPathNameW (in: lpFileName="C:\\Boot\\bootvhd.dll", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\bootvhd.dll", lpFilePart=0x0) returned 0x13
	[0106.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0106.931] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0106.931] GetFileType (hFile=0x41c) returned 0x1
	[0106.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0106.931] GetFileType (hFile=0x41c) returned 0x1
	[0106.931] GetFileSize (in: hFile=0x41c, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x185a0
	[0106.931] ReadFile (in: hFile=0x41c, lpBuffer=0x4407dc0, nNumberOfBytesToRead=0x185a0, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x4407dc0*, lpNumberOfBytesRead=0x55cf1fc*=0x185a0, lpOverlapped=0x0) returned 1
	[0106.935] CloseHandle (hObject=0x41c) returned 1
	[0106.935] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0106.935] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.935] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26660f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0106.935] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.935] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.935] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0106.935] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.935] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26661b0*=0x1, dwFlags=0x0) returned 1
	[0106.935] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x266617c, dwFlags=0x0) returned 1
	[0106.937] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4420380*, pdwDataLen=0x55cf204*=0x185b0, dwBufLen=0x185b0 | out: pbData=0x4420380*, pdwDataLen=0x55cf204*=0x185b0) returned 1
	[0106.937] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26661c0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26661c0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0106.937] CryptDestroyKey (hKey=0x82b280) returned 1
	[0106.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.937] GetFullPathNameW (in: lpFileName="C:\\Boot\\bootvhd.dll", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\bootvhd.dll", lpFilePart=0x0) returned 0x13
	[0106.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0106.937] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0106.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0106.939] GetFullPathNameW (in: lpFileName="C:\\Boot\\memtest.exe", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\memtest.exe", lpFilePart=0x0) returned 0x13
	[0106.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0106.940] GetFileAttributesExW (in: lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), fInfoLevelId=0x0, lpFileInformation=0x266671c | out: lpFileInformation=0x266671c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0)) returned 1
	[0106.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0106.940] GetFullPathNameW (in: lpFileName="C:\\Boot\\memtest.exe", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\memtest.exe", lpFilePart=0x0) returned 0x13
	[0106.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0106.940] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0106.940] GetFileType (hFile=0x41c) returned 0x1
	[0106.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0106.940] GetFileType (hFile=0x41c) returned 0x1
	[0106.940] GetFileSize (in: hFile=0x41c, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xc63a0
	[0106.943] ReadFile (in: hFile=0x41c, lpBuffer=0x96c8440, nNumberOfBytesToRead=0xc63a0, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x96c8440*, lpNumberOfBytesRead=0x55cf1fc*=0xc63a0, lpOverlapped=0x0) returned 1
	[0106.973] CloseHandle (hObject=0x41c) returned 1
	[0106.973] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0106.973] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.973] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2672d68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0106.973] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.973] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.973] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0106.973] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0106.973] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2672e20*=0x1, dwFlags=0x0) returned 1
	[0106.973] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2672dec, dwFlags=0x0) returned 1
	[0106.983] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x978e800*, pdwDataLen=0x55cf204*=0xc63b0, dwBufLen=0xc63b0 | out: pbData=0x978e800*, pdwDataLen=0x55cf204*=0xc63b0) returned 1
	[0106.984] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2672e30*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2672e30*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0106.984] CryptDestroyKey (hKey=0x82b280) returned 1
	[0106.984] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.984] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0106.984] GetFullPathNameW (in: lpFileName="C:\\Boot\\memtest.exe", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\memtest.exe", lpFilePart=0x0) returned 0x13
	[0106.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0106.984] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0106.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0106.986] GetFullPathNameW (in: lpFileName="C:\\Boot\\updaterevokesipolicy.p7b", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\updaterevokesipolicy.p7b", lpFilePart=0x0) returned 0x20
	[0106.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0106.986] GetFileAttributesExW (in: lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), fInfoLevelId=0x0, lpFileInformation=0x2673344 | out: lpFileInformation=0x2673344*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236)) returned 1
	[0106.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0106.988] GetFullPathNameW (in: lpFileName="C:\\Boot\\updaterevokesipolicy.p7b", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\updaterevokesipolicy.p7b", lpFilePart=0x0) returned 0x20
	[0106.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0106.988] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0106.988] GetFileType (hFile=0x5dc) returned 0x1
	[0106.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0106.988] GetFileType (hFile=0x5dc) returned 0x1
	[0106.988] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1236
	[0106.988] ReadFile (in: hFile=0x5dc, lpBuffer=0x267353c, nNumberOfBytesToRead=0x1236, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x267353c*, lpNumberOfBytesRead=0x55cf1fc*=0x1236, lpOverlapped=0x0) returned 1
	[0107.000] CloseHandle (hObject=0x5dc) returned 1
	[0107.000] CryptDestroyKey (hKey=0x82b380) returned 1
	[0107.001] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.001] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2679658, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0107.001] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.001] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.001] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0107.001] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.001] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2679710*=0x1, dwFlags=0x0) returned 1
	[0107.001] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x26796dc, dwFlags=0x0) returned 1
	[0107.001] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2679720*, pdwDataLen=0x55cf204*=0x1240, dwBufLen=0x1240 | out: pbData=0x2679720*, pdwDataLen=0x55cf204*=0x1240) returned 1
	[0107.001] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267a96c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x267a96c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.001] CryptDestroyKey (hKey=0x82b080) returned 1
	[0107.001] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.001] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.001] GetFullPathNameW (in: lpFileName="C:\\Boot\\updaterevokesipolicy.p7b", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\updaterevokesipolicy.p7b", lpFilePart=0x0) returned 0x20
	[0107.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.001] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0107.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0107.003] GetFullPathNameW (in: lpFileName="C:\\Logs\\Application.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Application.evtx", lpFilePart=0x0) returned 0x18
	[0107.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.003] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), fInfoLevelId=0x0, lpFileInformation=0x267ae50 | out: lpFileInformation=0x267ae50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0107.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.026] GetFullPathNameW (in: lpFileName="C:\\Logs\\Application.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Application.evtx", lpFilePart=0x0) returned 0x18
	[0107.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.027] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0107.027] GetFileType (hFile=0x5dc) returned 0x1
	[0107.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.027] GetFileType (hFile=0x5dc) returned 0x1
	[0107.027] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0107.028] ReadFile (in: hFile=0x5dc, lpBuffer=0x268d110, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x268d110*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.135] CloseHandle (hObject=0x5dc) returned 1
	[0107.135] CryptDestroyKey (hKey=0x82b300) returned 1
	[0107.135] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.135] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a2070, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b080) returned 1
	[0107.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.136] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.136] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0107.136] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.136] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26a2128*=0x1, dwFlags=0x0) returned 1
	[0107.136] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26a20f4, dwFlags=0x0) returned 1
	[0107.136] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a2138*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x26a2138*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.136] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b3154*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26b3154*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.136] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0107.136] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.136] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.136] GetFullPathNameW (in: lpFileName="C:\\Logs\\Application.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Application.evtx", lpFilePart=0x0) returned 0x18
	[0107.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.136] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0107.138] GetFileType (hFile=0x5dc) returned 0x1
	[0107.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.138] GetFileType (hFile=0x5dc) returned 0x1
	[0107.138] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a2138*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26a2138*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.139] CloseHandle (hObject=0x5dc) returned 1
	[0107.140] GetFullPathNameW (in: lpFileName="C:\\Logs\\Application.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Application.evtx", lpFilePart=0x0) returned 0x18
	[0107.140] GetFullPathNameW (in: lpFileName="C:\\Logs\\Application.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Application.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x47
	[0107.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.140] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a314e24, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.140] MoveFileW (lpExistingFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), lpNewFileName="C:\\Logs\\Application.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\application.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.140] GetFullPathNameW (in: lpFileName="C:\\Logs\\HardwareEvents.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\HardwareEvents.evtx", lpFilePart=0x0) returned 0x1b
	[0107.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.141] GetFileAttributesExW (in: lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26b3418 | out: lpFileInformation=0x26b3418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0107.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.206] GetFullPathNameW (in: lpFileName="C:\\Logs\\HardwareEvents.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\HardwareEvents.evtx", lpFilePart=0x0) returned 0x1b
	[0107.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.206] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0107.207] GetFileType (hFile=0x5dc) returned 0x1
	[0107.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.207] GetFileType (hFile=0x5dc) returned 0x1
	[0107.207] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0107.207] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b37d0, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26b37d0*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.221] CloseHandle (hObject=0x5dc) returned 1
	[0107.221] CryptDestroyKey (hKey=0x82b080) returned 1
	[0107.221] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.221] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d963c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0107.221] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.221] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.221] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b440) returned 1
	[0107.221] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.221] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26d96f4*=0x1, dwFlags=0x0) returned 1
	[0107.221] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26d96c0, dwFlags=0x0) returned 1
	[0107.221] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d9704*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x26d9704*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.221] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ea720*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26ea720*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.221] CryptDestroyKey (hKey=0x82b440) returned 1
	[0107.221] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.221] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.221] GetFullPathNameW (in: lpFileName="C:\\Logs\\HardwareEvents.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\HardwareEvents.evtx", lpFilePart=0x0) returned 0x1b
	[0107.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.221] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0107.223] GetFileType (hFile=0x5dc) returned 0x1
	[0107.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.223] GetFileType (hFile=0x5dc) returned 0x1
	[0107.223] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d9704*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26d9704*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.224] CloseHandle (hObject=0x5dc) returned 1
	[0107.225] GetFullPathNameW (in: lpFileName="C:\\Logs\\HardwareEvents.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\HardwareEvents.evtx", lpFilePart=0x0) returned 0x1b
	[0107.225] GetFullPathNameW (in: lpFileName="C:\\Logs\\HardwareEvents.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\HardwareEvents.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x4a
	[0107.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.225] GetFileAttributesExW (in: lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a3d388a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.225] MoveFileW (lpExistingFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), lpNewFileName="C:\\Logs\\HardwareEvents.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\hardwareevents.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.225] GetFullPathNameW (in: lpFileName="C:\\Logs\\Internet Explorer.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Internet Explorer.evtx", lpFilePart=0x0) returned 0x1e
	[0107.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.225] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26eaa08 | out: lpFileInformation=0x26eaa08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0107.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.226] GetFullPathNameW (in: lpFileName="C:\\Logs\\Internet Explorer.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Internet Explorer.evtx", lpFilePart=0x0) returned 0x1e
	[0107.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.226] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0107.226] GetFileType (hFile=0x5dc) returned 0x1
	[0107.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.226] GetFileType (hFile=0x5dc) returned 0x1
	[0107.226] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0107.226] ReadFile (in: hFile=0x5dc, lpBuffer=0x26eabf0, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26eabf0*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.261] CloseHandle (hObject=0x5dc) returned 1
	[0107.262] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0107.262] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.262] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fbc8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0107.262] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.262] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.262] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0107.262] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.262] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26fbd44*=0x1, dwFlags=0x0) returned 1
	[0107.262] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26fbd10, dwFlags=0x0) returned 1
	[0107.262] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fbd54*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x26fbd54*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.262] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270cd70*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x270cd70*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.262] CryptDestroyKey (hKey=0x82b540) returned 1
	[0107.262] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.262] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.263] GetFullPathNameW (in: lpFileName="C:\\Logs\\Internet Explorer.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Internet Explorer.evtx", lpFilePart=0x0) returned 0x1e
	[0107.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.263] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0107.264] GetFileType (hFile=0x5dc) returned 0x1
	[0107.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.265] GetFileType (hFile=0x5dc) returned 0x1
	[0107.265] WriteFile (in: hFile=0x5dc, lpBuffer=0x26fbd54*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26fbd54*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.267] CloseHandle (hObject=0x5dc) returned 1
	[0107.268] GetFullPathNameW (in: lpFileName="C:\\Logs\\Internet Explorer.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Internet Explorer.evtx", lpFilePart=0x0) returned 0x1e
	[0107.268] GetFullPathNameW (in: lpFileName="C:\\Logs\\Internet Explorer.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Internet Explorer.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x4d
	[0107.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.268] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a446015, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.268] MoveFileW (lpExistingFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), lpNewFileName="C:\\Logs\\Internet Explorer.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\internet explorer.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.269] GetFullPathNameW (in: lpFileName="C:\\Logs\\Key Management Service.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Key Management Service.evtx", lpFilePart=0x0) returned 0x23
	[0107.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.269] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), fInfoLevelId=0x0, lpFileInformation=0x270d07c | out: lpFileInformation=0x270d07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0107.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.269] GetFullPathNameW (in: lpFileName="C:\\Logs\\Key Management Service.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Key Management Service.evtx", lpFilePart=0x0) returned 0x23
	[0107.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.269] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0107.269] GetFileType (hFile=0x5dc) returned 0x1
	[0107.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.270] GetFileType (hFile=0x5dc) returned 0x1
	[0107.270] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0107.270] ReadFile (in: hFile=0x5dc, lpBuffer=0x270d284, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x270d284*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.285] CloseHandle (hObject=0x5dc) returned 1
	[0107.285] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0107.285] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.285] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272ad28, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0107.285] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.285] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.285] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b200) returned 1
	[0107.285] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.285] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x272ade0*=0x1, dwFlags=0x0) returned 1
	[0107.285] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x272adac, dwFlags=0x0) returned 1
	[0107.286] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272adf0*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x272adf0*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.286] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273be0c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x273be0c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.286] CryptDestroyKey (hKey=0x82b200) returned 1
	[0107.286] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.286] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.286] GetFullPathNameW (in: lpFileName="C:\\Logs\\Key Management Service.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Key Management Service.evtx", lpFilePart=0x0) returned 0x23
	[0107.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.286] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0107.288] GetFileType (hFile=0x5dc) returned 0x1
	[0107.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.288] GetFileType (hFile=0x5dc) returned 0x1
	[0107.288] WriteFile (in: hFile=0x5dc, lpBuffer=0x272adf0*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x272adf0*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.290] CloseHandle (hObject=0x5dc) returned 1
	[0107.290] GetFullPathNameW (in: lpFileName="C:\\Logs\\Key Management Service.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Key Management Service.evtx", lpFilePart=0x0) returned 0x23
	[0107.290] GetFullPathNameW (in: lpFileName="C:\\Logs\\Key Management Service.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Key Management Service.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0107.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.290] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a46c217, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.291] MoveFileW (lpExistingFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), lpNewFileName="C:\\Logs\\Key Management Service.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\key management service.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.291] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", lpFilePart=0x0) returned 0x37
	[0107.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.292] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x273c154 | out: lpFileInformation=0x273c154*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0107.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.292] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", lpFilePart=0x0) returned 0x37
	[0107.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.292] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0107.292] GetFileType (hFile=0x5dc) returned 0x1
	[0107.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.292] GetFileType (hFile=0x5dc) returned 0x1
	[0107.292] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0107.292] ReadFile (in: hFile=0x5dc, lpBuffer=0x273c3fc, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x273c3fc*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.307] CloseHandle (hObject=0x5dc) returned 1
	[0107.307] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0107.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.307] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276bdac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0107.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.307] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0107.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.307] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x276be64*=0x1, dwFlags=0x0) returned 1
	[0107.307] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x276be30, dwFlags=0x0) returned 1
	[0107.307] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276be74*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x276be74*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.308] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277ce90*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x277ce90*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.308] CryptDestroyKey (hKey=0x82b280) returned 1
	[0107.308] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.308] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.308] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", lpFilePart=0x0) returned 0x37
	[0107.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.308] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0107.309] GetFileType (hFile=0x5dc) returned 0x1
	[0107.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.309] GetFileType (hFile=0x5dc) returned 0x1
	[0107.309] WriteFile (in: hFile=0x5dc, lpBuffer=0x276be74*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x276be74*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.311] CloseHandle (hObject=0x5dc) returned 1
	[0107.311] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", lpFilePart=0x0) returned 0x37
	[0107.311] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0107.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.312] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a4b86d7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.312] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.312] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpFilePart=0x0) returned 0x56
	[0107.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.313] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), fInfoLevelId=0x0, lpFileInformation=0x277d2c8 | out: lpFileInformation=0x277d2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0107.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.328] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpFilePart=0x0) returned 0x56
	[0107.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.328] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0107.328] GetFileType (hFile=0x41c) returned 0x1
	[0107.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.328] GetFileType (hFile=0x41c) returned 0x1
	[0107.328] GetFileSize (in: hFile=0x41c, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0107.329] ReadFile (in: hFile=0x41c, lpBuffer=0x27836ec, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27836ec*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.341] CloseHandle (hObject=0x41c) returned 1
	[0107.341] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0107.341] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.341] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25af1b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0107.341] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.341] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.341] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0107.341] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.341] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x25af268*=0x1, dwFlags=0x0) returned 1
	[0107.341] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x25af234, dwFlags=0x0) returned 1
	[0107.341] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x25af278*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x25af278*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.342] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25c0294*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x25c0294*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.342] CryptDestroyKey (hKey=0x82b300) returned 1
	[0107.342] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.342] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.342] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpFilePart=0x0) returned 0x56
	[0107.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.342] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0107.343] GetFileType (hFile=0x41c) returned 0x1
	[0107.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.344] GetFileType (hFile=0x41c) returned 0x1
	[0107.344] WriteFile (in: hFile=0x41c, lpBuffer=0x25af278*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x25af278*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.346] CloseHandle (hObject=0x41c) returned 1
	[0107.346] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpFilePart=0x0) returned 0x56
	[0107.346] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x85
	[0107.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.346] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a504a76, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.346] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.347] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpFilePart=0x0) returned 0x4f
	[0107.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.347] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x25c0840 | out: lpFileInformation=0x25c0840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000)) returned 1
	[0107.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.379] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpFilePart=0x0) returned 0x4f
	[0107.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.379] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0107.379] GetFileType (hFile=0x41c) returned 0x1
	[0107.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.379] GetFileType (hFile=0x41c) returned 0x1
	[0107.379] GetFileSize (in: hFile=0x41c, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x101000
	[0107.381] ReadFile (in: hFile=0x41c, lpBuffer=0xc6ae4f8, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0xc6ae4f8*, lpNumberOfBytesRead=0x55cf1fc*=0x101000, lpOverlapped=0x0) returned 1
	[0107.426] CloseHandle (hObject=0x41c) returned 1
	[0107.426] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0107.426] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.426] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26046c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0107.426] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.426] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.426] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0107.426] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.426] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2604778*=0x1, dwFlags=0x0) returned 1
	[0107.426] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2604744, dwFlags=0x0) returned 1
	[0107.463] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd1a1c40*, pdwDataLen=0x55cf204*=0x101010, dwBufLen=0x101010 | out: pbData=0xd1a1c40*, pdwDataLen=0x55cf204*=0x101010) returned 1
	[0107.464] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2632b80*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2632b80*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.464] CryptDestroyKey (hKey=0x82b540) returned 1
	[0107.464] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.464] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.464] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpFilePart=0x0) returned 0x4f
	[0107.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.464] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0107.466] GetFileType (hFile=0x41c) returned 0x1
	[0107.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.466] GetFileType (hFile=0x41c) returned 0x1
	[0107.466] WriteFile (in: hFile=0x41c, lpBuffer=0xd1a1c40*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0xd1a1c40*, lpNumberOfBytesWritten=0x55cf1f0*=0x101010, lpOverlapped=0x0) returned 1
	[0107.496] CloseHandle (hObject=0x41c) returned 1
	[0107.536] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpFilePart=0x0) returned 0x4f
	[0107.536] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7e
	[0107.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.536] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a68245f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x101010)) returned 1
	[0107.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.536] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.537] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpFilePart=0x0) returned 0x35
	[0107.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.537] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2671df4 | out: lpFileInformation=0x2671df4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0107.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.537] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpFilePart=0x0) returned 0x35
	[0107.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.538] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0107.538] GetFileType (hFile=0x41c) returned 0x1
	[0107.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.538] GetFileType (hFile=0x41c) returned 0x1
	[0107.538] GetFileSize (in: hFile=0x41c, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0107.538] ReadFile (in: hFile=0x41c, lpBuffer=0x267208c, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x267208c*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.567] CloseHandle (hObject=0x41c) returned 1
	[0107.567] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0107.567] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.567] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2683128, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0107.567] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.567] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.567] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0107.567] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.567] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26831e0*=0x1, dwFlags=0x0) returned 1
	[0107.567] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26831ac, dwFlags=0x0) returned 1
	[0107.568] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26831f0*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x26831f0*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.568] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269420c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x269420c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.568] CryptDestroyKey (hKey=0x82b340) returned 1
	[0107.568] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.568] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.568] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpFilePart=0x0) returned 0x35
	[0107.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.568] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0107.570] GetFileType (hFile=0x41c) returned 0x1
	[0107.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.570] GetFileType (hFile=0x41c) returned 0x1
	[0107.570] WriteFile (in: hFile=0x41c, lpBuffer=0x26831f0*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26831f0*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.572] CloseHandle (hObject=0x41c) returned 1
	[0107.572] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpFilePart=0x0) returned 0x35
	[0107.572] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0107.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.572] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a71ab8f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.573] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.573] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpFilePart=0x0) returned 0x38
	[0107.575] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpFilePart=0x0) returned 0x38
	[0107.575] ReadFile (in: hFile=0x41c, lpBuffer=0x2696158, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2696158*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.598] CloseHandle (hObject=0x41c) returned 1
	[0107.598] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0107.598] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.598] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bdbc8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b4c0) returned 1
	[0107.598] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.598] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.599] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b440) returned 1
	[0107.599] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.599] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26bdc80*=0x1, dwFlags=0x0) returned 1
	[0107.599] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26bdc4c, dwFlags=0x0) returned 1
	[0107.599] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bdc90*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x26bdc90*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.599] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26cecac*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26cecac*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.599] CryptDestroyKey (hKey=0x82b440) returned 1
	[0107.599] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.599] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.599] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpFilePart=0x0) returned 0x38
	[0107.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.599] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0107.601] GetFileType (hFile=0x41c) returned 0x1
	[0107.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.601] GetFileType (hFile=0x41c) returned 0x1
	[0107.601] WriteFile (in: hFile=0x41c, lpBuffer=0x26bdc90*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26bdc90*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.603] CloseHandle (hObject=0x41c) returned 1
	[0107.603] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpFilePart=0x0) returned 0x38
	[0107.603] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0107.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.604] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a76712c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.604] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.605] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpFilePart=0x0) returned 0x41
	[0107.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.605] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26cf0f0 | out: lpFileInformation=0x26cf0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0107.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.605] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpFilePart=0x0) returned 0x41
	[0107.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.606] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0107.606] GetFileType (hFile=0x41c) returned 0x1
	[0107.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.606] GetFileType (hFile=0x41c) returned 0x1
	[0107.606] GetFileSize (in: hFile=0x41c, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0107.606] ReadFile (in: hFile=0x41c, lpBuffer=0x26cf3e8, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26cf3e8*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.647] CloseHandle (hObject=0x41c) returned 1
	[0107.648] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0107.648] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.648] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f79e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b000) returned 1
	[0107.648] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.648] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.648] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0107.648] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.648] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26f7a9c*=0x1, dwFlags=0x0) returned 1
	[0107.648] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26f7a68, dwFlags=0x0) returned 1
	[0107.648] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f7aac*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x26f7aac*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.648] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2708ac8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2708ac8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.648] CryptDestroyKey (hKey=0x82b540) returned 1
	[0107.648] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.648] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.648] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpFilePart=0x0) returned 0x41
	[0107.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.649] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0107.650] GetFileType (hFile=0x41c) returned 0x1
	[0107.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.650] GetFileType (hFile=0x41c) returned 0x1
	[0107.650] WriteFile (in: hFile=0x41c, lpBuffer=0x26f7aac*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26f7aac*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.653] CloseHandle (hObject=0x41c) returned 1
	[0107.653] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpFilePart=0x0) returned 0x41
	[0107.653] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x70
	[0107.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.653] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a7ffb03, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.653] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.654] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpFilePart=0x0) returned 0x40
	[0107.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.654] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2708f78 | out: lpFileInformation=0x2708f78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0107.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.654] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpFilePart=0x0) returned 0x40
	[0107.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.655] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0107.655] GetFileType (hFile=0x41c) returned 0x1
	[0107.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.655] GetFileType (hFile=0x41c) returned 0x1
	[0107.655] GetFileSize (in: hFile=0x41c, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0107.655] ReadFile (in: hFile=0x41c, lpBuffer=0x2709270, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2709270*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.695] CloseHandle (hObject=0x41c) returned 1
	[0107.695] CryptDestroyKey (hKey=0x82b000) returned 1
	[0107.695] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.696] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2729e24, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0107.696] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.696] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.696] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0107.696] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.696] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2729edc*=0x1, dwFlags=0x0) returned 1
	[0107.696] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2729ea8, dwFlags=0x0) returned 1
	[0107.696] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2729eec*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x2729eec*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.696] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273af08*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x273af08*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.696] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0107.696] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.696] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.696] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpFilePart=0x0) returned 0x40
	[0107.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.696] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x41c
	[0107.698] GetFileType (hFile=0x41c) returned 0x1
	[0107.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.698] GetFileType (hFile=0x41c) returned 0x1
	[0107.698] WriteFile (in: hFile=0x41c, lpBuffer=0x2729eec*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2729eec*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.701] CloseHandle (hObject=0x41c) returned 1
	[0107.701] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpFilePart=0x0) returned 0x40
	[0107.701] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0107.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.701] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a872281, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.701] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.702] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpFilePart=0x0) returned 0x36
	[0107.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.702] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x273b3ac | out: lpFileInformation=0x273b3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0107.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.703] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpFilePart=0x0) returned 0x36
	[0107.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.704] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0107.704] GetFileType (hFile=0x308) returned 0x1
	[0107.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.704] GetFileType (hFile=0x308) returned 0x1
	[0107.704] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0107.704] ReadFile (in: hFile=0x308, lpBuffer=0x273b654, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x273b654*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.723] CloseHandle (hObject=0x308) returned 1
	[0107.723] CryptDestroyKey (hKey=0x82b400) returned 1
	[0107.723] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.723] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2754b34, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0107.723] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.723] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.723] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0107.723] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.723] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2754bec*=0x1, dwFlags=0x0) returned 1
	[0107.723] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2754bb8, dwFlags=0x0) returned 1
	[0107.723] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2754bfc*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x2754bfc*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.723] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2765c18*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2765c18*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.723] CryptDestroyKey (hKey=0x82b280) returned 1
	[0107.723] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.723] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.724] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpFilePart=0x0) returned 0x36
	[0107.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.724] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0107.725] GetFileType (hFile=0x308) returned 0x1
	[0107.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.725] GetFileType (hFile=0x308) returned 0x1
	[0107.725] WriteFile (in: hFile=0x308, lpBuffer=0x2754bfc*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2754bfc*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.727] CloseHandle (hObject=0x308) returned 1
	[0107.727] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpFilePart=0x0) returned 0x36
	[0107.727] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0107.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.727] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a8982d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.728] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.728] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", lpFilePart=0x0) returned 0x32
	[0107.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.728] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2766044 | out: lpFileInformation=0x2766044*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0107.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.729] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", lpFilePart=0x0) returned 0x32
	[0107.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.729] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0107.729] GetFileType (hFile=0x308) returned 0x1
	[0107.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.729] GetFileType (hFile=0x308) returned 0x1
	[0107.729] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0107.729] ReadFile (in: hFile=0x308, lpBuffer=0x27662cc, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27662cc*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.749] CloseHandle (hObject=0x308) returned 1
	[0107.749] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0107.749] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.749] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a5684, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b100) returned 1
	[0107.749] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.749] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.749] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0107.749] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.749] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27a573c*=0x1, dwFlags=0x0) returned 1
	[0107.749] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x27a5708, dwFlags=0x0) returned 1
	[0107.749] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a574c*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x27a574c*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.749] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b6768*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27b6768*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.749] CryptDestroyKey (hKey=0x82b080) returned 1
	[0107.750] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.750] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.750] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", lpFilePart=0x0) returned 0x32
	[0107.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.750] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0107.751] GetFileType (hFile=0x308) returned 0x1
	[0107.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.751] GetFileType (hFile=0x308) returned 0x1
	[0107.751] WriteFile (in: hFile=0x308, lpBuffer=0x27a574c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27a574c*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.753] CloseHandle (hObject=0x308) returned 1
	[0107.753] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", lpFilePart=0x0) returned 0x32
	[0107.753] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0107.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.753] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a8e481d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.754] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.754] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", lpFilePart=0x0) returned 0x38
	[0107.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.755] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x27b6b64 | out: lpFileInformation=0x27b6b64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000)) returned 1
	[0107.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.759] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", lpFilePart=0x0) returned 0x38
	[0107.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.759] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0107.759] GetFileType (hFile=0x308) returned 0x1
	[0107.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.759] GetFileType (hFile=0x308) returned 0x1
	[0107.759] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x111000
	[0107.763] ReadFile (in: hFile=0x308, lpBuffer=0xd2a2c70, nNumberOfBytesToRead=0x111000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0xd2a2c70*, lpNumberOfBytesRead=0x55cf1fc*=0x111000, lpOverlapped=0x0) returned 1
	[0107.821] CloseHandle (hObject=0x308) returned 1
	[0107.821] CryptDestroyKey (hKey=0x82b100) returned 1
	[0107.821] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.821] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c2db0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0107.821] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.822] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.822] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0107.822] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.822] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27c2e68*=0x1, dwFlags=0x0) returned 1
	[0107.822] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27c2e34, dwFlags=0x0) returned 1
	[0107.836] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd3b3c90*, pdwDataLen=0x55cf204*=0x111010, dwBufLen=0x111010 | out: pbData=0xd3b3c90*, pdwDataLen=0x55cf204*=0x111010) returned 1
	[0107.837] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c2e78*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27c2e78*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.837] CryptDestroyKey (hKey=0x82b340) returned 1
	[0107.837] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.837] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.837] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", lpFilePart=0x0) returned 0x38
	[0107.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.838] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0107.841] GetFileType (hFile=0x308) returned 0x1
	[0107.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.841] GetFileType (hFile=0x308) returned 0x1
	[0107.841] WriteFile (in: hFile=0x308, lpBuffer=0xd3b3c90*, nNumberOfBytesToWrite=0x111010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0xd3b3c90*, lpNumberOfBytesWritten=0x55cf1f0*=0x111010, lpOverlapped=0x0) returned 1
	[0107.867] CloseHandle (hObject=0x308) returned 1
	[0107.868] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", lpFilePart=0x0) returned 0x38
	[0107.868] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0107.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.868] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7a9efa05, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x111010)) returned 1
	[0107.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.868] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.869] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", lpFilePart=0x0) returned 0x3a
	[0107.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.869] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x27c5cc8 | out: lpFileInformation=0x27c5cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0107.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.870] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", lpFilePart=0x0) returned 0x3a
	[0107.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.870] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0107.870] GetFileType (hFile=0x308) returned 0x1
	[0107.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.870] GetFileType (hFile=0x308) returned 0x1
	[0107.870] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0107.870] ReadFile (in: hFile=0x308, lpBuffer=0x27c6180, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27c6180*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0107.885] CloseHandle (hObject=0x308) returned 1
	[0107.886] CryptDestroyKey (hKey=0x82b300) returned 1
	[0107.886] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.886] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27dc3d4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b040) returned 1
	[0107.886] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.886] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.886] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0107.886] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.886] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27dc48c*=0x1, dwFlags=0x0) returned 1
	[0107.886] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27dc458, dwFlags=0x0) returned 1
	[0107.886] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27dc49c*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x27dc49c*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0107.886] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ed4b8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27ed4b8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0107.886] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0107.886] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.887] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.887] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", lpFilePart=0x0) returned 0x3a
	[0107.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0107.887] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0107.888] GetFileType (hFile=0x308) returned 0x1
	[0107.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0107.888] GetFileType (hFile=0x308) returned 0x1
	[0107.888] WriteFile (in: hFile=0x308, lpBuffer=0x27dc49c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27dc49c*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0107.891] CloseHandle (hObject=0x308) returned 1
	[0107.891] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", lpFilePart=0x0) returned 0x3a
	[0107.891] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0107.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0107.891] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7aa3be38, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0107.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0107.891] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0107.892] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpFilePart=0x0) returned 0x40
	[0107.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0107.892] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x27ed914 | out: lpFileInformation=0x27ed914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000)) returned 1
	[0107.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0107.893] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpFilePart=0x0) returned 0x40
	[0107.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0107.893] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0107.893] GetFileType (hFile=0x308) returned 0x1
	[0107.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0107.893] GetFileType (hFile=0x308) returned 0x1
	[0107.893] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x211000
	[0107.898] ReadFile (in: hFile=0x308, lpBuffer=0xd4c4cc0, nNumberOfBytesToRead=0x211000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0xd4c4cc0*, lpNumberOfBytesRead=0x55cf1fc*=0x211000, lpOverlapped=0x0) returned 1
	[0107.993] CloseHandle (hObject=0x308) returned 1
	[0107.993] CryptDestroyKey (hKey=0x82b040) returned 1
	[0107.993] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0107.993] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fd98c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0107.993] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.994] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.994] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b440) returned 1
	[0107.994] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0107.994] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x27fda44*=0x1, dwFlags=0x0) returned 1
	[0107.994] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x27fda10, dwFlags=0x0) returned 1
	[0108.012] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd8b1018*, pdwDataLen=0x55cf204*=0x211010, dwBufLen=0x211010 | out: pbData=0xd8b1018*, pdwDataLen=0x55cf204*=0x211010) returned 1
	[0108.014] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fda54*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27fda54*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.014] CryptDestroyKey (hKey=0x82b440) returned 1
	[0108.014] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.014] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.014] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpFilePart=0x0) returned 0x40
	[0108.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.014] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.016] GetFileType (hFile=0x308) returned 0x1
	[0108.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.016] GetFileType (hFile=0x308) returned 0x1
	[0108.016] WriteFile (in: hFile=0x308, lpBuffer=0xd8b1018*, nNumberOfBytesToWrite=0x211010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0xd8b1018*, lpNumberOfBytesWritten=0x55cf1f0*=0x211010, lpOverlapped=0x0) returned 1
	[0108.200] CloseHandle (hObject=0x308) returned 1
	[0108.200] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpFilePart=0x0) returned 0x40
	[0108.200] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0108.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.200] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7ad36d25, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x211010)) returned 1
	[0108.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.201] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.201] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpFilePart=0x0) returned 0x3f
	[0108.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.201] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), fInfoLevelId=0x0, lpFileInformation=0x28258f8 | out: lpFileInformation=0x28258f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.221] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpFilePart=0x0) returned 0x3f
	[0108.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.221] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.221] GetFileType (hFile=0x308) returned 0x1
	[0108.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.221] GetFileType (hFile=0x308) returned 0x1
	[0108.222] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.222] ReadFile (in: hFile=0x308, lpBuffer=0x2825be0, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2825be0*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.245] CloseHandle (hObject=0x308) returned 1
	[0108.247] CryptDestroyKey (hKey=0x82b400) returned 1
	[0108.247] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.247] CryptImportKey (in: hProv=0x7f93c0, pbData=0x284efdc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0108.247] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.250] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.250] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0108.250] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.250] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2852e08*=0x1, dwFlags=0x0) returned 1
	[0108.251] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2852dd4, dwFlags=0x0) returned 1
	[0108.251] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2852e18*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x2852e18*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.253] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2867ba8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2867ba8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.253] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0108.253] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.253] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.253] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpFilePart=0x0) returned 0x3f
	[0108.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.253] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.255] GetFileType (hFile=0x308) returned 0x1
	[0108.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.256] GetFileType (hFile=0x308) returned 0x1
	[0108.256] WriteFile (in: hFile=0x308, lpBuffer=0x2852e18*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2852e18*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.258] CloseHandle (hObject=0x308) returned 1
	[0108.259] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpFilePart=0x0) returned 0x3f
	[0108.259] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6e
	[0108.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.259] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7ada9328, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.259] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.260] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0108.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.260] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2868040 | out: lpFileInformation=0x2868040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.261] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0108.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.261] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.261] GetFileType (hFile=0x308) returned 0x1
	[0108.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.261] GetFileType (hFile=0x308) returned 0x1
	[0108.262] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.262] ReadFile (in: hFile=0x308, lpBuffer=0x28682f8, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x28682f8*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.271] CloseHandle (hObject=0x308) returned 1
	[0108.271] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0108.271] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.271] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2884bf0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b040) returned 1
	[0108.271] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.271] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.271] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0108.271] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.271] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2884ca8*=0x1, dwFlags=0x0) returned 1
	[0108.271] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2884c74, dwFlags=0x0) returned 1
	[0108.271] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2884cb8*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x2884cb8*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.272] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2895cd4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2895cd4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.272] CryptDestroyKey (hKey=0x82b100) returned 1
	[0108.272] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.272] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.272] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0108.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.272] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.273] GetFileType (hFile=0x308) returned 0x1
	[0108.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.273] GetFileType (hFile=0x308) returned 0x1
	[0108.273] WriteFile (in: hFile=0x308, lpBuffer=0x2884cb8*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2884cb8*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.275] CloseHandle (hObject=0x308) returned 1
	[0108.276] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0108.276] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0108.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.276] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7adcf706, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.276] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.277] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpFilePart=0x0) returned 0x48
	[0108.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.277] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2896124 | out: lpFileInformation=0x2896124*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.279] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpFilePart=0x0) returned 0x48
	[0108.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.279] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.279] GetFileType (hFile=0x308) returned 0x1
	[0108.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.279] GetFileType (hFile=0x308) returned 0x1
	[0108.279] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.279] ReadFile (in: hFile=0x308, lpBuffer=0x289645c, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x289645c*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.299] CloseHandle (hObject=0x308) returned 1
	[0108.299] CryptDestroyKey (hKey=0x82b040) returned 1
	[0108.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.300] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28c2324, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0108.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.300] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0108.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.300] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x28c23dc*=0x1, dwFlags=0x0) returned 1
	[0108.300] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x28c23a8, dwFlags=0x0) returned 1
	[0108.300] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28c23ec*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x28c23ec*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.300] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28d3408*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x28d3408*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.300] CryptDestroyKey (hKey=0x82b480) returned 1
	[0108.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.300] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpFilePart=0x0) returned 0x48
	[0108.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.300] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.302] GetFileType (hFile=0x308) returned 0x1
	[0108.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.302] GetFileType (hFile=0x308) returned 0x1
	[0108.302] WriteFile (in: hFile=0x308, lpBuffer=0x28c23ec*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x28c23ec*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.304] CloseHandle (hObject=0x308) returned 1
	[0108.304] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpFilePart=0x0) returned 0x48
	[0108.304] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x77
	[0108.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.304] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7ae1b9fb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.305] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.305] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0108.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.305] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x28d390c | out: lpFileInformation=0x28d390c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.306] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0108.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.306] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.306] GetFileType (hFile=0x308) returned 0x1
	[0108.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.306] GetFileType (hFile=0x308) returned 0x1
	[0108.306] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.307] ReadFile (in: hFile=0x308, lpBuffer=0x28d3bb4, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x28d3bb4*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.325] CloseHandle (hObject=0x308) returned 1
	[0108.325] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0108.325] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.325] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25e0900, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0108.325] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.325] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.325] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0108.325] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.325] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x25e09b8*=0x1, dwFlags=0x0) returned 1
	[0108.325] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x25e0984, dwFlags=0x0) returned 1
	[0108.325] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x25e09c8*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x25e09c8*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.325] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25f19e4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x25f19e4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.325] CryptDestroyKey (hKey=0x82b380) returned 1
	[0108.325] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.325] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.326] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0108.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.326] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.327] GetFileType (hFile=0x308) returned 0x1
	[0108.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.327] GetFileType (hFile=0x308) returned 0x1
	[0108.327] WriteFile (in: hFile=0x308, lpBuffer=0x25e09c8*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x25e09c8*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.331] CloseHandle (hObject=0x308) returned 1
	[0108.331] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0108.331] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0108.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.331] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7ae67e6b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.332] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.332] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0108.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.332] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x25f1e1c | out: lpFileInformation=0x25f1e1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.333] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0108.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.333] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.333] GetFileType (hFile=0x308) returned 0x1
	[0108.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.333] GetFileType (hFile=0x308) returned 0x1
	[0108.333] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.333] ReadFile (in: hFile=0x308, lpBuffer=0x25f20d4, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x25f20d4*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.342] CloseHandle (hObject=0x308) returned 1
	[0108.342] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0108.342] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.343] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2605d3c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b200) returned 1
	[0108.343] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.343] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.343] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0108.343] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.343] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2605df4*=0x1, dwFlags=0x0) returned 1
	[0108.343] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2605dc0, dwFlags=0x0) returned 1
	[0108.343] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2605e04*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x2605e04*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.343] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2616e20*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2616e20*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.343] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0108.343] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.343] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.343] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0108.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.343] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.345] GetFileType (hFile=0x308) returned 0x1
	[0108.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.345] GetFileType (hFile=0x308) returned 0x1
	[0108.345] WriteFile (in: hFile=0x308, lpBuffer=0x2605e04*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2605e04*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.347] CloseHandle (hObject=0x308) returned 1
	[0108.347] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0108.347] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0108.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.347] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7ae8e287, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.348] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.348] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpFilePart=0x0) returned 0x47
	[0108.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.348] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2617270 | out: lpFileInformation=0x2617270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.349] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpFilePart=0x0) returned 0x47
	[0108.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.349] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.349] GetFileType (hFile=0x308) returned 0x1
	[0108.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.349] GetFileType (hFile=0x308) returned 0x1
	[0108.351] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.351] ReadFile (in: hFile=0x308, lpBuffer=0x2617598, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2617598*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.373] CloseHandle (hObject=0x308) returned 1
	[0108.373] CryptDestroyKey (hKey=0x82b200) returned 1
	[0108.373] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.373] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262e550, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0108.373] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.373] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.373] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0108.374] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.374] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x262e608*=0x1, dwFlags=0x0) returned 1
	[0108.374] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x262e5d4, dwFlags=0x0) returned 1
	[0108.374] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262e618*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x262e618*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.374] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263f634*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x263f634*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.374] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0108.374] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.374] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.374] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpFilePart=0x0) returned 0x47
	[0108.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.374] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.376] GetFileType (hFile=0x308) returned 0x1
	[0108.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.376] GetFileType (hFile=0x308) returned 0x1
	[0108.376] WriteFile (in: hFile=0x308, lpBuffer=0x262e618*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x262e618*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.378] CloseHandle (hObject=0x308) returned 1
	[0108.378] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpFilePart=0x0) returned 0x47
	[0108.378] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x76
	[0108.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.378] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7aeda71a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.378] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.379] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpFilePart=0x0) returned 0x39
	[0108.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.379] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), fInfoLevelId=0x0, lpFileInformation=0x263fb2c | out: lpFileInformation=0x263fb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.380] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpFilePart=0x0) returned 0x39
	[0108.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.380] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.380] GetFileType (hFile=0x308) returned 0x1
	[0108.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.380] GetFileType (hFile=0x308) returned 0x1
	[0108.380] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.380] ReadFile (in: hFile=0x308, lpBuffer=0x263fde4, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x263fde4*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.427] CloseHandle (hObject=0x308) returned 1
	[0108.427] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0108.427] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.427] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2663da0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0108.427] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.427] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.427] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0108.427] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.427] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2663e58*=0x1, dwFlags=0x0) returned 1
	[0108.427] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2663e24, dwFlags=0x0) returned 1
	[0108.427] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2663e68*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x2663e68*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.428] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2674e84*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2674e84*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.428] CryptDestroyKey (hKey=0x82b300) returned 1
	[0108.428] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.428] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.428] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpFilePart=0x0) returned 0x39
	[0108.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.428] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.430] GetFileType (hFile=0x308) returned 0x1
	[0108.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.430] GetFileType (hFile=0x308) returned 0x1
	[0108.430] WriteFile (in: hFile=0x308, lpBuffer=0x2663e68*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2663e68*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.433] CloseHandle (hObject=0x308) returned 1
	[0108.433] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpFilePart=0x0) returned 0x39
	[0108.433] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0108.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.434] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7af71f5e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.434] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.435] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpFilePart=0x0) returned 0x38
	[0108.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.435] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26752d4 | out: lpFileInformation=0x26752d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.437] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpFilePart=0x0) returned 0x38
	[0108.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.437] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.437] GetFileType (hFile=0x308) returned 0x1
	[0108.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.437] GetFileType (hFile=0x308) returned 0x1
	[0108.437] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.437] ReadFile (in: hFile=0x308, lpBuffer=0x267558c, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x267558c*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.461] CloseHandle (hObject=0x308) returned 1
	[0108.461] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0108.461] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.461] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a4a20, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b0c0) returned 1
	[0108.461] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.461] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.461] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0108.461] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.462] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26a4ad8*=0x1, dwFlags=0x0) returned 1
	[0108.462] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x26a4aa4, dwFlags=0x0) returned 1
	[0108.462] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a4ae8*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x26a4ae8*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.462] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b5b04*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26b5b04*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.462] CryptDestroyKey (hKey=0x82b100) returned 1
	[0108.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.462] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpFilePart=0x0) returned 0x38
	[0108.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.462] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.464] GetFileType (hFile=0x308) returned 0x1
	[0108.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.464] GetFileType (hFile=0x308) returned 0x1
	[0108.464] WriteFile (in: hFile=0x308, lpBuffer=0x26a4ae8*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26a4ae8*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.466] CloseHandle (hObject=0x308) returned 1
	[0108.466] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpFilePart=0x0) returned 0x38
	[0108.466] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0108.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.466] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7afb2821, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.467] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.467] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpFilePart=0x0) returned 0x56
	[0108.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.468] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26b5f48 | out: lpFileInformation=0x26b5f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000)) returned 1
	[0108.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.468] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpFilePart=0x0) returned 0x56
	[0108.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.468] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.468] GetFileType (hFile=0x308) returned 0x1
	[0108.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.468] GetFileType (hFile=0x308) returned 0x1
	[0108.468] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x101000
	[0108.471] ReadFile (in: hFile=0x308, lpBuffer=0xd6d5ce0, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0xd6d5ce0*, lpNumberOfBytesRead=0x55cf1fc*=0x101000, lpOverlapped=0x0) returned 1
	[0108.534] CloseHandle (hObject=0x308) returned 1
	[0108.535] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0108.535] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.535] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f1028, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0108.535] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.535] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.535] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0108.535] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.535] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26f10e0*=0x1, dwFlags=0x0) returned 1
	[0108.535] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x26f10ac, dwFlags=0x0) returned 1
	[0108.548] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xdac2048*, pdwDataLen=0x55cf204*=0x101010, dwBufLen=0x101010 | out: pbData=0xdac2048*, pdwDataLen=0x55cf204*=0x101010) returned 1
	[0108.549] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f10f0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26f10f0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.549] CryptDestroyKey (hKey=0x82b380) returned 1
	[0108.549] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.549] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.549] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpFilePart=0x0) returned 0x56
	[0108.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.549] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.550] GetFileType (hFile=0x308) returned 0x1
	[0108.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.551] GetFileType (hFile=0x308) returned 0x1
	[0108.551] WriteFile (in: hFile=0x308, lpBuffer=0xdac2048*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0xdac2048*, lpNumberOfBytesWritten=0x55cf1f0*=0x101010, lpOverlapped=0x0) returned 1
	[0108.572] CloseHandle (hObject=0x308) returned 1
	[0108.572] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpFilePart=0x0) returned 0x56
	[0108.572] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x85
	[0108.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.572] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7b0bdb7a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x101010)) returned 1
	[0108.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.572] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.573] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpFilePart=0x0) returned 0x38
	[0108.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.573] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26f169c | out: lpFileInformation=0x26f169c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.574] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpFilePart=0x0) returned 0x38
	[0108.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.574] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.574] GetFileType (hFile=0x308) returned 0x1
	[0108.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.574] GetFileType (hFile=0x308) returned 0x1
	[0108.574] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.574] ReadFile (in: hFile=0x308, lpBuffer=0x26f1954, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26f1954*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.591] CloseHandle (hObject=0x308) returned 1
	[0108.591] CryptDestroyKey (hKey=0x82b300) returned 1
	[0108.591] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.592] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27029f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0108.592] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.592] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.592] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0108.592] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.592] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x2702aa8*=0x1, dwFlags=0x0) returned 1
	[0108.592] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x2702a74, dwFlags=0x0) returned 1
	[0108.592] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2702ab8*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x2702ab8*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.592] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2713ad4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2713ad4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.592] CryptDestroyKey (hKey=0x82b340) returned 1
	[0108.592] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.592] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.592] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpFilePart=0x0) returned 0x38
	[0108.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.592] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.594] GetFileType (hFile=0x308) returned 0x1
	[0108.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.594] GetFileType (hFile=0x308) returned 0x1
	[0108.594] WriteFile (in: hFile=0x308, lpBuffer=0x2702ab8*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2702ab8*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.597] CloseHandle (hObject=0x308) returned 1
	[0108.597] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpFilePart=0x0) returned 0x38
	[0108.597] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0108.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.597] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7b0e3e61, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.597] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.598] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpFilePart=0x0) returned 0x3e
	[0108.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.598] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2713f18 | out: lpFileInformation=0x2713f18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.599] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpFilePart=0x0) returned 0x3e
	[0108.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.599] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.599] GetFileType (hFile=0x308) returned 0x1
	[0108.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.599] GetFileType (hFile=0x308) returned 0x1
	[0108.599] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.599] ReadFile (in: hFile=0x308, lpBuffer=0x2714200, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2714200*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.613] CloseHandle (hObject=0x308) returned 1
	[0108.613] CryptDestroyKey (hKey=0x82b280) returned 1
	[0108.613] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.613] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273079c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0108.613] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.613] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.613] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0108.613] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.613] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2730854*=0x1, dwFlags=0x0) returned 1
	[0108.613] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2730820, dwFlags=0x0) returned 1
	[0108.613] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2730864*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x2730864*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.613] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2741880*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2741880*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.613] CryptDestroyKey (hKey=0x82b380) returned 1
	[0108.613] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.613] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.614] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpFilePart=0x0) returned 0x3e
	[0108.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.614] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.615] GetFileType (hFile=0x308) returned 0x1
	[0108.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.615] GetFileType (hFile=0x308) returned 0x1
	[0108.615] WriteFile (in: hFile=0x308, lpBuffer=0x2730864*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2730864*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.617] CloseHandle (hObject=0x308) returned 1
	[0108.618] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpFilePart=0x0) returned 0x3e
	[0108.618] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6d
	[0108.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.618] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7b1302fd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.618] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.619] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpFilePart=0x0) returned 0x31
	[0108.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.619] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2741d0c | out: lpFileInformation=0x2741d0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.619] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpFilePart=0x0) returned 0x31
	[0108.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.619] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.620] GetFileType (hFile=0x308) returned 0x1
	[0108.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.620] GetFileType (hFile=0x308) returned 0x1
	[0108.620] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.620] ReadFile (in: hFile=0x308, lpBuffer=0x2741f84, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2741f84*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.657] CloseHandle (hObject=0x308) returned 1
	[0108.657] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0108.658] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.658] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27747f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b080) returned 1
	[0108.658] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.658] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.658] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b200) returned 1
	[0108.658] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.658] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x27748ac*=0x1, dwFlags=0x0) returned 1
	[0108.658] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2774878, dwFlags=0x0) returned 1
	[0108.658] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27748bc*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x27748bc*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.658] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27858d8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27858d8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.658] CryptDestroyKey (hKey=0x82b200) returned 1
	[0108.658] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.658] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.658] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpFilePart=0x0) returned 0x31
	[0108.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.658] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.659] GetFileType (hFile=0x308) returned 0x1
	[0108.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.659] GetFileType (hFile=0x308) returned 0x1
	[0108.660] WriteFile (in: hFile=0x308, lpBuffer=0x27748bc*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27748bc*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.661] CloseHandle (hObject=0x308) returned 1
	[0108.661] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpFilePart=0x0) returned 0x31
	[0108.661] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x60
	[0108.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.661] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7b17c803, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.661] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.662] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpFilePart=0x0) returned 0x33
	[0108.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.662] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2785cc8 | out: lpFileInformation=0x2785cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.663] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpFilePart=0x0) returned 0x33
	[0108.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.663] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.663] GetFileType (hFile=0x308) returned 0x1
	[0108.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.663] GetFileType (hFile=0x308) returned 0x1
	[0108.663] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.663] ReadFile (in: hFile=0x308, lpBuffer=0x2785f50, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2785f50*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.720] CloseHandle (hObject=0x308) returned 1
	[0108.721] CryptDestroyKey (hKey=0x82b080) returned 1
	[0108.721] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.721] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2796fec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0108.721] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.721] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.721] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0108.721] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.721] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27970a4*=0x1, dwFlags=0x0) returned 1
	[0108.721] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2797070, dwFlags=0x0) returned 1
	[0108.721] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27970b4*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x27970b4*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.721] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a80d0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27a80d0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.721] CryptDestroyKey (hKey=0x82b540) returned 1
	[0108.721] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.721] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.721] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpFilePart=0x0) returned 0x33
	[0108.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.722] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.723] GetFileType (hFile=0x308) returned 0x1
	[0108.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.723] GetFileType (hFile=0x308) returned 0x1
	[0108.723] WriteFile (in: hFile=0x308, lpBuffer=0x27970b4*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27970b4*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.726] CloseHandle (hObject=0x308) returned 1
	[0108.726] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpFilePart=0x0) returned 0x33
	[0108.726] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x62
	[0108.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.726] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7b23b386, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.726] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.727] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0108.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.727] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x27a84d8 | out: lpFileInformation=0x27a84d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.730] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0108.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.730] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.730] GetFileType (hFile=0x308) returned 0x1
	[0108.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.730] GetFileType (hFile=0x308) returned 0x1
	[0108.730] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.730] ReadFile (in: hFile=0x308, lpBuffer=0x27a8790, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27a8790*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.755] CloseHandle (hObject=0x308) returned 1
	[0108.755] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0108.755] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.755] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b982c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b040) returned 1
	[0108.755] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.755] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.756] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0108.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.756] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27b98e4*=0x1, dwFlags=0x0) returned 1
	[0108.756] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27b98b0, dwFlags=0x0) returned 1
	[0108.756] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b98f4*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x27b98f4*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.756] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ca910*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27ca910*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.756] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0108.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.756] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0108.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.756] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.758] GetFileType (hFile=0x308) returned 0x1
	[0108.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.758] GetFileType (hFile=0x308) returned 0x1
	[0108.758] WriteFile (in: hFile=0x308, lpBuffer=0x27b98f4*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27b98f4*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.760] CloseHandle (hObject=0x308) returned 1
	[0108.760] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0108.760] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0108.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.760] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7b287804, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.760] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.763] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpFilePart=0x0) returned 0x43
	[0108.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.763] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x27cad60 | out: lpFileInformation=0x27cad60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.763] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpFilePart=0x0) returned 0x43
	[0108.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.763] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.763] GetFileType (hFile=0x308) returned 0x1
	[0108.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.763] GetFileType (hFile=0x308) returned 0x1
	[0108.764] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.765] ReadFile (in: hFile=0x308, lpBuffer=0x25d3320, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x25d3320*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0108.855] CloseHandle (hObject=0x308) returned 1
	[0108.855] CryptDestroyKey (hKey=0x82b040) returned 1
	[0108.855] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.855] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25e462c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0108.856] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.856] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.856] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0108.856] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0108.856] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x25e46e4*=0x1, dwFlags=0x0) returned 1
	[0108.856] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x25e46b0, dwFlags=0x0) returned 1
	[0108.856] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x25e46f4*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x25e46f4*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0108.856] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25f5710*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x25f5710*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0108.856] CryptDestroyKey (hKey=0x82b480) returned 1
	[0108.856] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.856] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0108.856] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpFilePart=0x0) returned 0x43
	[0108.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0108.856] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.858] GetFileType (hFile=0x308) returned 0x1
	[0108.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0108.858] GetFileType (hFile=0x308) returned 0x1
	[0108.858] WriteFile (in: hFile=0x308, lpBuffer=0x25e46f4*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x25e46f4*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0108.860] CloseHandle (hObject=0x308) returned 1
	[0108.860] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpFilePart=0x0) returned 0x43
	[0108.860] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x72
	[0108.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0108.860] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x7b36c61c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0108.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0108.861] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0108.861] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0108.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0108.861] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x25f5bd8 | out: lpFileInformation=0x25f5bd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0108.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0108.862] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0108.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0108.862] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0108.862] GetFileType (hFile=0x308) returned 0x1
	[0108.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0108.862] GetFileType (hFile=0x308) returned 0x1
	[0108.862] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0108.863] ReadFile (in: hFile=0x308, lpBuffer=0x25f5e80, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x25f5e80*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0109.415] CloseHandle (hObject=0x308) returned 1
	[0109.415] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0109.415] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0109.415] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2606f1c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0109.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0109.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0109.416] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0109.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0109.416] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2606fd4*=0x1, dwFlags=0x0) returned 1
	[0109.416] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2606fa0, dwFlags=0x0) returned 1
	[0109.416] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2606fe4*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x2606fe4*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0109.416] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2618000*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2618000*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0109.416] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0109.416] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0109.416] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0109.416] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0109.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0109.416] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308
	[0109.418] GetFileType (hFile=0x308) returned 0x1
	[0109.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0109.418] GetFileType (hFile=0x308) returned 0x1
	[0109.418] WriteFile (in: hFile=0x308, lpBuffer=0x2606fe4*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2606fe4*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0109.421] CloseHandle (hObject=0x308) returned 1
	[0109.421] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0109.421] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0109.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0109.421] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7b8de5b2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0109.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0109.422] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0109.423] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0109.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0109.423] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2618438 | out: lpFileInformation=0x2618438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0109.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0109.813] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0109.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0109.813] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0109.814] GetFileType (hFile=0x2ec) returned 0x1
	[0109.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0109.814] GetFileType (hFile=0x2ec) returned 0x1
	[0109.814] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0109.814] ReadFile (in: hFile=0x2ec, lpBuffer=0x26186e0, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26186e0*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0109.888] CloseHandle (hObject=0x2ec) returned 1
	[0109.888] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0109.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0109.888] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262977c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0109.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0109.889] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0109.889] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0109.889] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0109.889] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2629834*=0x1, dwFlags=0x0) returned 1
	[0109.889] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2629800, dwFlags=0x0) returned 1
	[0109.889] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2629844*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x2629844*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0109.889] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263a860*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x263a860*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0109.889] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0109.889] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0109.889] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0109.889] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0109.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0109.889] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0109.891] GetFileType (hFile=0x2ec) returned 0x1
	[0109.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0109.891] GetFileType (hFile=0x2ec) returned 0x1
	[0109.891] WriteFile (in: hFile=0x2ec, lpBuffer=0x2629844*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2629844*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0109.893] CloseHandle (hObject=0x2ec) returned 1
	[0109.893] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0109.893] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0109.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0109.893] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7bd50a2a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0109.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0109.893] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0109.894] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpFilePart=0x0) returned 0x3b
	[0109.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0109.894] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x263ac98 | out: lpFileInformation=0x263ac98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0109.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0109.894] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpFilePart=0x0) returned 0x3b
	[0109.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0109.895] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0109.895] GetFileType (hFile=0x2ec) returned 0x1
	[0109.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0109.895] GetFileType (hFile=0x2ec) returned 0x1
	[0109.895] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0109.895] ReadFile (in: hFile=0x2ec, lpBuffer=0x263af60, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x263af60*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0110.133] CloseHandle (hObject=0x2ec) returned 1
	[0110.133] CryptDestroyKey (hKey=0x82b540) returned 1
	[0110.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.133] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26505e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0110.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.133] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0110.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.133] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26506a0*=0x1, dwFlags=0x0) returned 1
	[0110.133] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x265066c, dwFlags=0x0) returned 1
	[0110.134] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26506b0*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x26506b0*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0110.134] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26616cc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26616cc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0110.134] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0110.134] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.134] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.134] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpFilePart=0x0) returned 0x3b
	[0110.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0110.134] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.136] GetFileType (hFile=0x2ec) returned 0x1
	[0110.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0110.136] GetFileType (hFile=0x2ec) returned 0x1
	[0110.136] WriteFile (in: hFile=0x2ec, lpBuffer=0x26506b0*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26506b0*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0110.139] CloseHandle (hObject=0x2ec) returned 1
	[0110.139] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpFilePart=0x0) returned 0x3b
	[0110.139] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6a
	[0110.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0110.139] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7bfb2ffc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0110.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0110.139] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0110.140] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0110.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0110.140] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2661b34 | out: lpFileInformation=0x2661b34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0110.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0110.142] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0110.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0110.143] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.143] GetFileType (hFile=0x2ec) returned 0x1
	[0110.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0110.143] GetFileType (hFile=0x2ec) returned 0x1
	[0110.143] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0110.143] ReadFile (in: hFile=0x2ec, lpBuffer=0x2661dec, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2661dec*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0110.182] CloseHandle (hObject=0x2ec) returned 1
	[0110.182] CryptDestroyKey (hKey=0x82b400) returned 1
	[0110.182] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.182] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2672e88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b0c0) returned 1
	[0110.182] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.182] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.182] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b400) returned 1
	[0110.182] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.182] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2672f40*=0x1, dwFlags=0x0) returned 1
	[0110.182] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2672f0c, dwFlags=0x0) returned 1
	[0110.182] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2672f50*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x2672f50*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0110.182] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2683f6c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2683f6c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0110.182] CryptDestroyKey (hKey=0x82b400) returned 1
	[0110.182] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.182] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.182] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0110.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0110.183] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.184] GetFileType (hFile=0x2ec) returned 0x1
	[0110.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0110.184] GetFileType (hFile=0x2ec) returned 0x1
	[0110.184] WriteFile (in: hFile=0x2ec, lpBuffer=0x2672f50*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2672f50*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0110.186] CloseHandle (hObject=0x2ec) returned 1
	[0110.187] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", lpFilePart=0x0) returned 0x39
	[0110.187] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0110.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0110.187] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7c025714, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0110.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0110.187] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0110.188] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0110.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0110.188] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26843bc | out: lpFileInformation=0x26843bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0110.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0110.188] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0110.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0110.189] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.189] GetFileType (hFile=0x2ec) returned 0x1
	[0110.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0110.189] GetFileType (hFile=0x2ec) returned 0x1
	[0110.189] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0110.189] ReadFile (in: hFile=0x2ec, lpBuffer=0x2684664, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2684664*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0110.234] CloseHandle (hObject=0x2ec) returned 1
	[0110.234] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0110.234] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.234] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2695700, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0110.234] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.234] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.234] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0110.234] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.234] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26957b8*=0x1, dwFlags=0x0) returned 1
	[0110.234] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2695784, dwFlags=0x0) returned 1
	[0110.235] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26957c8*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x26957c8*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0110.235] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a67e4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26a67e4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0110.235] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0110.235] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.235] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.235] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0110.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0110.235] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.237] GetFileType (hFile=0x2ec) returned 0x1
	[0110.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0110.237] GetFileType (hFile=0x2ec) returned 0x1
	[0110.237] WriteFile (in: hFile=0x2ec, lpBuffer=0x26957c8*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26957c8*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0110.239] CloseHandle (hObject=0x2ec) returned 1
	[0110.239] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0110.239] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0110.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0110.239] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7c09acdc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0110.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0110.240] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0110.241] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpFilePart=0x0) returned 0x39
	[0110.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0110.241] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26a6c1c | out: lpFileInformation=0x26a6c1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0110.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0110.241] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpFilePart=0x0) returned 0x39
	[0110.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0110.241] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.242] GetFileType (hFile=0x2ec) returned 0x1
	[0110.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0110.242] GetFileType (hFile=0x2ec) returned 0x1
	[0110.242] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0110.242] ReadFile (in: hFile=0x2ec, lpBuffer=0x26a6ed4, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26a6ed4*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0110.316] CloseHandle (hObject=0x2ec) returned 1
	[0110.316] CryptDestroyKey (hKey=0x82b380) returned 1
	[0110.316] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.317] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b7f70, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b440) returned 1
	[0110.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.317] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0110.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.317] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26b8028*=0x1, dwFlags=0x0) returned 1
	[0110.317] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26b7ff4, dwFlags=0x0) returned 1
	[0110.317] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b8038*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x26b8038*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0110.317] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c9054*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26c9054*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0110.317] CryptDestroyKey (hKey=0x82b340) returned 1
	[0110.317] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.317] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.317] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpFilePart=0x0) returned 0x39
	[0110.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0110.318] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.319] GetFileType (hFile=0x2ec) returned 0x1
	[0110.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0110.319] GetFileType (hFile=0x2ec) returned 0x1
	[0110.319] WriteFile (in: hFile=0x2ec, lpBuffer=0x26b8038*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26b8038*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0110.321] CloseHandle (hObject=0x2ec) returned 1
	[0110.321] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpFilePart=0x0) returned 0x39
	[0110.321] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0110.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0110.321] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7c156a38, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0110.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0110.322] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0110.323] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpFilePart=0x0) returned 0x38
	[0110.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0110.323] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26c94a4 | out: lpFileInformation=0x26c94a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000)) returned 1
	[0110.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0110.323] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpFilePart=0x0) returned 0x38
	[0110.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0110.324] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.324] GetFileType (hFile=0x2ec) returned 0x1
	[0110.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0110.324] GetFileType (hFile=0x2ec) returned 0x1
	[0110.324] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x101000
	[0110.327] ReadFile (in: hFile=0x2ec, lpBuffer=0xdbc3078, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0xdbc3078*, lpNumberOfBytesRead=0x55cf1fc*=0x101000, lpOverlapped=0x0) returned 1
	[0110.479] CloseHandle (hObject=0x2ec) returned 1
	[0110.479] CryptDestroyKey (hKey=0x82b440) returned 1
	[0110.479] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.479] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c97ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0110.479] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.479] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.479] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0110.479] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.479] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26c98a4*=0x1, dwFlags=0x0) returned 1
	[0110.479] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26c9870, dwFlags=0x0) returned 1
	[0110.490] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xdcc4098*, pdwDataLen=0x55cf204*=0x101010, dwBufLen=0x101010 | out: pbData=0xdcc4098*, pdwDataLen=0x55cf204*=0x101010) returned 1
	[0110.491] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c98b4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26c98b4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0110.491] CryptDestroyKey (hKey=0x82b540) returned 1
	[0110.491] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.491] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.491] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpFilePart=0x0) returned 0x38
	[0110.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0110.491] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.493] GetFileType (hFile=0x2ec) returned 0x1
	[0110.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0110.493] GetFileType (hFile=0x2ec) returned 0x1
	[0110.493] WriteFile (in: hFile=0x2ec, lpBuffer=0xdcc4098*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0xdcc4098*, lpNumberOfBytesWritten=0x55cf1f0*=0x101010, lpOverlapped=0x0) returned 1
	[0110.554] CloseHandle (hObject=0x2ec) returned 1
	[0110.554] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpFilePart=0x0) returned 0x38
	[0110.554] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0110.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0110.555] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7c392c16, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x101010)) returned 1
	[0110.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0110.555] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0110.556] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpFilePart=0x0) returned 0x40
	[0110.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0110.556] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26d6df4 | out: lpFileInformation=0x26d6df4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0110.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0110.557] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpFilePart=0x0) returned 0x40
	[0110.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0110.557] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.557] GetFileType (hFile=0x2ec) returned 0x1
	[0110.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0110.557] GetFileType (hFile=0x2ec) returned 0x1
	[0110.557] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0110.557] ReadFile (in: hFile=0x2ec, lpBuffer=0x26d70ec, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26d70ec*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0110.581] CloseHandle (hObject=0x2ec) returned 1
	[0110.581] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0110.581] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.581] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ec5d4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b100) returned 1
	[0110.581] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.581] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.582] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0110.582] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.582] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x26ec68c*=0x1, dwFlags=0x0) returned 1
	[0110.582] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x26ec658, dwFlags=0x0) returned 1
	[0110.582] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ec69c*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x26ec69c*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0110.582] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fd6b8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26fd6b8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0110.582] CryptDestroyKey (hKey=0x82b080) returned 1
	[0110.582] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.582] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.582] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpFilePart=0x0) returned 0x40
	[0110.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0110.582] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.584] GetFileType (hFile=0x2ec) returned 0x1
	[0110.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0110.584] GetFileType (hFile=0x2ec) returned 0x1
	[0110.584] WriteFile (in: hFile=0x2ec, lpBuffer=0x26ec69c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26ec69c*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0110.586] CloseHandle (hObject=0x2ec) returned 1
	[0110.586] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpFilePart=0x0) returned 0x40
	[0110.587] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0110.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0110.587] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7c3df206, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0110.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0110.587] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0110.589] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpFilePart=0x0) returned 0x3d
	[0110.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0110.589] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26fdb5c | out: lpFileInformation=0x26fdb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0110.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.581] GetFullPathNameW (in: lpFileName="C:\\Logs\\Windows PowerShell.evtx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Windows PowerShell.evtx", lpFilePart=0x0) returned 0x1f
	[0114.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.581] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.582] GetFileType (hFile=0x2ec) returned 0x1
	[0114.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.582] GetFileType (hFile=0x2ec) returned 0x1
	[0114.582] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11000
	[0114.582] ReadFile (in: hFile=0x2ec, lpBuffer=0x2924fb4, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2924fb4*, lpNumberOfBytesRead=0x55cf1fc*=0x11000, lpOverlapped=0x0) returned 1
	[0114.601] CloseHandle (hObject=0x2ec) returned 1
	[0114.601] CryptDestroyKey (hKey=0x82b540) returned 1
	[0114.601] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.601] CryptImportKey (in: hProv=0x7f93c0, pbData=0x295564c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0114.601] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.601] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.601] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0114.601] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.601] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2955704*=0x1, dwFlags=0x0) returned 1
	[0114.601] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x29556d0, dwFlags=0x0) returned 1
	[0114.601] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2955714*, pdwDataLen=0x55cf204*=0x11010, dwBufLen=0x11010 | out: pbData=0x2955714*, pdwDataLen=0x55cf204*=0x11010) returned 1
	[0114.602] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2966730*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2966730*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.602] CryptDestroyKey (hKey=0x82b480) returned 1
	[0114.602] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.602] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.602] GetFullPathNameW (in: lpFileName="C:\\Logs\\Windows PowerShell.evtx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Windows PowerShell.evtx", lpFilePart=0x0) returned 0x1f
	[0114.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.602] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.603] GetFileType (hFile=0x2ec) returned 0x1
	[0114.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0114.603] GetFileType (hFile=0x2ec) returned 0x1
	[0114.603] WriteFile (in: hFile=0x2ec, lpBuffer=0x2955714*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2955714*, lpNumberOfBytesWritten=0x55cf1f0*=0x11010, lpOverlapped=0x0) returned 1
	[0114.605] CloseHandle (hObject=0x2ec) returned 1
	[0114.606] GetFullPathNameW (in: lpFileName="C:\\Logs\\Windows PowerShell.evtx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Windows PowerShell.evtx", lpFilePart=0x0) returned 0x1f
	[0114.606] GetFullPathNameW (in: lpFileName="C:\\Logs\\Windows PowerShell.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Windows PowerShell.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x4e
	[0114.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0114.606] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7ea346f2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0114.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0114.606] MoveFileW (lpExistingFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), lpNewFileName="C:\\Logs\\Windows PowerShell.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\windows powershell.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.607] GetFullPathNameW (in: lpFileName="C:\\Recovery\\ReAgentOld.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\ReAgentOld.xml", lpFilePart=0x0) returned 0x1a
	[0114.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.607] GetFileAttributesExW (in: lpFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), fInfoLevelId=0x0, lpFileInformation=0x2966a48 | out: lpFileInformation=0x2966a48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee)) returned 1
	[0114.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.607] GetFullPathNameW (in: lpFileName="C:\\Recovery\\ReAgentOld.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\ReAgentOld.xml", lpFilePart=0x0) returned 0x1a
	[0114.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.607] CreateFileW (lpFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.607] GetFileType (hFile=0x2ec) returned 0x1
	[0114.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.608] GetFileType (hFile=0x2ec) returned 0x1
	[0114.608] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x3ee
	[0114.608] ReadFile (in: hFile=0x2ec, lpBuffer=0x2966ffc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2966ffc*, lpNumberOfBytesRead=0x55cf1fc*=0x3ee, lpOverlapped=0x0) returned 1
	[0114.700] CloseHandle (hObject=0x2ec) returned 1
	[0114.700] CryptDestroyKey (hKey=0x82b280) returned 1
	[0114.700] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.700] CryptImportKey (in: hProv=0x7f93c0, pbData=0x29a6ccc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b440) returned 1
	[0114.700] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.700] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.700] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0114.701] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.701] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x29a6d84*=0x1, dwFlags=0x0) returned 1
	[0114.701] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x29a6d50, dwFlags=0x0) returned 1
	[0114.701] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29a6d94*, pdwDataLen=0x55cf204*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x29a6d94*, pdwDataLen=0x55cf204*=0x3f0) returned 1
	[0114.701] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29a7190*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x29a7190*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.701] CryptDestroyKey (hKey=0x82b300) returned 1
	[0114.701] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.701] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.701] GetFullPathNameW (in: lpFileName="C:\\Recovery\\ReAgentOld.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\ReAgentOld.xml", lpFilePart=0x0) returned 0x1a
	[0114.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.701] CreateFileW (lpFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.702] GetFileType (hFile=0x2ec) returned 0x1
	[0114.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0114.702] GetFileType (hFile=0x2ec) returned 0x1
	[0114.702] WriteFile (in: hFile=0x2ec, lpBuffer=0x29a7278*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x29a7278*, lpNumberOfBytesWritten=0x55cf1c4*=0x3f0, lpOverlapped=0x0) returned 1
	[0114.703] CloseHandle (hObject=0x2ec) returned 1
	[0114.703] GetFullPathNameW (in: lpFileName="C:\\Recovery\\ReAgentOld.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\ReAgentOld.xml", lpFilePart=0x0) returned 0x1a
	[0114.703] GetFullPathNameW (in: lpFileName="C:\\Recovery\\ReAgentOld.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\ReAgentOld.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x49
	[0114.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0114.703] GetFileAttributesExW (in: lpFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7eb3d3a5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1
	[0114.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0114.703] MoveFileW (lpExistingFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), lpNewFileName="C:\\Recovery\\ReAgentOld.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\recovery\\reagentold.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.704] GetFullPathNameW (in: lpFileName="C:\\Users\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\desktop.ini", lpFilePart=0x0) returned 0x14
	[0114.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.704] GetFileAttributesExW (in: lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x29a8470 | out: lpFileInformation=0x29a8470*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae)) returned 1
	[0114.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.705] GetFullPathNameW (in: lpFileName="C:\\Users\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\desktop.ini", lpFilePart=0x0) returned 0x14
	[0114.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.705] CreateFileW (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.705] GetFileType (hFile=0x2ec) returned 0x1
	[0114.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.705] GetFileType (hFile=0x2ec) returned 0x1
	[0114.705] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xae
	[0114.705] ReadFile (in: hFile=0x2ec, lpBuffer=0x29a86bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x29a86bc*, lpNumberOfBytesRead=0x55cf1fc*=0xae, lpOverlapped=0x0) returned 1
	[0114.706] CloseHandle (hObject=0x2ec) returned 1
	[0114.706] CryptDestroyKey (hKey=0x82b440) returned 1
	[0114.706] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.706] CryptImportKey (in: hProv=0x7f93c0, pbData=0x29a9758, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0114.706] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.706] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.706] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0114.706] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.706] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x29a9810*=0x1, dwFlags=0x0) returned 1
	[0114.706] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x29a97dc, dwFlags=0x0) returned 1
	[0114.706] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29a9820*, pdwDataLen=0x55cf204*=0xb0, dwBufLen=0xb0 | out: pbData=0x29a9820*, pdwDataLen=0x55cf204*=0xb0) returned 1
	[0114.706] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29a98dc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x29a98dc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.706] CryptDestroyKey (hKey=0x82b480) returned 1
	[0114.706] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.706] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.707] GetFullPathNameW (in: lpFileName="C:\\Users\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\desktop.ini", lpFilePart=0x0) returned 0x14
	[0114.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.707] CreateFileW (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0114.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0114.708] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", lpFilePart=0x0) returned 0x39
	[0114.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.708] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), fInfoLevelId=0x0, lpFileInformation=0x29a9d44 | out: lpFileInformation=0x29a9d44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2)) returned 1
	[0114.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.709] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", lpFilePart=0x0) returned 0x39
	[0114.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.709] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.710] GetFileType (hFile=0x2ec) returned 0x1
	[0114.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.710] GetFileType (hFile=0x2ec) returned 0x1
	[0114.710] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xa6b2
	[0114.710] ReadFile (in: hFile=0x2ec, lpBuffer=0x29abaec, nNumberOfBytesToRead=0xa6b2, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x29abaec*, lpNumberOfBytesRead=0x55cf1fc*=0xa6b2, lpOverlapped=0x0) returned 1
	[0114.714] CloseHandle (hObject=0x2ec) returned 1
	[0114.714] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0114.714] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.714] CryptImportKey (in: hProv=0x7f93c0, pbData=0x29bd67c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0114.714] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.714] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.714] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0114.714] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.714] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x29bd734*=0x1, dwFlags=0x0) returned 1
	[0114.714] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x29bd700, dwFlags=0x0) returned 1
	[0114.714] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29bd744*, pdwDataLen=0x55cf204*=0xa6c0, dwBufLen=0xa6c0 | out: pbData=0x29bd744*, pdwDataLen=0x55cf204*=0xa6c0) returned 1
	[0114.714] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29c7e10*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x29c7e10*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.714] CryptDestroyKey (hKey=0x82b280) returned 1
	[0114.714] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.714] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.715] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", lpFilePart=0x0) returned 0x39
	[0114.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.715] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.716] GetFileType (hFile=0x2ec) returned 0x1
	[0114.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0114.716] GetFileType (hFile=0x2ec) returned 0x1
	[0114.716] WriteFile (in: hFile=0x2ec, lpBuffer=0x29bd744*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x29bd744*, lpNumberOfBytesWritten=0x55cf1f0*=0xa6c0, lpOverlapped=0x0) returned 1
	[0114.717] CloseHandle (hObject=0x2ec) returned 1
	[0114.717] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", lpFilePart=0x0) returned 0x39
	[0114.718] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0114.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0114.718] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x7eb3d3a5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xa6c0)) returned 1
	[0114.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0114.718] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.718] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", lpFilePart=0x0) returned 0x34
	[0114.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.718] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), fInfoLevelId=0x0, lpFileInformation=0x29c8248 | out: lpFileInformation=0x29c8248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774)) returned 1
	[0114.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.719] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", lpFilePart=0x0) returned 0x34
	[0114.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.720] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.720] GetFileType (hFile=0x2ec) returned 0x1
	[0114.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.720] GetFileType (hFile=0x2ec) returned 0x1
	[0114.720] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1774
	[0114.720] ReadFile (in: hFile=0x2ec, lpBuffer=0x29c84b0, nNumberOfBytesToRead=0x1774, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x29c84b0*, lpNumberOfBytesRead=0x55cf1fc*=0x1774, lpOverlapped=0x0) returned 1
	[0114.739] CloseHandle (hObject=0x2ec) returned 1
	[0114.739] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0114.739] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.739] CryptImportKey (in: hProv=0x7f93c0, pbData=0x29edaa0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0114.739] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.739] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.739] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0114.740] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.740] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x29edb58*=0x1, dwFlags=0x0) returned 1
	[0114.740] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x29edb24, dwFlags=0x0) returned 1
	[0114.740] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29edb68*, pdwDataLen=0x55cf204*=0x1780, dwBufLen=0x1780 | out: pbData=0x29edb68*, pdwDataLen=0x55cf204*=0x1780) returned 1
	[0114.740] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29ef2f4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x29ef2f4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.740] CryptDestroyKey (hKey=0x82b340) returned 1
	[0114.740] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.740] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.740] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", lpFilePart=0x0) returned 0x34
	[0114.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.740] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.741] GetFileType (hFile=0x2ec) returned 0x1
	[0114.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0114.741] GetFileType (hFile=0x2ec) returned 0x1
	[0114.741] WriteFile (in: hFile=0x2ec, lpBuffer=0x29edb68*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x29edb68*, lpNumberOfBytesWritten=0x55cf1f0*=0x1780, lpOverlapped=0x0) returned 1
	[0114.742] CloseHandle (hObject=0x2ec) returned 1
	[0114.742] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", lpFilePart=0x0) returned 0x34
	[0114.742] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x63
	[0114.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0114.742] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7eb897e7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1780)) returned 1
	[0114.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0114.742] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.743] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", lpFilePart=0x0) returned 0x32
	[0114.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.743] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), fInfoLevelId=0x0, lpFileInformation=0x29ef6f0 | out: lpFileInformation=0x29ef6f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28)) returned 1
	[0114.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.743] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", lpFilePart=0x0) returned 0x32
	[0114.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.744] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.744] GetFileType (hFile=0x2ec) returned 0x1
	[0114.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.744] GetFileType (hFile=0x2ec) returned 0x1
	[0114.744] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x28
	[0114.744] ReadFile (in: hFile=0x2ec, lpBuffer=0x29ef97c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x29ef97c*, lpNumberOfBytesRead=0x55cf1fc*=0x28, lpOverlapped=0x0) returned 1
	[0114.745] CloseHandle (hObject=0x2ec) returned 1
	[0114.745] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0114.745] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.745] CryptImportKey (in: hProv=0x7f93c0, pbData=0x29f0a18, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0114.745] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.745] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.745] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0114.745] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.745] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x29f0ad0*=0x1, dwFlags=0x0) returned 1
	[0114.745] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x29f0a9c, dwFlags=0x0) returned 1
	[0114.745] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29f0ae0*, pdwDataLen=0x55cf204*=0x30, dwBufLen=0x30 | out: pbData=0x29f0ae0*, pdwDataLen=0x55cf204*=0x30) returned 1
	[0114.746] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29f0b1c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x29f0b1c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.746] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0114.746] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.746] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.746] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", lpFilePart=0x0) returned 0x32
	[0114.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.746] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.747] GetFileType (hFile=0x2ec) returned 0x1
	[0114.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0114.747] GetFileType (hFile=0x2ec) returned 0x1
	[0114.747] WriteFile (in: hFile=0x2ec, lpBuffer=0x29f0c54*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x29f0c54*, lpNumberOfBytesWritten=0x55cf1c4*=0x30, lpOverlapped=0x0) returned 1
	[0114.748] CloseHandle (hObject=0x2ec) returned 1
	[0114.748] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", lpFilePart=0x0) returned 0x32
	[0114.748] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0114.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0114.748] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7eb897e7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x30)) returned 1
	[0114.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0114.748] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.749] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", lpFilePart=0x0) returned 0x28
	[0114.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.749] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), fInfoLevelId=0x0, lpFileInformation=0x29f1f0c | out: lpFileInformation=0x29f1f0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8)) returned 1
	[0114.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.782] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", lpFilePart=0x0) returned 0x28
	[0114.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.782] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0114.782] GetFileType (hFile=0x5dc) returned 0x1
	[0114.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.782] GetFileType (hFile=0x5dc) returned 0x1
	[0114.782] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x232c8
	[0114.782] ReadFile (in: hFile=0x5dc, lpBuffer=0x9854bd0, nNumberOfBytesToRead=0x232c8, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x9854bd0*, lpNumberOfBytesRead=0x55cf1fc*=0x232c8, lpOverlapped=0x0) returned 1
	[0114.829] CloseHandle (hObject=0x5dc) returned 1
	[0114.829] CryptDestroyKey (hKey=0x82b540) returned 1
	[0114.829] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.829] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2618d58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b100) returned 1
	[0114.829] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.829] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.829] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0114.829] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.829] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2618e10*=0x1, dwFlags=0x0) returned 1
	[0114.830] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2618ddc, dwFlags=0x0) returned 1
	[0114.832] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9877eb8*, pdwDataLen=0x55cf204*=0x232d0, dwBufLen=0x232d0 | out: pbData=0x9877eb8*, pdwDataLen=0x55cf204*=0x232d0) returned 1
	[0114.832] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2618e20*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2618e20*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.832] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0114.832] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.832] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.832] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", lpFilePart=0x0) returned 0x28
	[0114.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.832] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0114.834] GetFileType (hFile=0x5dc) returned 0x1
	[0114.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0114.834] GetFileType (hFile=0x5dc) returned 0x1
	[0114.834] WriteFile (in: hFile=0x5dc, lpBuffer=0x9877eb8*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x9877eb8*, lpNumberOfBytesWritten=0x55cf1f0*=0x232d0, lpOverlapped=0x0) returned 1
	[0114.836] CloseHandle (hObject=0x5dc) returned 1
	[0114.837] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", lpFilePart=0x0) returned 0x28
	[0114.837] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0114.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0114.837] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x7ec6e810, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x232d0)) returned 1
	[0114.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0114.837] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.837] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", lpFilePart=0x0) returned 0x2c
	[0114.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.838] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), fInfoLevelId=0x0, lpFileInformation=0x2619188 | out: lpFileInformation=0x2619188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c)) returned 1
	[0114.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.851] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", lpFilePart=0x0) returned 0x2c
	[0114.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.852] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.852] GetFileType (hFile=0x2ec) returned 0x1
	[0114.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.852] GetFileType (hFile=0x2ec) returned 0x1
	[0114.852] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x9c
	[0114.852] ReadFile (in: hFile=0x2ec, lpBuffer=0x26247e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26247e8*, lpNumberOfBytesRead=0x55cf1fc*=0x9c, lpOverlapped=0x0) returned 1
	[0114.854] CloseHandle (hObject=0x2ec) returned 1
	[0114.854] CryptDestroyKey (hKey=0x82b100) returned 1
	[0114.854] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.854] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2625884, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b480) returned 1
	[0114.854] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.854] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.854] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0114.854] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.854] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x262593c*=0x1, dwFlags=0x0) returned 1
	[0114.854] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2625908, dwFlags=0x0) returned 1
	[0114.854] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262594c*, pdwDataLen=0x55cf204*=0xa0, dwBufLen=0xa0 | out: pbData=0x262594c*, pdwDataLen=0x55cf204*=0xa0) returned 1
	[0114.854] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26259f8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26259f8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.854] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0114.854] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.854] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.854] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", lpFilePart=0x0) returned 0x2c
	[0114.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.854] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.855] GetFileType (hFile=0x2ec) returned 0x1
	[0114.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0114.856] GetFileType (hFile=0x2ec) returned 0x1
	[0114.856] WriteFile (in: hFile=0x2ec, lpBuffer=0x2625b14*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2625b14*, lpNumberOfBytesWritten=0x55cf1c4*=0xa0, lpOverlapped=0x0) returned 1
	[0114.856] CloseHandle (hObject=0x2ec) returned 1
	[0114.856] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", lpFilePart=0x0) returned 0x2c
	[0114.857] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0114.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0114.857] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x7ec9490f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xa0)) returned 1
	[0114.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0114.857] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.857] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", lpFilePart=0x0) returned 0x2e
	[0114.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.857] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), fInfoLevelId=0x0, lpFileInformation=0x2626d9c | out: lpFileInformation=0x2626d9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241)) returned 1
	[0114.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.858] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", lpFilePart=0x0) returned 0x2e
	[0114.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.858] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.858] GetFileType (hFile=0x2ec) returned 0x1
	[0114.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.858] GetFileType (hFile=0x2ec) returned 0x1
	[0114.858] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x241
	[0114.858] ReadFile (in: hFile=0x2ec, lpBuffer=0x262721c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x262721c*, lpNumberOfBytesRead=0x55cf1fc*=0x241, lpOverlapped=0x0) returned 1
	[0114.887] CloseHandle (hObject=0x2ec) returned 1
	[0114.887] CryptDestroyKey (hKey=0x82b480) returned 1
	[0114.887] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.887] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263a0f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b080) returned 1
	[0114.887] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.887] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.887] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0114.887] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.887] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x263a1b0*=0x1, dwFlags=0x0) returned 1
	[0114.887] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x263a17c, dwFlags=0x0) returned 1
	[0114.887] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263a1c0*, pdwDataLen=0x55cf204*=0x250, dwBufLen=0x250 | out: pbData=0x263a1c0*, pdwDataLen=0x55cf204*=0x250) returned 1
	[0114.887] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263a41c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x263a41c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.887] CryptDestroyKey (hKey=0x82b540) returned 1
	[0114.887] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.887] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.887] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", lpFilePart=0x0) returned 0x2e
	[0114.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.887] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.889] GetFileType (hFile=0x2ec) returned 0x1
	[0114.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0114.889] GetFileType (hFile=0x2ec) returned 0x1
	[0114.889] WriteFile (in: hFile=0x2ec, lpBuffer=0x263a540*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x263a540*, lpNumberOfBytesWritten=0x55cf1c4*=0x250, lpOverlapped=0x0) returned 1
	[0114.890] CloseHandle (hObject=0x2ec) returned 1
	[0114.890] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", lpFilePart=0x0) returned 0x2e
	[0114.890] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0114.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0114.890] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x7ece0e89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1
	[0114.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0114.890] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.891] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", lpFilePart=0x0) returned 0x21
	[0114.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.891] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x263b7d8 | out: lpFileInformation=0x263b7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a)) returned 1
	[0114.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.892] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", lpFilePart=0x0) returned 0x21
	[0114.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.892] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.892] GetFileType (hFile=0x2ec) returned 0x1
	[0114.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.893] GetFileType (hFile=0x2ec) returned 0x1
	[0114.893] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x4a
	[0114.893] ReadFile (in: hFile=0x2ec, lpBuffer=0x263b9f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x263b9f0*, lpNumberOfBytesRead=0x55cf1fc*=0x4a, lpOverlapped=0x0) returned 1
	[0114.894] CloseHandle (hObject=0x2ec) returned 1
	[0114.894] CryptDestroyKey (hKey=0x82b080) returned 1
	[0114.894] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.894] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263ca8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0114.894] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.894] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.894] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0114.894] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.894] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x263cb44*=0x1, dwFlags=0x0) returned 1
	[0114.894] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x263cb10, dwFlags=0x0) returned 1
	[0114.894] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263cb54*, pdwDataLen=0x55cf204*=0x50, dwBufLen=0x50 | out: pbData=0x263cb54*, pdwDataLen=0x55cf204*=0x50) returned 1
	[0114.895] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263cbb0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x263cbb0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.895] CryptDestroyKey (hKey=0x82b000) returned 1
	[0114.895] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.895] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.895] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", lpFilePart=0x0) returned 0x21
	[0114.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.895] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.896] GetFileType (hFile=0x2ec) returned 0x1
	[0114.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0114.896] GetFileType (hFile=0x2ec) returned 0x1
	[0114.896] WriteFile (in: hFile=0x2ec, lpBuffer=0x263cc9c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x263cc9c*, lpNumberOfBytesWritten=0x55cf1c4*=0x50, lpOverlapped=0x0) returned 1
	[0114.897] CloseHandle (hObject=0x2ec) returned 1
	[0114.897] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", lpFilePart=0x0) returned 0x21
	[0114.897] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\preoobe.cmd id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x50
	[0114.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0114.897] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x7ed0708e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1
	[0114.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0114.898] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.898] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", lpFilePart=0x0) returned 0x27
	[0114.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.898] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), fInfoLevelId=0x0, lpFileInformation=0x263ded0 | out: lpFileInformation=0x263ded0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133)) returned 1
	[0114.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.926] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", lpFilePart=0x0) returned 0x27
	[0114.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.926] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.926] GetFileType (hFile=0x2ec) returned 0x1
	[0114.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.926] GetFileType (hFile=0x2ec) returned 0x1
	[0114.926] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x133
	[0114.926] ReadFile (in: hFile=0x2ec, lpBuffer=0x264ff00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x264ff00*, lpNumberOfBytesRead=0x55cf1fc*=0x133, lpOverlapped=0x0) returned 1
	[0114.936] CloseHandle (hObject=0x2ec) returned 1
	[0114.936] CryptDestroyKey (hKey=0x82b300) returned 1
	[0114.936] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.936] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2658350, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b4c0) returned 1
	[0114.936] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.936] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.936] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0114.936] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.936] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2658408*=0x1, dwFlags=0x0) returned 1
	[0114.936] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26583d4, dwFlags=0x0) returned 1
	[0114.936] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2658418*, pdwDataLen=0x55cf204*=0x140, dwBufLen=0x140 | out: pbData=0x2658418*, pdwDataLen=0x55cf204*=0x140) returned 1
	[0114.936] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2658564*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2658564*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.937] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0114.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.937] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", lpFilePart=0x0) returned 0x27
	[0114.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.937] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.938] GetFileType (hFile=0x2ec) returned 0x1
	[0114.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0114.938] GetFileType (hFile=0x2ec) returned 0x1
	[0114.939] WriteFile (in: hFile=0x2ec, lpBuffer=0x2658668*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2658668*, lpNumberOfBytesWritten=0x55cf1c4*=0x140, lpOverlapped=0x0) returned 1
	[0114.940] CloseHandle (hObject=0x2ec) returned 1
	[0114.940] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", lpFilePart=0x0) returned 0x27
	[0114.940] GetFullPathNameW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0114.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0114.940] GetFileAttributesExW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x7ed797bb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x140)) returned 1
	[0114.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0114.940] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.941] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0114.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.941] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26598cc | out: lpFileInformation=0x26598cc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81)) returned 1
	[0114.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.941] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0114.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.941] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.942] GetFileType (hFile=0x2ec) returned 0x1
	[0114.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.942] GetFileType (hFile=0x2ec) returned 0x1
	[0114.942] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x81
	[0114.942] ReadFile (in: hFile=0x2ec, lpBuffer=0x2659b2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2659b2c*, lpNumberOfBytesRead=0x55cf1fc*=0x81, lpOverlapped=0x0) returned 1
	[0114.943] CloseHandle (hObject=0x2ec) returned 1
	[0114.943] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0114.943] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.943] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265abc8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0114.943] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.943] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.944] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0114.944] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.944] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x265ac80*=0x1, dwFlags=0x0) returned 1
	[0114.944] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x265ac4c, dwFlags=0x0) returned 1
	[0114.944] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265ac90*, pdwDataLen=0x55cf204*=0x90, dwBufLen=0x90 | out: pbData=0x265ac90*, pdwDataLen=0x55cf204*=0x90) returned 1
	[0114.944] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265ad2c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x265ad2c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.944] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0114.944] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.944] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.944] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0114.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.944] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0114.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0114.946] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", lpFilePart=0x0) returned 0x49
	[0114.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.946] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x265b214 | out: lpFileInformation=0x265b214*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81)) returned 1
	[0114.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.947] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", lpFilePart=0x0) returned 0x49
	[0114.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.947] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.947] GetFileType (hFile=0x2ec) returned 0x1
	[0114.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.947] GetFileType (hFile=0x2ec) returned 0x1
	[0114.947] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x81
	[0114.947] ReadFile (in: hFile=0x2ec, lpBuffer=0x265b504, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x265b504*, lpNumberOfBytesRead=0x55cf1fc*=0x81, lpOverlapped=0x0) returned 1
	[0114.948] CloseHandle (hObject=0x2ec) returned 1
	[0114.948] CryptDestroyKey (hKey=0x82b280) returned 1
	[0114.948] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.948] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265c5a0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0114.948] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.948] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.948] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0114.949] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.949] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x265c658*=0x1, dwFlags=0x0) returned 1
	[0114.949] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x265c624, dwFlags=0x0) returned 1
	[0114.949] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265c668*, pdwDataLen=0x55cf204*=0x90, dwBufLen=0x90 | out: pbData=0x265c668*, pdwDataLen=0x55cf204*=0x90) returned 1
	[0114.949] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265c704*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x265c704*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.949] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0114.949] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.949] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.949] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", lpFilePart=0x0) returned 0x49
	[0114.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.949] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0114.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0114.951] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0114.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.951] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x265cde4 | out: lpFileInformation=0x265cde4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f)) returned 1
	[0114.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.952] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0114.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.952] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.953] GetFileType (hFile=0x2ec) returned 0x1
	[0114.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.953] GetFileType (hFile=0x2ec) returned 0x1
	[0114.953] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1d8f
	[0114.953] ReadFile (in: hFile=0x2ec, lpBuffer=0x265cfa4, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x265cfa4*, lpNumberOfBytesRead=0x55cf1fc*=0x1d8f, lpOverlapped=0x0) returned 1
	[0114.967] CloseHandle (hObject=0x2ec) returned 1
	[0114.967] CryptDestroyKey (hKey=0x82b300) returned 1
	[0114.967] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.967] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2669408, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b4c0) returned 1
	[0114.968] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.968] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.968] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0114.968] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.968] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26694c0*=0x1, dwFlags=0x0) returned 1
	[0114.968] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x266948c, dwFlags=0x0) returned 1
	[0114.968] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26694d0*, pdwDataLen=0x55cf204*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x26694d0*, pdwDataLen=0x55cf204*=0x1d90) returned 1
	[0114.968] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266b26c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x266b26c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0114.968] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0114.968] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.969] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.969] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0114.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0114.969] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.970] GetFileType (hFile=0x2ec) returned 0x1
	[0114.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0114.970] GetFileType (hFile=0x2ec) returned 0x1
	[0114.970] WriteFile (in: hFile=0x2ec, lpBuffer=0x26694d0*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26694d0*, lpNumberOfBytesWritten=0x55cf1f0*=0x1d90, lpOverlapped=0x0) returned 1
	[0114.971] CloseHandle (hObject=0x2ec) returned 1
	[0114.971] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0114.971] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0114.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0114.972] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7edc5dd9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d90)) returned 1
	[0114.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0114.972] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.974] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0114.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0114.974] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x266b708 | out: lpFileInformation=0x266b708*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6)) returned 1
	[0114.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0114.975] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0114.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0114.975] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.975] GetFileType (hFile=0x2ec) returned 0x1
	[0114.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0114.975] GetFileType (hFile=0x2ec) returned 0x1
	[0114.975] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x121e6
	[0114.975] ReadFile (in: hFile=0x2ec, lpBuffer=0x266b910, nNumberOfBytesToRead=0x121e6, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x266b910*, lpNumberOfBytesRead=0x55cf1fc*=0x121e6, lpOverlapped=0x0) returned 1
	[0114.999] CloseHandle (hObject=0x2ec) returned 1
	[0114.999] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0114.999] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.999] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268fcb0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0114.999] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.999] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.999] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0114.999] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.999] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x268fd68*=0x1, dwFlags=0x0) returned 1
	[0114.999] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x268fd34, dwFlags=0x0) returned 1
	[0115.000] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268fd78*, pdwDataLen=0x55cf204*=0x121f0, dwBufLen=0x121f0 | out: pbData=0x268fd78*, pdwDataLen=0x55cf204*=0x121f0) returned 1
	[0115.000] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a1f74*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26a1f74*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0115.000] CryptDestroyKey (hKey=0x82b100) returned 1
	[0115.000] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.000] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.000] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0115.000] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.002] GetFileType (hFile=0x2ec) returned 0x1
	[0115.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0115.002] GetFileType (hFile=0x2ec) returned 0x1
	[0115.002] WriteFile (in: hFile=0x2ec, lpBuffer=0x268fd78*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x268fd78*, lpNumberOfBytesWritten=0x55cf1f0*=0x121f0, lpOverlapped=0x0) returned 1
	[0115.004] CloseHandle (hObject=0x2ec) returned 1
	[0115.004] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.004] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0115.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0115.004] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7ee120b2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x121f0)) returned 1
	[0115.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0115.005] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.005] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0115.005] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x26a2300 | out: lpFileInformation=0x26a2300*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358)) returned 1
	[0115.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0115.006] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0115.006] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.006] GetFileType (hFile=0x2ec) returned 0x1
	[0115.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0115.006] GetFileType (hFile=0x2ec) returned 0x1
	[0115.006] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x4358
	[0115.006] ReadFile (in: hFile=0x2ec, lpBuffer=0x26a2510, nNumberOfBytesToRead=0x4358, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26a2510*, lpNumberOfBytesRead=0x55cf1fc*=0x4358, lpOverlapped=0x0) returned 1
	[0115.030] CloseHandle (hObject=0x2ec) returned 1
	[0115.030] CryptDestroyKey (hKey=0x82b540) returned 1
	[0115.030] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.050] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d17e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0115.050] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.051] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.051] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b0c0) returned 1
	[0115.051] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.051] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26d18a0*=0x1, dwFlags=0x0) returned 1
	[0115.051] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x26d186c, dwFlags=0x0) returned 1
	[0115.051] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d18b0*, pdwDataLen=0x55cf204*=0x4360, dwBufLen=0x4360 | out: pbData=0x26d18b0*, pdwDataLen=0x55cf204*=0x4360) returned 1
	[0115.051] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d5c1c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26d5c1c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0115.051] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0115.051] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.051] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.051] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0115.051] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.052] GetFileType (hFile=0x2ec) returned 0x1
	[0115.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0115.052] GetFileType (hFile=0x2ec) returned 0x1
	[0115.052] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d18b0*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26d18b0*, lpNumberOfBytesWritten=0x55cf1f0*=0x4360, lpOverlapped=0x0) returned 1
	[0115.053] CloseHandle (hObject=0x2ec) returned 1
	[0115.053] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.053] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0115.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0115.053] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7ee84845, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4360)) returned 1
	[0115.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0115.054] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.054] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0115.054] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x26d5fb8 | out: lpFileInformation=0x26d5fb8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5)) returned 1
	[0115.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0115.055] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0115.055] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.055] GetFileType (hFile=0x2ec) returned 0x1
	[0115.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0115.055] GetFileType (hFile=0x2ec) returned 0x1
	[0115.055] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x18a5
	[0115.055] ReadFile (in: hFile=0x2ec, lpBuffer=0x26d6178, nNumberOfBytesToRead=0x18a5, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26d6178*, lpNumberOfBytesRead=0x55cf1fc*=0x18a5, lpOverlapped=0x0) returned 1
	[0115.114] CloseHandle (hObject=0x2ec) returned 1
	[0115.114] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0115.114] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.114] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e2408, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0115.114] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.114] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.114] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b200) returned 1
	[0115.114] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.114] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26e24c0*=0x1, dwFlags=0x0) returned 1
	[0115.114] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26e248c, dwFlags=0x0) returned 1
	[0115.114] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e24d0*, pdwDataLen=0x55cf204*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x26e24d0*, pdwDataLen=0x55cf204*=0x18b0) returned 1
	[0115.114] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e3d8c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26e3d8c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0115.114] CryptDestroyKey (hKey=0x82b200) returned 1
	[0115.114] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.114] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.114] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0115.114] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.115] GetFileType (hFile=0x2ec) returned 0x1
	[0115.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0115.115] GetFileType (hFile=0x2ec) returned 0x1
	[0115.116] WriteFile (in: hFile=0x2ec, lpBuffer=0x26e24d0*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26e24d0*, lpNumberOfBytesWritten=0x55cf1f0*=0x18b0, lpOverlapped=0x0) returned 1
	[0115.116] CloseHandle (hObject=0x2ec) returned 1
	[0115.116] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.117] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0115.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0115.117] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7ef1d2aa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x18b0)) returned 1
	[0115.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0115.117] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.157] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0115.157] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2712d78 | out: lpFileInformation=0x2712d78*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90)) returned 1
	[0115.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0115.158] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0115.158] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.158] GetFileType (hFile=0x2ec) returned 0x1
	[0115.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0115.158] GetFileType (hFile=0x2ec) returned 0x1
	[0115.158] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xed90
	[0115.158] ReadFile (in: hFile=0x2ec, lpBuffer=0x2712f80, nNumberOfBytesToRead=0xed90, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2712f80*, lpNumberOfBytesRead=0x55cf1fc*=0xed90, lpOverlapped=0x0) returned 1
	[0115.168] CloseHandle (hObject=0x2ec) returned 1
	[0115.168] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0115.168] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.168] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272ac2c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0115.168] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.168] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.168] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0115.168] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.168] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x272ace4*=0x1, dwFlags=0x0) returned 1
	[0115.168] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x272acb0, dwFlags=0x0) returned 1
	[0115.169] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272acf4*, pdwDataLen=0x55cf204*=0xeda0, dwBufLen=0xeda0 | out: pbData=0x272acf4*, pdwDataLen=0x55cf204*=0xeda0) returned 1
	[0115.169] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2739aa0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2739aa0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0115.169] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0115.169] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.169] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.169] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0115.169] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.171] GetFileType (hFile=0x2ec) returned 0x1
	[0115.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0115.171] GetFileType (hFile=0x2ec) returned 0x1
	[0115.171] WriteFile (in: hFile=0x2ec, lpBuffer=0x272acf4*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x272acf4*, lpNumberOfBytesWritten=0x55cf1f0*=0xeda0, lpOverlapped=0x0) returned 1
	[0115.173] CloseHandle (hObject=0x2ec) returned 1
	[0115.173] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.173] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0115.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0115.174] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7efb5afa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xeda0)) returned 1
	[0115.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0115.174] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.175] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0115.175] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x2739e2c | out: lpFileInformation=0x2739e2c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758)) returned 1
	[0115.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0115.176] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0115.176] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.176] GetFileType (hFile=0x2ec) returned 0x1
	[0115.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0115.176] GetFileType (hFile=0x2ec) returned 0x1
	[0115.176] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x3758
	[0115.176] ReadFile (in: hFile=0x2ec, lpBuffer=0x273a03c, nNumberOfBytesToRead=0x3758, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x273a03c*, lpNumberOfBytesRead=0x55cf1fc*=0x3758, lpOverlapped=0x0) returned 1
	[0115.196] CloseHandle (hObject=0x2ec) returned 1
	[0115.196] CryptDestroyKey (hKey=0x82b540) returned 1
	[0115.196] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.196] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275449c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b480) returned 1
	[0115.196] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.196] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.196] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0115.196] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.196] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2754554*=0x1, dwFlags=0x0) returned 1
	[0115.196] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2754520, dwFlags=0x0) returned 1
	[0115.197] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2754564*, pdwDataLen=0x55cf204*=0x3760, dwBufLen=0x3760 | out: pbData=0x2754564*, pdwDataLen=0x55cf204*=0x3760) returned 1
	[0115.197] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2757cd0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2757cd0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0115.197] CryptDestroyKey (hKey=0x82b380) returned 1
	[0115.197] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.197] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.197] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0115.197] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.198] GetFileType (hFile=0x2ec) returned 0x1
	[0115.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0115.198] GetFileType (hFile=0x2ec) returned 0x1
	[0115.198] WriteFile (in: hFile=0x2ec, lpBuffer=0x2754564*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2754564*, lpNumberOfBytesWritten=0x55cf1f0*=0x3760, lpOverlapped=0x0) returned 1
	[0115.199] CloseHandle (hObject=0x2ec) returned 1
	[0115.200] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.200] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0115.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0115.200] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7efe9099, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3760)) returned 1
	[0115.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0115.200] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.200] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0115.201] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x275806c | out: lpFileInformation=0x275806c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e)) returned 1
	[0115.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0115.214] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0115.214] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.214] GetFileType (hFile=0x2ec) returned 0x1
	[0115.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0115.214] GetFileType (hFile=0x2ec) returned 0x1
	[0115.214] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xe8e
	[0115.214] ReadFile (in: hFile=0x2ec, lpBuffer=0x276ae00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x276ae00*, lpNumberOfBytesRead=0x55cf1fc*=0xe8e, lpOverlapped=0x0) returned 1
	[0115.240] CloseHandle (hObject=0x2ec) returned 1
	[0115.240] CryptDestroyKey (hKey=0x82b480) returned 1
	[0115.240] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.240] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278fa04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0115.240] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.240] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.240] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0115.240] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.240] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x278fabc*=0x1, dwFlags=0x0) returned 1
	[0115.240] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x278fa88, dwFlags=0x0) returned 1
	[0115.240] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278facc*, pdwDataLen=0x55cf204*=0xe90, dwBufLen=0xe90 | out: pbData=0x278facc*, pdwDataLen=0x55cf204*=0xe90) returned 1
	[0115.241] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2790968*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2790968*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0115.241] CryptDestroyKey (hKey=0x82b540) returned 1
	[0115.241] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.241] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.241] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0115.241] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.242] GetFileType (hFile=0x2ec) returned 0x1
	[0115.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0115.242] GetFileType (hFile=0x2ec) returned 0x1
	[0115.242] WriteFile (in: hFile=0x2ec, lpBuffer=0x2790a54*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2790a54*, lpNumberOfBytesWritten=0x55cf1c4*=0xe90, lpOverlapped=0x0) returned 1
	[0115.243] CloseHandle (hObject=0x2ec) returned 1
	[0115.243] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.243] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0115.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0115.244] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7f04e419, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xe90)) returned 1
	[0115.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0115.244] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.246] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0115.246] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2791c98 | out: lpFileInformation=0x2791c98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a)) returned 1
	[0115.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0115.247] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0115.247] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.247] GetFileType (hFile=0x2ec) returned 0x1
	[0115.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0115.247] GetFileType (hFile=0x2ec) returned 0x1
	[0115.247] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x13c4a
	[0115.248] ReadFile (in: hFile=0x2ec, lpBuffer=0x2791ea0, nNumberOfBytesToRead=0x13c4a, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2791ea0*, lpNumberOfBytesRead=0x55cf1fc*=0x13c4a, lpOverlapped=0x0) returned 1
	[0115.264] CloseHandle (hObject=0x2ec) returned 1
	[0115.264] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0115.264] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.264] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b7888, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b0c0) returned 1
	[0115.265] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.265] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.265] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b440) returned 1
	[0115.265] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.265] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x27b7940*=0x1, dwFlags=0x0) returned 1
	[0115.265] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x27b790c, dwFlags=0x0) returned 1
	[0115.265] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b7950*, pdwDataLen=0x55cf204*=0x13c50, dwBufLen=0x13c50 | out: pbData=0x27b7950*, pdwDataLen=0x55cf204*=0x13c50) returned 1
	[0115.265] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb5ac*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27cb5ac*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0115.265] CryptDestroyKey (hKey=0x82b440) returned 1
	[0115.265] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.265] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.265] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0115.265] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0115.267] GetFileType (hFile=0x2ec) returned 0x1
	[0115.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0115.267] GetFileType (hFile=0x2ec) returned 0x1
	[0115.267] WriteFile (in: hFile=0x2ec, lpBuffer=0x27b7950*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27b7950*, lpNumberOfBytesWritten=0x55cf1f0*=0x13c50, lpOverlapped=0x0) returned 1
	[0115.270] CloseHandle (hObject=0x2ec) returned 1
	[0115.270] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.270] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0115.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0115.270] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7f09a947, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13c50)) returned 1
	[0115.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0115.270] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.271] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0115.271] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x27cb938 | out: lpFileInformation=0x27cb938*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758)) returned 1
	[0115.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0116.533] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.533] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.583] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.593] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.593] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.608] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.666] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.722] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.787] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.787] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.787] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.787] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.790] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.790] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.802] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.900] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.920] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0116.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0117.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0117.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0117.290] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0117.363] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0117.443] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0117.443] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.443] GetFileType (hFile=0x5dc) returned 0x1
	[0117.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0117.444] GetFileType (hFile=0x5dc) returned 0x1
	[0117.444] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x3758
	[0117.444] ReadFile (in: hFile=0x5dc, lpBuffer=0x2784d08, nNumberOfBytesToRead=0x3758, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2784d08*, lpNumberOfBytesRead=0x55cf1fc*=0x3758, lpOverlapped=0x0) returned 1
	[0117.457] CloseHandle (hObject=0x5dc) returned 1
	[0117.457] CryptDestroyKey (hKey=0x82b480) returned 1
	[0117.457] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.457] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27884fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0117.457] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.458] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.458] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0117.458] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.458] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27885b4*=0x1, dwFlags=0x0) returned 1
	[0117.458] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2788580, dwFlags=0x0) returned 1
	[0117.458] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27885c4*, pdwDataLen=0x55cf204*=0x3760, dwBufLen=0x3760 | out: pbData=0x27885c4*, pdwDataLen=0x55cf204*=0x3760) returned 1
	[0117.458] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278bd30*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x278bd30*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0117.458] CryptDestroyKey (hKey=0x82b380) returned 1
	[0117.458] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.458] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.458] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0117.458] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.459] GetFileType (hFile=0x5dc) returned 0x1
	[0117.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0117.460] GetFileType (hFile=0x5dc) returned 0x1
	[0117.460] WriteFile (in: hFile=0x5dc, lpBuffer=0x27885c4*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27885c4*, lpNumberOfBytesWritten=0x55cf1f0*=0x3760, lpOverlapped=0x0) returned 1
	[0117.461] CloseHandle (hObject=0x5dc) returned 1
	[0117.461] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.461] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0117.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0117.461] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x805771d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3760)) returned 1
	[0117.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0117.461] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.462] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0117.462] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x278c0cc | out: lpFileInformation=0x278c0cc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf)) returned 1
	[0117.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0117.463] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0117.463] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.463] GetFileType (hFile=0x5dc) returned 0x1
	[0117.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0117.463] GetFileType (hFile=0x5dc) returned 0x1
	[0117.463] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xfaf
	[0117.463] ReadFile (in: hFile=0x5dc, lpBuffer=0x278d248, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x278d248*, lpNumberOfBytesRead=0x55cf1fc*=0xfaf, lpOverlapped=0x0) returned 1
	[0117.477] CloseHandle (hObject=0x5dc) returned 1
	[0117.477] CryptDestroyKey (hKey=0x82b340) returned 1
	[0117.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.478] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278e2e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0117.478] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.478] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.478] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0117.478] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.478] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x278e39c*=0x1, dwFlags=0x0) returned 1
	[0117.478] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x278e368, dwFlags=0x0) returned 1
	[0117.478] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278e3ac*, pdwDataLen=0x55cf204*=0xfb0, dwBufLen=0xfb0 | out: pbData=0x278e3ac*, pdwDataLen=0x55cf204*=0xfb0) returned 1
	[0117.478] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278f368*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x278f368*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0117.478] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0117.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.478] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0117.478] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.480] GetFileType (hFile=0x5dc) returned 0x1
	[0117.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0117.480] GetFileType (hFile=0x5dc) returned 0x1
	[0117.480] WriteFile (in: hFile=0x5dc, lpBuffer=0x278f454*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x278f454*, lpNumberOfBytesWritten=0x55cf1c4*=0xfb0, lpOverlapped=0x0) returned 1
	[0117.481] CloseHandle (hObject=0x5dc) returned 1
	[0117.481] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.481] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0117.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0117.481] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8059d535, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xfb0)) returned 1
	[0117.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0117.481] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.483] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0117.483] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2790698 | out: lpFileInformation=0x2790698*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e)) returned 1
	[0117.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0117.484] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0117.484] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.484] GetFileType (hFile=0x5dc) returned 0x1
	[0117.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0117.484] GetFileType (hFile=0x5dc) returned 0x1
	[0117.484] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1397e
	[0117.484] ReadFile (in: hFile=0x5dc, lpBuffer=0x27908a0, nNumberOfBytesToRead=0x1397e, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27908a0*, lpNumberOfBytesRead=0x55cf1fc*=0x1397e, lpOverlapped=0x0) returned 1
	[0117.497] CloseHandle (hObject=0x5dc) returned 1
	[0117.497] CryptDestroyKey (hKey=0x82b380) returned 1
	[0117.497] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.497] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a42bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0117.497] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.497] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.497] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b040) returned 1
	[0117.497] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.497] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x27a4374*=0x1, dwFlags=0x0) returned 1
	[0117.497] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x27a4340, dwFlags=0x0) returned 1
	[0117.497] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a4384*, pdwDataLen=0x55cf204*=0x13980, dwBufLen=0x13980 | out: pbData=0x27a4384*, pdwDataLen=0x55cf204*=0x13980) returned 1
	[0117.497] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b7d10*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27b7d10*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0117.498] CryptDestroyKey (hKey=0x82b040) returned 1
	[0117.498] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.498] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.498] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0117.498] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.500] GetFileType (hFile=0x5dc) returned 0x1
	[0117.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0117.500] GetFileType (hFile=0x5dc) returned 0x1
	[0117.500] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a4384*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27a4384*, lpNumberOfBytesWritten=0x55cf1f0*=0x13980, lpOverlapped=0x0) returned 1
	[0117.502] CloseHandle (hObject=0x5dc) returned 1
	[0117.502] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.502] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0117.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0117.502] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x805e99da, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13980)) returned 1
	[0117.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0117.503] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.503] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0117.504] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x27b809c | out: lpFileInformation=0x27b809c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958)) returned 1
	[0117.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0117.504] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0117.504] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.504] GetFileType (hFile=0x5dc) returned 0x1
	[0117.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0117.504] GetFileType (hFile=0x5dc) returned 0x1
	[0117.504] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x4958
	[0117.504] ReadFile (in: hFile=0x5dc, lpBuffer=0x27b82ac, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27b82ac*, lpNumberOfBytesRead=0x55cf1fc*=0x4958, lpOverlapped=0x0) returned 1
	[0117.517] CloseHandle (hObject=0x5dc) returned 1
	[0117.517] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0117.517] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.518] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27bcca0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0117.518] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.518] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.518] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b400) returned 1
	[0117.518] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.518] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x27bcd58*=0x1, dwFlags=0x0) returned 1
	[0117.518] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x27bcd24, dwFlags=0x0) returned 1
	[0117.518] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27bcd68*, pdwDataLen=0x55cf204*=0x4960, dwBufLen=0x4960 | out: pbData=0x27bcd68*, pdwDataLen=0x55cf204*=0x4960) returned 1
	[0117.518] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c16d4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27c16d4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0117.518] CryptDestroyKey (hKey=0x82b400) returned 1
	[0117.518] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.518] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.518] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0117.519] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.520] GetFileType (hFile=0x5dc) returned 0x1
	[0117.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0117.520] GetFileType (hFile=0x5dc) returned 0x1
	[0117.520] WriteFile (in: hFile=0x5dc, lpBuffer=0x27bcd68*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27bcd68*, lpNumberOfBytesWritten=0x55cf1f0*=0x4960, lpOverlapped=0x0) returned 1
	[0117.523] CloseHandle (hObject=0x5dc) returned 1
	[0117.524] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.524] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0117.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0117.524] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x8060fba0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4960)) returned 1
	[0117.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0117.524] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.525] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0117.525] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x27c1a70 | out: lpFileInformation=0x27c1a70*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5)) returned 1
	[0117.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0117.525] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0117.525] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.525] GetFileType (hFile=0x5dc) returned 0x1
	[0117.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0117.525] GetFileType (hFile=0x5dc) returned 0x1
	[0117.525] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x18a5
	[0117.526] ReadFile (in: hFile=0x5dc, lpBuffer=0x27c1c30, nNumberOfBytesToRead=0x18a5, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27c1c30*, lpNumberOfBytesRead=0x55cf1fc*=0x18a5, lpOverlapped=0x0) returned 1
	[0117.564] CloseHandle (hObject=0x5dc) returned 1
	[0117.564] CryptDestroyKey (hKey=0x82b540) returned 1
	[0117.564] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.564] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c3574, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0117.564] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.564] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.564] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b200) returned 1
	[0117.565] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.565] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x27c362c*=0x1, dwFlags=0x0) returned 1
	[0117.565] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x27c35f8, dwFlags=0x0) returned 1
	[0117.565] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c363c*, pdwDataLen=0x55cf204*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x27c363c*, pdwDataLen=0x55cf204*=0x18b0) returned 1
	[0117.565] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c4ef8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27c4ef8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0117.565] CryptDestroyKey (hKey=0x82b200) returned 1
	[0117.565] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.565] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.565] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0117.565] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.566] GetFileType (hFile=0x5dc) returned 0x1
	[0117.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0117.566] GetFileType (hFile=0x5dc) returned 0x1
	[0117.566] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c363c*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27c363c*, lpNumberOfBytesWritten=0x55cf1f0*=0x18b0, lpOverlapped=0x0) returned 1
	[0117.567] CloseHandle (hObject=0x5dc) returned 1
	[0117.568] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.568] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0117.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0117.568] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x806821ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x18b0)) returned 1
	[0117.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0117.568] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.570] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0117.570] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x27c521c | out: lpFileInformation=0x27c521c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90)) returned 1
	[0117.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0117.571] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0117.571] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.571] GetFileType (hFile=0x5dc) returned 0x1
	[0117.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0117.571] GetFileType (hFile=0x5dc) returned 0x1
	[0117.571] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xed90
	[0117.571] ReadFile (in: hFile=0x5dc, lpBuffer=0x27c5424, nNumberOfBytesToRead=0xed90, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27c5424*, lpNumberOfBytesRead=0x55cf1fc*=0xed90, lpOverlapped=0x0) returned 1
	[0117.593] CloseHandle (hObject=0x5dc) returned 1
	[0117.593] CryptDestroyKey (hKey=0x82b280) returned 1
	[0117.593] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.593] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d4250, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0117.594] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.594] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.594] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0117.594] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.594] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27d4308*=0x1, dwFlags=0x0) returned 1
	[0117.594] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x27d42d4, dwFlags=0x0) returned 1
	[0117.594] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d4318*, pdwDataLen=0x55cf204*=0xeda0, dwBufLen=0xeda0 | out: pbData=0x27d4318*, pdwDataLen=0x55cf204*=0xeda0) returned 1
	[0117.594] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e30c4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27e30c4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0117.595] CryptDestroyKey (hKey=0x82b080) returned 1
	[0117.595] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.595] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.595] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0117.595] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.597] GetFileType (hFile=0x5dc) returned 0x1
	[0117.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0117.597] GetFileType (hFile=0x5dc) returned 0x1
	[0117.597] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d4318*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27d4318*, lpNumberOfBytesWritten=0x55cf1f0*=0xeda0, lpOverlapped=0x0) returned 1
	[0117.600] CloseHandle (hObject=0x5dc) returned 1
	[0117.600] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.600] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0117.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0117.600] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x806ce7c6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xeda0)) returned 1
	[0117.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0117.601] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.602] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0117.602] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x27e3450 | out: lpFileInformation=0x27e3450*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758)) returned 1
	[0117.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0117.602] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0117.603] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.603] GetFileType (hFile=0x5dc) returned 0x1
	[0117.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0117.603] GetFileType (hFile=0x5dc) returned 0x1
	[0117.603] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x3758
	[0117.603] ReadFile (in: hFile=0x5dc, lpBuffer=0x27e3660, nNumberOfBytesToRead=0x3758, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27e3660*, lpNumberOfBytesRead=0x55cf1fc*=0x3758, lpOverlapped=0x0) returned 1
	[0117.616] CloseHandle (hObject=0x5dc) returned 1
	[0117.616] CryptDestroyKey (hKey=0x82b540) returned 1
	[0117.617] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.617] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e6e54, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0117.617] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.617] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.617] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b0c0) returned 1
	[0117.617] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.617] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27e6f0c*=0x1, dwFlags=0x0) returned 1
	[0117.617] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x27e6ed8, dwFlags=0x0) returned 1
	[0117.617] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e6f1c*, pdwDataLen=0x55cf204*=0x3760, dwBufLen=0x3760 | out: pbData=0x27e6f1c*, pdwDataLen=0x55cf204*=0x3760) returned 1
	[0117.618] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ea688*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27ea688*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0117.618] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0117.618] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.618] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.618] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0117.618] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.620] GetFileType (hFile=0x5dc) returned 0x1
	[0117.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0117.620] GetFileType (hFile=0x5dc) returned 0x1
	[0117.620] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e6f1c*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27e6f1c*, lpNumberOfBytesWritten=0x55cf1f0*=0x3760, lpOverlapped=0x0) returned 1
	[0117.622] CloseHandle (hObject=0x5dc) returned 1
	[0117.622] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.622] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0117.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0117.622] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x806f4a5e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3760)) returned 1
	[0117.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0117.623] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.623] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0117.624] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x27eaa24 | out: lpFileInformation=0x27eaa24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd)) returned 1
	[0117.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0117.624] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0117.624] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.625] GetFileType (hFile=0x5dc) returned 0x1
	[0117.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0117.625] GetFileType (hFile=0x5dc) returned 0x1
	[0117.625] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xbfd
	[0117.626] ReadFile (in: hFile=0x5dc, lpBuffer=0x27eb7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27eb7f0*, lpNumberOfBytesRead=0x55cf1fc*=0xbfd, lpOverlapped=0x0) returned 1
	[0117.642] CloseHandle (hObject=0x5dc) returned 1
	[0117.642] CryptDestroyKey (hKey=0x82b340) returned 1
	[0117.642] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.642] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ec88c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0117.642] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.643] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0117.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.643] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27ec944*=0x1, dwFlags=0x0) returned 1
	[0117.643] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27ec910, dwFlags=0x0) returned 1
	[0117.643] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ec954*, pdwDataLen=0x55cf204*=0xc00, dwBufLen=0xc00 | out: pbData=0x27ec954*, pdwDataLen=0x55cf204*=0xc00) returned 1
	[0117.643] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ed560*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27ed560*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0117.643] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0117.643] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.643] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.643] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0117.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.645] GetFileType (hFile=0x5dc) returned 0x1
	[0117.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0117.645] GetFileType (hFile=0x5dc) returned 0x1
	[0117.645] WriteFile (in: hFile=0x5dc, lpBuffer=0x27ed64c*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27ed64c*, lpNumberOfBytesWritten=0x55cf1c4*=0xc00, lpOverlapped=0x0) returned 1
	[0117.647] CloseHandle (hObject=0x5dc) returned 1
	[0117.647] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.647] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0117.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0117.647] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x80740f33, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0117.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0117.648] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.692] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0117.692] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x27ee890 | out: lpFileInformation=0x27ee890*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c)) returned 1
	[0117.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0117.692] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0117.693] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.693] GetFileType (hFile=0x5dc) returned 0x1
	[0117.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0117.693] GetFileType (hFile=0x5dc) returned 0x1
	[0117.693] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1387c
	[0117.693] ReadFile (in: hFile=0x5dc, lpBuffer=0x27eea98, nNumberOfBytesToRead=0x1387c, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27eea98*, lpNumberOfBytesRead=0x55cf1fc*=0x1387c, lpOverlapped=0x0) returned 1
	[0117.703] CloseHandle (hObject=0x5dc) returned 1
	[0117.703] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0117.703] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.704] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28023b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0117.704] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.704] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.704] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0117.704] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.704] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2802468*=0x1, dwFlags=0x0) returned 1
	[0117.704] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2802434, dwFlags=0x0) returned 1
	[0117.704] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2802478*, pdwDataLen=0x55cf204*=0x13880, dwBufLen=0x13880 | out: pbData=0x2802478*, pdwDataLen=0x55cf204*=0x13880) returned 1
	[0117.704] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2815d04*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2815d04*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0117.705] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0117.705] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.705] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.705] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0117.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.707] GetFileType (hFile=0x5dc) returned 0x1
	[0117.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0117.707] GetFileType (hFile=0x5dc) returned 0x1
	[0117.707] WriteFile (in: hFile=0x5dc, lpBuffer=0x2802478*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2802478*, lpNumberOfBytesWritten=0x55cf1f0*=0x13880, lpOverlapped=0x0) returned 1
	[0117.710] CloseHandle (hObject=0x5dc) returned 1
	[0117.710] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.710] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0117.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0117.710] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x807d995f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13880)) returned 1
	[0117.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0117.711] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.712] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0117.712] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x2816090 | out: lpFileInformation=0x2816090*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958)) returned 1
	[0117.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0117.712] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0117.713] ReadFile (in: hFile=0x5dc, lpBuffer=0x28162a0, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x28162a0*, lpNumberOfBytesRead=0x55cf1fc*=0x4958, lpOverlapped=0x0) returned 1
	[0117.726] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0117.726] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.727] CryptImportKey (in: hProv=0x7f93c0, pbData=0x281ac94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0117.727] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.727] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.727] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0117.727] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.727] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x281ad4c*=0x1, dwFlags=0x0) returned 1
	[0117.727] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x281ad18, dwFlags=0x0) returned 1
	[0117.727] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x281ad5c*, pdwDataLen=0x55cf204*=0x4960, dwBufLen=0x4960 | out: pbData=0x281ad5c*, pdwDataLen=0x55cf204*=0x4960) returned 1
	[0117.728] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x281f6c8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x281f6c8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0117.728] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0117.728] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.728] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.728] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0117.728] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.730] GetFileType (hFile=0x5dc) returned 0x1
	[0117.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0117.730] GetFileType (hFile=0x5dc) returned 0x1
	[0117.730] WriteFile (in: hFile=0x5dc, lpBuffer=0x281ad5c*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x281ad5c*, lpNumberOfBytesWritten=0x55cf1f0*=0x4960, lpOverlapped=0x0) returned 1
	[0117.732] CloseHandle (hObject=0x5dc) returned 1
	[0117.732] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.732] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0117.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0117.732] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x807ffa9d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4960)) returned 1
	[0117.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0117.733] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.734] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", lpFilePart=0x0) returned 0x2e
	[0117.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0117.734] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x281fa64 | out: lpFileInformation=0x281fa64*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444)) returned 1
	[0117.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0117.735] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", lpFilePart=0x0) returned 0x2e
	[0117.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0117.735] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.735] GetFileType (hFile=0x5dc) returned 0x1
	[0117.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0117.735] GetFileType (hFile=0x5dc) returned 0x1
	[0117.735] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x31444
	[0118.100] ReadFile (in: hFile=0x5dc, lpBuffer=0x34494c8, nNumberOfBytesToRead=0x31444, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesRead=0x55cf1fc*=0x31444, lpOverlapped=0x0) returned 1
	[0118.205] CloseHandle (hObject=0x5dc) returned 1
	[0118.205] CryptDestroyKey (hKey=0x82b540) returned 1
	[0118.206] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.206] CryptImportKey (in: hProv=0x7f93c0, pbData=0x281fd04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0118.206] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.206] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.206] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0118.206] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.206] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x281fdbc*=0x1, dwFlags=0x0) returned 1
	[0118.206] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x281fd88, dwFlags=0x0) returned 1
	[0118.209] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x347a928*, pdwDataLen=0x55cf204*=0x31450, dwBufLen=0x31450 | out: pbData=0x347a928*, pdwDataLen=0x55cf204*=0x31450) returned 1
	[0118.209] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x281fdcc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x281fdcc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0118.210] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0118.210] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.210] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.210] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", lpFilePart=0x0) returned 0x2e
	[0118.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0118.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.213] GetFileType (hFile=0x5dc) returned 0x1
	[0118.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0118.213] GetFileType (hFile=0x5dc) returned 0x1
	[0118.213] WriteFile (in: hFile=0x5dc, lpBuffer=0x347a928*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x347a928*, lpNumberOfBytesWritten=0x55cf1f0*=0x31450, lpOverlapped=0x0) returned 1
	[0118.217] CloseHandle (hObject=0x5dc) returned 1
	[0118.217] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", lpFilePart=0x0) returned 0x2e
	[0118.217] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0118.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0118.217] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x80c9e2a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x31450)) returned 1
	[0118.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0118.217] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.218] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", lpFilePart=0x0) returned 0x27
	[0118.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0118.218] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x282016c | out: lpFileInformation=0x282016c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882)) returned 1
	[0118.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0118.219] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", lpFilePart=0x0) returned 0x27
	[0118.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0118.219] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.219] GetFileType (hFile=0x5dc) returned 0x1
	[0118.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0118.219] GetFileType (hFile=0x5dc) returned 0x1
	[0118.219] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x9882
	[0118.219] ReadFile (in: hFile=0x5dc, lpBuffer=0x2820344, nNumberOfBytesToRead=0x9882, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2820344*, lpNumberOfBytesRead=0x55cf1fc*=0x9882, lpOverlapped=0x0) returned 1
	[0118.252] CloseHandle (hObject=0x5dc) returned 1
	[0118.252] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0118.252] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.252] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2829c64, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0118.252] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.252] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.252] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b0c0) returned 1
	[0118.252] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.252] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x2829d1c*=0x1, dwFlags=0x0) returned 1
	[0118.253] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x2829ce8, dwFlags=0x0) returned 1
	[0118.253] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2829d2c*, pdwDataLen=0x55cf204*=0x9890, dwBufLen=0x9890 | out: pbData=0x2829d2c*, pdwDataLen=0x55cf204*=0x9890) returned 1
	[0118.253] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28335c8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x28335c8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0118.253] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0118.253] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.253] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.253] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", lpFilePart=0x0) returned 0x27
	[0118.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0118.253] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.255] GetFileType (hFile=0x5dc) returned 0x1
	[0118.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0118.255] GetFileType (hFile=0x5dc) returned 0x1
	[0118.255] WriteFile (in: hFile=0x5dc, lpBuffer=0x2829d2c*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2829d2c*, lpNumberOfBytesWritten=0x55cf1f0*=0x9890, lpOverlapped=0x0) returned 1
	[0118.257] CloseHandle (hObject=0x5dc) returned 1
	[0118.257] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", lpFilePart=0x0) returned 0x27
	[0118.257] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\UiInfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0118.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0118.257] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x80d10b07, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9890)) returned 1
	[0118.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0118.257] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.341] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", lpFilePart=0x0) returned 0x30
	[0118.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0118.341] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x2833918 | out: lpFileInformation=0x2833918*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82)) returned 1
	[0118.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0118.342] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", lpFilePart=0x0) returned 0x30
	[0118.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0118.342] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.342] GetFileType (hFile=0x5dc) returned 0x1
	[0118.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0118.343] GetFileType (hFile=0x5dc) returned 0x1
	[0118.343] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x16c82
	[0118.343] ReadFile (in: hFile=0x5dc, lpBuffer=0x34abd98, nNumberOfBytesToRead=0x16c82, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x34abd98*, lpNumberOfBytesRead=0x55cf1fc*=0x16c82, lpOverlapped=0x0) returned 1
	[0118.360] CloseHandle (hObject=0x5dc) returned 1
	[0118.360] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0118.360] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.360] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2833bc0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b080) returned 1
	[0118.360] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.360] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.360] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0118.360] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.360] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2833c78*=0x1, dwFlags=0x0) returned 1
	[0118.360] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2833c44, dwFlags=0x0) returned 1
	[0118.362] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34c2a38*, pdwDataLen=0x55cf204*=0x16c90, dwBufLen=0x16c90 | out: pbData=0x34c2a38*, pdwDataLen=0x55cf204*=0x16c90) returned 1
	[0118.362] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2833c88*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2833c88*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0118.362] CryptDestroyKey (hKey=0x82b540) returned 1
	[0118.362] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.362] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.362] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", lpFilePart=0x0) returned 0x30
	[0118.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0118.362] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.364] GetFileType (hFile=0x5dc) returned 0x1
	[0118.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0118.364] GetFileType (hFile=0x5dc) returned 0x1
	[0118.364] WriteFile (in: hFile=0x5dc, lpBuffer=0x34c2a38*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x34c2a38*, lpNumberOfBytesWritten=0x55cf1f0*=0x16c90, lpOverlapped=0x0) returned 1
	[0118.367] CloseHandle (hObject=0x5dc) returned 1
	[0118.367] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", lpFilePart=0x0) returned 0x30
	[0118.367] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0118.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0118.367] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x80e1b9ae, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x16c90)) returned 1
	[0118.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0118.367] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.368] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", lpFilePart=0x0) returned 0x29
	[0118.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0118.368] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x283403c | out: lpFileInformation=0x283403c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a)) returned 1
	[0118.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0118.369] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", lpFilePart=0x0) returned 0x29
	[0118.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0118.369] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.369] GetFileType (hFile=0x5dc) returned 0x1
	[0118.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0118.369] GetFileType (hFile=0x5dc) returned 0x1
	[0118.369] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x988a
	[0118.369] ReadFile (in: hFile=0x5dc, lpBuffer=0x283421c, nNumberOfBytesToRead=0x988a, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x283421c*, lpNumberOfBytesRead=0x55cf1fc*=0x988a, lpOverlapped=0x0) returned 1
	[0118.388] CloseHandle (hObject=0x5dc) returned 1
	[0118.388] CryptDestroyKey (hKey=0x82b080) returned 1
	[0118.388] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.389] CryptImportKey (in: hProv=0x7f93c0, pbData=0x283db44, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0118.389] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.389] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.389] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0118.389] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.389] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x283dbfc*=0x1, dwFlags=0x0) returned 1
	[0118.389] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x283dbc8, dwFlags=0x0) returned 1
	[0118.389] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x283dc0c*, pdwDataLen=0x55cf204*=0x9890, dwBufLen=0x9890 | out: pbData=0x283dc0c*, pdwDataLen=0x55cf204*=0x9890) returned 1
	[0118.389] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28474a8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x28474a8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0118.389] CryptDestroyKey (hKey=0x82b280) returned 1
	[0118.389] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.389] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.389] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", lpFilePart=0x0) returned 0x29
	[0118.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0118.389] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.391] GetFileType (hFile=0x5dc) returned 0x1
	[0118.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0118.391] GetFileType (hFile=0x5dc) returned 0x1
	[0118.391] WriteFile (in: hFile=0x5dc, lpBuffer=0x283dc0c*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x283dc0c*, lpNumberOfBytesWritten=0x55cf1f0*=0x9890, lpOverlapped=0x0) returned 1
	[0118.393] CloseHandle (hObject=0x5dc) returned 1
	[0118.393] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", lpFilePart=0x0) returned 0x29
	[0118.393] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x58
	[0118.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0118.393] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x80e695e5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9890)) returned 1
	[0118.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0118.393] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.395] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Print.ico", lpFilePart=0x0) returned 0x28
	[0118.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0118.396] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), fInfoLevelId=0x0, lpFileInformation=0x284780c | out: lpFileInformation=0x284780c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e)) returned 1
	[0118.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0118.397] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Print.ico", lpFilePart=0x0) returned 0x28
	[0118.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0118.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.397] GetFileType (hFile=0x5dc) returned 0x1
	[0118.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0118.397] GetFileType (hFile=0x5dc) returned 0x1
	[0118.397] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x47e
	[0118.397] ReadFile (in: hFile=0x5dc, lpBuffer=0x2847e70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2847e70*, lpNumberOfBytesRead=0x55cf1fc*=0x47e, lpOverlapped=0x0) returned 1
	[0118.399] CloseHandle (hObject=0x5dc) returned 1
	[0118.399] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0118.399] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.399] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2848f0c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b4c0) returned 1
	[0118.400] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.400] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.400] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0118.400] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.400] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2848fc4*=0x1, dwFlags=0x0) returned 1
	[0118.400] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2848f90, dwFlags=0x0) returned 1
	[0118.400] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2848fd4*, pdwDataLen=0x55cf204*=0x480, dwBufLen=0x480 | out: pbData=0x2848fd4*, pdwDataLen=0x55cf204*=0x480) returned 1
	[0118.400] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2849460*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2849460*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0118.400] CryptDestroyKey (hKey=0x82b540) returned 1
	[0118.400] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.400] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.400] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Print.ico", lpFilePart=0x0) returned 0x28
	[0118.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0118.400] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.402] GetFileType (hFile=0x5dc) returned 0x1
	[0118.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0118.402] GetFileType (hFile=0x5dc) returned 0x1
	[0118.402] WriteFile (in: hFile=0x5dc, lpBuffer=0x2849558*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2849558*, lpNumberOfBytesWritten=0x55cf1c4*=0x480, lpOverlapped=0x0) returned 1
	[0118.403] CloseHandle (hObject=0x5dc) returned 1
	[0118.403] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Print.ico", lpFilePart=0x0) returned 0x28
	[0118.403] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Print.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0118.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0118.403] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80e695e5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x480)) returned 1
	[0118.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0118.404] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.404] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", lpFilePart=0x0) returned 0x2a
	[0118.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0118.405] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), fInfoLevelId=0x0, lpFileInformation=0x284a7c0 | out: lpFileInformation=0x284a7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e)) returned 1
	[0118.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0118.405] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", lpFilePart=0x0) returned 0x2a
	[0118.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0118.405] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.405] GetFileType (hFile=0x5dc) returned 0x1
	[0118.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0118.405] GetFileType (hFile=0x5dc) returned 0x1
	[0118.405] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x37e
	[0118.405] ReadFile (in: hFile=0x5dc, lpBuffer=0x284ad34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x284ad34*, lpNumberOfBytesRead=0x55cf1fc*=0x37e, lpOverlapped=0x0) returned 1
	[0118.437] CloseHandle (hObject=0x5dc) returned 1
	[0118.437] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0118.437] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.438] CryptImportKey (in: hProv=0x7f93c0, pbData=0x284bdd0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0118.438] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.438] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.438] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0118.438] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.438] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x284be88*=0x1, dwFlags=0x0) returned 1
	[0118.438] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x284be54, dwFlags=0x0) returned 1
	[0118.438] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x284be98*, pdwDataLen=0x55cf204*=0x380, dwBufLen=0x380 | out: pbData=0x284be98*, pdwDataLen=0x55cf204*=0x380) returned 1
	[0118.438] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x284c224*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x284c224*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0118.438] CryptDestroyKey (hKey=0x82b280) returned 1
	[0118.438] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.438] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.438] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", lpFilePart=0x0) returned 0x2a
	[0118.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0118.439] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.440] GetFileType (hFile=0x5dc) returned 0x1
	[0118.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0118.440] GetFileType (hFile=0x5dc) returned 0x1
	[0118.440] WriteFile (in: hFile=0x5dc, lpBuffer=0x284c324*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x284c324*, lpNumberOfBytesWritten=0x55cf1c4*=0x380, lpOverlapped=0x0) returned 1
	[0118.441] CloseHandle (hObject=0x5dc) returned 1
	[0118.441] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", lpFilePart=0x0) returned 0x2a
	[0118.441] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0118.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0118.442] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80eda5e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0118.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0118.442] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.443] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", lpFilePart=0x0) returned 0x2a
	[0118.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0118.443] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), fInfoLevelId=0x0, lpFileInformation=0x284d59c | out: lpFileInformation=0x284d59c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e)) returned 1
	[0118.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0118.444] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", lpFilePart=0x0) returned 0x2a
	[0118.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0118.444] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.444] GetFileType (hFile=0x5dc) returned 0x1
	[0118.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0118.444] GetFileType (hFile=0x5dc) returned 0x1
	[0118.444] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x37e
	[0118.444] ReadFile (in: hFile=0x5dc, lpBuffer=0x284db10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x284db10*, lpNumberOfBytesRead=0x55cf1fc*=0x37e, lpOverlapped=0x0) returned 1
	[0118.452] CloseHandle (hObject=0x5dc) returned 1
	[0118.453] CryptDestroyKey (hKey=0x82b300) returned 1
	[0118.453] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.453] CryptImportKey (in: hProv=0x7f93c0, pbData=0x284ebac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0118.453] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.453] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.453] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0118.453] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.453] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x284ec64*=0x1, dwFlags=0x0) returned 1
	[0118.453] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x284ec30, dwFlags=0x0) returned 1
	[0118.454] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x284ec74*, pdwDataLen=0x55cf204*=0x380, dwBufLen=0x380 | out: pbData=0x284ec74*, pdwDataLen=0x55cf204*=0x380) returned 1
	[0118.454] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x284f000*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x284f000*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0118.454] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0118.454] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.454] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.454] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", lpFilePart=0x0) returned 0x2a
	[0118.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0118.454] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.455] GetFileType (hFile=0x5dc) returned 0x1
	[0118.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0118.455] GetFileType (hFile=0x5dc) returned 0x1
	[0118.456] WriteFile (in: hFile=0x5dc, lpBuffer=0x284f100*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x284f100*, lpNumberOfBytesWritten=0x55cf1c4*=0x380, lpOverlapped=0x0) returned 1
	[0118.457] CloseHandle (hObject=0x5dc) returned 1
	[0118.457] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", lpFilePart=0x0) returned 0x2a
	[0118.457] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0118.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0118.457] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80f0087a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0118.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0118.457] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.458] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", lpFilePart=0x0) returned 0x2a
	[0118.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0118.458] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), fInfoLevelId=0x0, lpFileInformation=0x2850378 | out: lpFileInformation=0x2850378*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e)) returned 1
	[0118.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0118.459] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", lpFilePart=0x0) returned 0x2a
	[0118.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0118.459] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.459] GetFileType (hFile=0x5dc) returned 0x1
	[0118.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0118.459] GetFileType (hFile=0x5dc) returned 0x1
	[0118.460] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x37e
	[0118.460] ReadFile (in: hFile=0x5dc, lpBuffer=0x28508ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x28508ec*, lpNumberOfBytesRead=0x55cf1fc*=0x37e, lpOverlapped=0x0) returned 1
	[0118.461] CloseHandle (hObject=0x5dc) returned 1
	[0118.461] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0118.461] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.462] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2851988, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0118.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.462] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0118.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.462] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x2851a40*=0x1, dwFlags=0x0) returned 1
	[0118.462] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x2851a0c, dwFlags=0x0) returned 1
	[0118.462] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2851a50*, pdwDataLen=0x55cf204*=0x380, dwBufLen=0x380 | out: pbData=0x2851a50*, pdwDataLen=0x55cf204*=0x380) returned 1
	[0118.462] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2851ddc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2851ddc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0118.462] CryptDestroyKey (hKey=0x82b340) returned 1
	[0118.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.462] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", lpFilePart=0x0) returned 0x2a
	[0118.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0118.462] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.464] GetFileType (hFile=0x5dc) returned 0x1
	[0118.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0118.464] GetFileType (hFile=0x5dc) returned 0x1
	[0118.464] WriteFile (in: hFile=0x5dc, lpBuffer=0x2851edc*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2851edc*, lpNumberOfBytesWritten=0x55cf1c4*=0x380, lpOverlapped=0x0) returned 1
	[0118.465] CloseHandle (hObject=0x5dc) returned 1
	[0118.465] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", lpFilePart=0x0) returned 0x2a
	[0118.465] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0118.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0118.465] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80f0087a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0118.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0118.465] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.466] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", lpFilePart=0x0) returned 0x2a
	[0118.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0118.466] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), fInfoLevelId=0x0, lpFileInformation=0x2853154 | out: lpFileInformation=0x2853154*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e)) returned 1
	[0118.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0118.467] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", lpFilePart=0x0) returned 0x2a
	[0118.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0118.467] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.467] GetFileType (hFile=0x5dc) returned 0x1
	[0118.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0118.467] GetFileType (hFile=0x5dc) returned 0x1
	[0118.467] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x37e
	[0118.468] ReadFile (in: hFile=0x5dc, lpBuffer=0x28536c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x28536c8*, lpNumberOfBytesRead=0x55cf1fc*=0x37e, lpOverlapped=0x0) returned 1
	[0118.469] CloseHandle (hObject=0x5dc) returned 1
	[0118.470] CryptDestroyKey (hKey=0x82b280) returned 1
	[0118.470] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.470] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2854764, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0118.470] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.470] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.470] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0118.470] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.470] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x285481c*=0x1, dwFlags=0x0) returned 1
	[0118.470] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x28547e8, dwFlags=0x0) returned 1
	[0118.470] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x285482c*, pdwDataLen=0x55cf204*=0x380, dwBufLen=0x380 | out: pbData=0x285482c*, pdwDataLen=0x55cf204*=0x380) returned 1
	[0118.470] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2854bb8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2854bb8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0118.470] CryptDestroyKey (hKey=0x82b540) returned 1
	[0118.470] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.470] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.470] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", lpFilePart=0x0) returned 0x2a
	[0118.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0118.470] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.472] GetFileType (hFile=0x5dc) returned 0x1
	[0118.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0118.472] GetFileType (hFile=0x5dc) returned 0x1
	[0118.472] WriteFile (in: hFile=0x5dc, lpBuffer=0x2854cb8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2854cb8*, lpNumberOfBytesWritten=0x55cf1c4*=0x380, lpOverlapped=0x0) returned 1
	[0118.473] CloseHandle (hObject=0x5dc) returned 1
	[0118.473] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", lpFilePart=0x0) returned 0x2a
	[0118.473] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0118.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0118.473] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80f26ad9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0118.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0118.474] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.474] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", lpFilePart=0x0) returned 0x2a
	[0118.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0118.475] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), fInfoLevelId=0x0, lpFileInformation=0x2855f30 | out: lpFileInformation=0x2855f30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e)) returned 1
	[0118.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0118.475] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.479] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.483] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.509] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.528] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.582] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.582] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.627] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.638] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.638] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.647] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.787] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.034] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.058] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.065] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.065] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.065] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.067] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.067] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.067] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.067] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0119.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.900] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.900] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.900] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.900] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.901] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.901] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.902] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.989] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.073] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.085] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.177] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.256] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.286] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.287] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.368] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.381] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.388] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.390] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.391] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.403] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.406] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.409] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL", lpFilePart=0x0) returned 0x27
	[0121.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.409] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.410] GetFileType (hFile=0x5dc) returned 0x1
	[0121.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.410] GetFileType (hFile=0x5dc) returned 0x1
	[0121.410] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x3a7c
	[0121.410] ReadFile (in: hFile=0x5dc, lpBuffer=0x26486d0, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26486d0*, lpNumberOfBytesRead=0x55cf1fc*=0x3a7c, lpOverlapped=0x0) returned 1
	[0121.412] CloseHandle (hObject=0x5dc) returned 1
	[0121.413] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0121.413] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.413] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264c1e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0121.413] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.413] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.413] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0121.413] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.413] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x264c2a0*=0x1, dwFlags=0x0) returned 1
	[0121.413] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x264c26c, dwFlags=0x0) returned 1
	[0121.414] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264c2b0*, pdwDataLen=0x55cf204*=0x3a80, dwBufLen=0x3a80 | out: pbData=0x264c2b0*, pdwDataLen=0x55cf204*=0x3a80) returned 1
	[0121.414] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264fd3c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x264fd3c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.414] CryptDestroyKey (hKey=0x82b540) returned 1
	[0121.414] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.414] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.414] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL", lpFilePart=0x0) returned 0x27
	[0121.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.414] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.416] GetFileType (hFile=0x5dc) returned 0x1
	[0121.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.416] GetFileType (hFile=0x5dc) returned 0x1
	[0121.416] WriteFile (in: hFile=0x5dc, lpBuffer=0x264c2b0*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x264c2b0*, lpNumberOfBytesWritten=0x55cf1f0*=0x3a80, lpOverlapped=0x0) returned 1
	[0121.420] CloseHandle (hObject=0x5dc) returned 1
	[0121.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL", lpFilePart=0x0) returned 0x27
	[0121.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0121.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.421] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x82b4cbda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3a80)) returned 1
	[0121.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.421] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), lpNewFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.422] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker", lpFilePart=0x0) returned 0x37
	[0121.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.422] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\programdata\\microsoft\\office\\clicktorunpackagelocker"), fInfoLevelId=0x0, lpFileInformation=0x265008c | out: lpFileInformation=0x265008c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0121.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker", lpFilePart=0x0) returned 0x37
	[0121.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.423] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\programdata\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.423] GetFileType (hFile=0x5dc) returned 0x1
	[0121.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.423] GetFileType (hFile=0x5dc) returned 0x1
	[0121.423] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x0
	[0121.424] CloseHandle (hObject=0x5dc) returned 1
	[0121.424] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0121.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.424] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2650370, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0121.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.425] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.425] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0121.425] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.425] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2650428*=0x1, dwFlags=0x0) returned 1
	[0121.425] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x26503f4, dwFlags=0x0) returned 1
	[0121.425] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2650438*, pdwDataLen=0x55cf204*=0x10, dwBufLen=0x10 | out: pbData=0x2650438*, pdwDataLen=0x55cf204*=0x10) returned 1
	[0121.425] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2650454*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2650454*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.425] CryptDestroyKey (hKey=0x82b000) returned 1
	[0121.425] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.425] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.425] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker", lpFilePart=0x0) returned 0x37
	[0121.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.425] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\programdata\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.426] GetFileType (hFile=0x5dc) returned 0x1
	[0121.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.426] GetFileType (hFile=0x5dc) returned 0x1
	[0121.428] WriteFile (in: hFile=0x5dc, lpBuffer=0x2650584*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2650584*, lpNumberOfBytesWritten=0x55cf1c4*=0x10, lpOverlapped=0x0) returned 1
	[0121.429] CloseHandle (hObject=0x5dc) returned 1
	[0121.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker", lpFilePart=0x0) returned 0x37
	[0121.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0121.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.429] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\programdata\\microsoft\\office\\clicktorunpackagelocker"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x82b5dcfb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1
	[0121.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.432] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\programdata\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\office\\clicktorunpackagelocker id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.433] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml", lpFilePart=0x0) returned 0x36
	[0121.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.433] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\countrytable.xml"), fInfoLevelId=0x0, lpFileInformation=0x2651868 | out: lpFileInformation=0x2651868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60aed0fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x60aed0fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x60aed0fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70bb)) returned 1
	[0121.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.467] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml", lpFilePart=0x0) returned 0x36
	[0121.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.467] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.468] GetFileType (hFile=0x5dc) returned 0x1
	[0121.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.468] GetFileType (hFile=0x5dc) returned 0x1
	[0121.468] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x70bb
	[0121.468] ReadFile (in: hFile=0x5dc, lpBuffer=0x2651a98, nNumberOfBytesToRead=0x70bb, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2651a98*, lpNumberOfBytesRead=0x55cf1fc*=0x70bb, lpOverlapped=0x0) returned 1
	[0121.470] CloseHandle (hObject=0x5dc) returned 1
	[0121.470] CryptDestroyKey (hKey=0x82b400) returned 1
	[0121.470] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.470] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2658bf0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b440) returned 1
	[0121.470] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.471] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.471] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0121.471] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.471] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2658ca8*=0x1, dwFlags=0x0) returned 1
	[0121.471] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2658c74, dwFlags=0x0) returned 1
	[0121.471] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2658cb8*, pdwDataLen=0x55cf204*=0x70c0, dwBufLen=0x70c0 | out: pbData=0x2658cb8*, pdwDataLen=0x55cf204*=0x70c0) returned 1
	[0121.471] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265fd84*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x265fd84*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.471] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0121.471] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.471] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml", lpFilePart=0x0) returned 0x36
	[0121.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.471] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0121.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat", lpFilePart=0x0) returned 0x40
	[0121.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.474] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat"), fInfoLevelId=0x0, lpFileInformation=0x266046c | out: lpFileInformation=0x266046c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4dcad0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x2ab8b28d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x1571)) returned 1
	[0121.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat", lpFilePart=0x0) returned 0x40
	[0121.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.475] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.475] GetFileType (hFile=0x5dc) returned 0x1
	[0121.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.475] GetFileType (hFile=0x5dc) returned 0x1
	[0121.475] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1571
	[0121.475] ReadFile (in: hFile=0x5dc, lpBuffer=0x26606e4, nNumberOfBytesToRead=0x1571, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26606e4*, lpNumberOfBytesRead=0x55cf1fc*=0x1571, lpOverlapped=0x0) returned 1
	[0121.477] CloseHandle (hObject=0x5dc) returned 1
	[0121.477] CryptDestroyKey (hKey=0x82b440) returned 1
	[0121.477] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.477] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2661cf4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0121.477] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.477] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.477] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0121.477] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.477] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2661dac*=0x1, dwFlags=0x0) returned 1
	[0121.477] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2661d78, dwFlags=0x0) returned 1
	[0121.478] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2661dbc*, pdwDataLen=0x55cf204*=0x1580, dwBufLen=0x1580 | out: pbData=0x2661dbc*, pdwDataLen=0x55cf204*=0x1580) returned 1
	[0121.478] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2663348*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2663348*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.478] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0121.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.478] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat", lpFilePart=0x0) returned 0x40
	[0121.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.478] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.479] GetFileType (hFile=0x5dc) returned 0x1
	[0121.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.479] GetFileType (hFile=0x5dc) returned 0x1
	[0121.479] WriteFile (in: hFile=0x5dc, lpBuffer=0x2661dbc*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2661dbc*, lpNumberOfBytesWritten=0x55cf1f0*=0x1580, lpOverlapped=0x0) returned 1
	[0121.481] CloseHandle (hObject=0x5dc) returned 1
	[0121.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat", lpFilePart=0x0) returned 0x40
	[0121.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0121.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.481] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4dcad0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x82bcc55c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1580)) returned 1
	[0121.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.481] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.482] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat", lpFilePart=0x0) returned 0x3e
	[0121.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.482] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storagehealthmodel.dat"), fInfoLevelId=0x0, lpFileInformation=0x26637ac | out: lpFileInformation=0x26637ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f)) returned 1
	[0121.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat", lpFilePart=0x0) returned 0x3e
	[0121.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.483] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storagehealthmodel.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.483] GetFileType (hFile=0x5dc) returned 0x1
	[0121.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.483] GetFileType (hFile=0x5dc) returned 0x1
	[0121.483] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1375f
	[0121.483] ReadFile (in: hFile=0x5dc, lpBuffer=0x2663a14, nNumberOfBytesToRead=0x1375f, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2663a14*, lpNumberOfBytesRead=0x55cf1fc*=0x1375f, lpOverlapped=0x0) returned 1
	[0121.508] CloseHandle (hObject=0x5dc) returned 1
	[0121.508] CryptDestroyKey (hKey=0x82b380) returned 1
	[0121.508] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.508] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2677210, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b4c0) returned 1
	[0121.509] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.509] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.509] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0121.509] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.509] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26772c8*=0x1, dwFlags=0x0) returned 1
	[0121.509] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2677294, dwFlags=0x0) returned 1
	[0121.509] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26772d8*, pdwDataLen=0x55cf204*=0x13760, dwBufLen=0x13760 | out: pbData=0x26772d8*, pdwDataLen=0x55cf204*=0x13760) returned 1
	[0121.509] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268aa44*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x268aa44*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.509] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0121.509] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.509] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.509] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat", lpFilePart=0x0) returned 0x3e
	[0121.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.510] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storagehealthmodel.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0121.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0121.512] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat", lpFilePart=0x0) returned 0x3f
	[0121.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.512] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat"), fInfoLevelId=0x0, lpFileInformation=0x268b014 | out: lpFileInformation=0x268b014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecc15f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa4ecc15f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa4ecc15f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x930d0)) returned 1
	[0121.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.513] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat", lpFilePart=0x0) returned 0x3f
	[0121.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.513] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.513] GetFileType (hFile=0x5dc) returned 0x1
	[0121.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.513] GetFileType (hFile=0x5dc) returned 0x1
	[0121.514] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x930d0
	[0121.515] ReadFile (in: hFile=0x5dc, lpBuffer=0x6d710c8, nNumberOfBytesToRead=0x930d0, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x6d710c8*, lpNumberOfBytesRead=0x55cf1fc*=0x930d0, lpOverlapped=0x0) returned 1
	[0121.539] CloseHandle (hObject=0x5dc) returned 1
	[0121.539] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0121.539] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.539] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268b2f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0121.539] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.539] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.539] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b0c0) returned 1
	[0121.539] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.539] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x268b3ac*=0x1, dwFlags=0x0) returned 1
	[0121.539] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x268b378, dwFlags=0x0) returned 1
	[0121.548] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6e041b8*, pdwDataLen=0x55cf204*=0x930e0, dwBufLen=0x930e0 | out: pbData=0x6e041b8*, pdwDataLen=0x55cf204*=0x930e0) returned 1
	[0121.548] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268b3bc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x268b3bc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.549] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0121.549] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.549] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.549] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat", lpFilePart=0x0) returned 0x3f
	[0121.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.549] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.556] GetFileType (hFile=0x5dc) returned 0x1
	[0121.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.557] GetFileType (hFile=0x5dc) returned 0x1
	[0121.557] WriteFile (in: hFile=0x5dc, lpBuffer=0x6e041b8*, nNumberOfBytesToWrite=0x930e0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x6e041b8*, lpNumberOfBytesWritten=0x55cf1f0*=0x930e0, lpOverlapped=0x0) returned 1
	[0121.586] CloseHandle (hObject=0x5dc) returned 1
	[0121.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat", lpFilePart=0x0) returned 0x3f
	[0121.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6e
	[0121.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.587] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecc15f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa4ecc15f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x82ce21f5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x930e0)) returned 1
	[0121.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.587] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat", lpFilePart=0x0) returned 0x39
	[0121.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.588] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\fd1hvy.dat"), fInfoLevelId=0x0, lpFileInformation=0x268b808 | out: lpFileInformation=0x268b808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37896d36, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37896d36, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37896d36, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0121.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat", lpFilePart=0x0) returned 0x39
	[0121.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.591] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\fd1hvy.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.591] GetFileType (hFile=0x5dc) returned 0x1
	[0121.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.591] GetFileType (hFile=0x5dc) returned 0x1
	[0121.591] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x0
	[0121.591] CloseHandle (hObject=0x5dc) returned 1
	[0121.592] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0121.592] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.592] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268bac4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0121.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.593] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0121.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.593] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x268bb7c*=0x1, dwFlags=0x0) returned 1
	[0121.593] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x268bb48, dwFlags=0x0) returned 1
	[0121.593] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268bb8c*, pdwDataLen=0x55cf204*=0x10, dwBufLen=0x10 | out: pbData=0x268bb8c*, pdwDataLen=0x55cf204*=0x10) returned 1
	[0121.593] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268bba8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x268bba8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.593] CryptDestroyKey (hKey=0x82b280) returned 1
	[0121.593] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.594] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat", lpFilePart=0x0) returned 0x39
	[0121.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.594] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\fd1hvy.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.594] GetFileType (hFile=0x5dc) returned 0x1
	[0121.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.594] GetFileType (hFile=0x5dc) returned 0x1
	[0121.595] WriteFile (in: hFile=0x5dc, lpBuffer=0x268bcc4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x268bcc4*, lpNumberOfBytesWritten=0x55cf1c4*=0x10, lpOverlapped=0x0) returned 1
	[0121.596] CloseHandle (hObject=0x5dc) returned 1
	[0121.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat", lpFilePart=0x0) returned 0x39
	[0121.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0121.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.596] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\fd1hvy.dat"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37896d36, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37896d36, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x82cf1dce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1
	[0121.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.596] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\fd1hvy.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\user account pictures\\fd1hvy.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.597] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", lpFilePart=0x0) returned 0x38
	[0121.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.597] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), fInfoLevelId=0x0, lpFileInformation=0x268cfb8 | out: lpFileInformation=0x268cfb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038)) returned 1
	[0121.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", lpFilePart=0x0) returned 0x38
	[0121.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.606] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.606] GetFileType (hFile=0x5dc) returned 0x1
	[0121.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.606] GetFileType (hFile=0x5dc) returned 0x1
	[0121.606] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x93038
	[0121.608] ReadFile (in: hFile=0x5dc, lpBuffer=0x6ea1018, nNumberOfBytesToRead=0x93038, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x6ea1018*, lpNumberOfBytesRead=0x55cf1fc*=0x93038, lpOverlapped=0x0) returned 1
	[0121.636] CloseHandle (hObject=0x5dc) returned 1
	[0121.636] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0121.636] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.636] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268d260, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0121.636] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.637] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.637] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0121.637] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.637] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x268d318*=0x1, dwFlags=0x0) returned 1
	[0121.637] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x268d2e4, dwFlags=0x0) returned 1
	[0121.645] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f34070*, pdwDataLen=0x55cf204*=0x93040, dwBufLen=0x93040 | out: pbData=0x6f34070*, pdwDataLen=0x55cf204*=0x93040) returned 1
	[0121.646] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268d328*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x268d328*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.646] CryptDestroyKey (hKey=0x82b340) returned 1
	[0121.646] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.646] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", lpFilePart=0x0) returned 0x38
	[0121.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.646] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.653] GetFileType (hFile=0x5dc) returned 0x1
	[0121.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.653] GetFileType (hFile=0x5dc) returned 0x1
	[0121.653] WriteFile (in: hFile=0x5dc, lpBuffer=0x6f34070*, nNumberOfBytesToWrite=0x93040, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x6f34070*, lpNumberOfBytesWritten=0x55cf1f0*=0x93040, lpOverlapped=0x0) returned 1
	[0121.664] CloseHandle (hObject=0x5dc) returned 1
	[0121.665] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", lpFilePart=0x0) returned 0x38
	[0121.665] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0121.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.665] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x82d8ab10, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x93040)) returned 1
	[0121.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.665] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.666] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png", lpFilePart=0x0) returned 0x38
	[0121.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.666] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), fInfoLevelId=0x0, lpFileInformation=0x268d71c | out: lpFileInformation=0x268d71c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518)) returned 1
	[0121.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png", lpFilePart=0x0) returned 0x38
	[0121.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.667] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.667] GetFileType (hFile=0x5dc) returned 0x1
	[0121.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.667] GetFileType (hFile=0x5dc) returned 0x1
	[0121.667] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1518
	[0121.667] ReadFile (in: hFile=0x5dc, lpBuffer=0x268d934, nNumberOfBytesToRead=0x1518, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x268d934*, lpNumberOfBytesRead=0x55cf1fc*=0x1518, lpOverlapped=0x0) returned 1
	[0121.674] CloseHandle (hObject=0x5dc) returned 1
	[0121.674] CryptDestroyKey (hKey=0x82b300) returned 1
	[0121.674] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.674] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268eee8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b440) returned 1
	[0121.674] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.675] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.675] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0121.675] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.675] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x268efa0*=0x1, dwFlags=0x0) returned 1
	[0121.675] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x268ef6c, dwFlags=0x0) returned 1
	[0121.675] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268efb0*, pdwDataLen=0x55cf204*=0x1520, dwBufLen=0x1520 | out: pbData=0x268efb0*, pdwDataLen=0x55cf204*=0x1520) returned 1
	[0121.675] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26904dc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26904dc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.675] CryptDestroyKey (hKey=0x82b100) returned 1
	[0121.675] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.675] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png", lpFilePart=0x0) returned 0x38
	[0121.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.675] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.677] GetFileType (hFile=0x5dc) returned 0x1
	[0121.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.677] GetFileType (hFile=0x5dc) returned 0x1
	[0121.677] WriteFile (in: hFile=0x5dc, lpBuffer=0x268efb0*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x268efb0*, lpNumberOfBytesWritten=0x55cf1f0*=0x1520, lpOverlapped=0x0) returned 1
	[0121.678] CloseHandle (hObject=0x5dc) returned 1
	[0121.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png", lpFilePart=0x0) returned 0x38
	[0121.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0121.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.679] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x82db0d8c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1520)) returned 1
	[0121.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.679] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png", lpFilePart=0x0) returned 0x3b
	[0121.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.680] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), fInfoLevelId=0x0, lpFileInformation=0x26908d0 | out: lpFileInformation=0x26908d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x967)) returned 1
	[0121.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.689] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png", lpFilePart=0x0) returned 0x3b
	[0121.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.689] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.689] GetFileType (hFile=0x5dc) returned 0x1
	[0121.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.689] GetFileType (hFile=0x5dc) returned 0x1
	[0121.689] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x967
	[0121.690] ReadFile (in: hFile=0x5dc, lpBuffer=0x2691474, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2691474*, lpNumberOfBytesRead=0x55cf1fc*=0x967, lpOverlapped=0x0) returned 1
	[0121.701] CloseHandle (hObject=0x5dc) returned 1
	[0121.701] CryptDestroyKey (hKey=0x82b440) returned 1
	[0121.701] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.701] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2692510, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0121.701] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.701] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.701] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0121.701] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.702] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26925c8*=0x1, dwFlags=0x0) returned 1
	[0121.702] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2692594, dwFlags=0x0) returned 1
	[0121.702] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26925d8*, pdwDataLen=0x55cf204*=0x970, dwBufLen=0x970 | out: pbData=0x26925d8*, pdwDataLen=0x55cf204*=0x970) returned 1
	[0121.702] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2692f54*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2692f54*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.702] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0121.702] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.702] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.702] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png", lpFilePart=0x0) returned 0x3b
	[0121.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.702] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.704] GetFileType (hFile=0x5dc) returned 0x1
	[0121.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.704] GetFileType (hFile=0x5dc) returned 0x1
	[0121.704] WriteFile (in: hFile=0x5dc, lpBuffer=0x2693078*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2693078*, lpNumberOfBytesWritten=0x55cf1c4*=0x970, lpOverlapped=0x0) returned 1
	[0121.706] CloseHandle (hObject=0x5dc) returned 1
	[0121.706] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png", lpFilePart=0x0) returned 0x3b
	[0121.706] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6a
	[0121.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.707] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x82dfd1f6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x970)) returned 1
	[0121.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.707] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png", lpFilePart=0x0) returned 0x3a
	[0121.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.708] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), fInfoLevelId=0x0, lpFileInformation=0x269437c | out: lpFileInformation=0x269437c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19f)) returned 1
	[0121.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.709] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png", lpFilePart=0x0) returned 0x3a
	[0121.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.709] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.709] GetFileType (hFile=0x5dc) returned 0x1
	[0121.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.710] GetFileType (hFile=0x5dc) returned 0x1
	[0121.710] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x19f
	[0121.710] ReadFile (in: hFile=0x5dc, lpBuffer=0x2694750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2694750*, lpNumberOfBytesRead=0x55cf1fc*=0x19f, lpOverlapped=0x0) returned 1
	[0121.711] CloseHandle (hObject=0x5dc) returned 1
	[0121.711] CryptDestroyKey (hKey=0x82b540) returned 1
	[0121.711] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.712] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26957ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0121.712] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.712] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.712] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0121.712] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.712] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26958a4*=0x1, dwFlags=0x0) returned 1
	[0121.712] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2695870, dwFlags=0x0) returned 1
	[0121.712] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26958b4*, pdwDataLen=0x55cf204*=0x1a0, dwBufLen=0x1a0 | out: pbData=0x26958b4*, pdwDataLen=0x55cf204*=0x1a0) returned 1
	[0121.712] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2695a60*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2695a60*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.712] CryptDestroyKey (hKey=0x82b280) returned 1
	[0121.712] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.712] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png", lpFilePart=0x0) returned 0x3a
	[0121.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.713] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.714] GetFileType (hFile=0x5dc) returned 0x1
	[0121.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.714] GetFileType (hFile=0x5dc) returned 0x1
	[0121.714] WriteFile (in: hFile=0x5dc, lpBuffer=0x2695b80*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2695b80*, lpNumberOfBytesWritten=0x55cf1c4*=0x1a0, lpOverlapped=0x0) returned 1
	[0121.723] CloseHandle (hObject=0x5dc) returned 1
	[0121.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png", lpFilePart=0x0) returned 0x3a
	[0121.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0121.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.724] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x82e234f0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1a0)) returned 1
	[0121.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.724] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png", lpFilePart=0x0) returned 0x3a
	[0121.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.725] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), fInfoLevelId=0x0, lpFileInformation=0x2696e78 | out: lpFileInformation=0x2696e78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b1)) returned 1
	[0121.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png", lpFilePart=0x0) returned 0x3a
	[0121.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.726] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.726] GetFileType (hFile=0x5dc) returned 0x1
	[0121.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.726] GetFileType (hFile=0x5dc) returned 0x1
	[0121.726] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1b1
	[0121.726] ReadFile (in: hFile=0x5dc, lpBuffer=0x2697260, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2697260*, lpNumberOfBytesRead=0x55cf1fc*=0x1b1, lpOverlapped=0x0) returned 1
	[0121.727] CloseHandle (hObject=0x5dc) returned 1
	[0121.728] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0121.728] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.728] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26982fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0121.728] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.728] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.728] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0121.728] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.728] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26983b4*=0x1, dwFlags=0x0) returned 1
	[0121.728] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2698380, dwFlags=0x0) returned 1
	[0121.728] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26983c4*, pdwDataLen=0x55cf204*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x26983c4*, pdwDataLen=0x55cf204*=0x1c0) returned 1
	[0121.728] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2698590*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2698590*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.729] CryptDestroyKey (hKey=0x82b280) returned 1
	[0121.729] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.729] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png", lpFilePart=0x0) returned 0x3a
	[0121.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.729] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.730] GetFileType (hFile=0x5dc) returned 0x1
	[0121.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.730] GetFileType (hFile=0x5dc) returned 0x1
	[0121.730] WriteFile (in: hFile=0x5dc, lpBuffer=0x26986b0*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26986b0*, lpNumberOfBytesWritten=0x55cf1c4*=0x1c0, lpOverlapped=0x0) returned 1
	[0121.731] CloseHandle (hObject=0x5dc) returned 1
	[0121.731] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png", lpFilePart=0x0) returned 0x3a
	[0121.732] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0121.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.732] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x82e234f0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1c0)) returned 1
	[0121.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.732] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.733] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png", lpFilePart=0x0) returned 0x3a
	[0121.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.733] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), fInfoLevelId=0x0, lpFileInformation=0x26999a8 | out: lpFileInformation=0x26999a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f5)) returned 1
	[0121.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.733] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png", lpFilePart=0x0) returned 0x3a
	[0121.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.734] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.734] GetFileType (hFile=0x5dc) returned 0x1
	[0121.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.734] GetFileType (hFile=0x5dc) returned 0x1
	[0121.734] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1f5
	[0121.734] ReadFile (in: hFile=0x5dc, lpBuffer=0x2699dd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2699dd4*, lpNumberOfBytesRead=0x55cf1fc*=0x1f5, lpOverlapped=0x0) returned 1
	[0121.735] CloseHandle (hObject=0x5dc) returned 1
	[0121.735] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0121.735] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.735] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269ae70, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0121.735] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.735] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.736] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b440) returned 1
	[0121.736] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.736] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x269af28*=0x1, dwFlags=0x0) returned 1
	[0121.736] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x269aef4, dwFlags=0x0) returned 1
	[0121.736] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269af38*, pdwDataLen=0x55cf204*=0x200, dwBufLen=0x200 | out: pbData=0x269af38*, pdwDataLen=0x55cf204*=0x200) returned 1
	[0121.736] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269b144*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x269b144*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.736] CryptDestroyKey (hKey=0x82b440) returned 1
	[0121.736] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.736] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.736] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png", lpFilePart=0x0) returned 0x3a
	[0121.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.736] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.738] GetFileType (hFile=0x5dc) returned 0x1
	[0121.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.738] GetFileType (hFile=0x5dc) returned 0x1
	[0121.738] WriteFile (in: hFile=0x5dc, lpBuffer=0x269b264*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x269b264*, lpNumberOfBytesWritten=0x55cf1c4*=0x200, lpOverlapped=0x0) returned 1
	[0121.739] CloseHandle (hObject=0x5dc) returned 1
	[0121.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png", lpFilePart=0x0) returned 0x3a
	[0121.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0121.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.739] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x82e49783, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1
	[0121.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.740] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.740] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", lpFilePart=0x0) returned 0x37
	[0121.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.741] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), fInfoLevelId=0x0, lpFileInformation=0x269c55c | out: lpFileInformation=0x269c55c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038)) returned 1
	[0121.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", lpFilePart=0x0) returned 0x37
	[0121.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.741] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.743] ReadFile (in: hFile=0x5dc, lpBuffer=0x6fc70d0, nNumberOfBytesToRead=0x93038, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x6fc70d0*, lpNumberOfBytesRead=0x55cf1fc*=0x93038, lpOverlapped=0x0) returned 1
	[0121.772] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0121.772] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.773] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269c7fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0121.773] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.773] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.773] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0121.773] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.773] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x269c8b4*=0x1, dwFlags=0x0) returned 1
	[0121.773] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x269c880, dwFlags=0x0) returned 1
	[0121.781] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x705a128*, pdwDataLen=0x55cf204*=0x93040, dwBufLen=0x93040 | out: pbData=0x705a128*, pdwDataLen=0x55cf204*=0x93040) returned 1
	[0121.782] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269c8c4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x269c8c4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.782] CryptDestroyKey (hKey=0x82b080) returned 1
	[0121.782] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.782] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.782] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", lpFilePart=0x0) returned 0x37
	[0121.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.782] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.789] GetFileType (hFile=0x5dc) returned 0x1
	[0121.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.789] GetFileType (hFile=0x5dc) returned 0x1
	[0121.789] WriteFile (in: hFile=0x5dc, lpBuffer=0x705a128*, nNumberOfBytesToWrite=0x93040, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x705a128*, lpNumberOfBytesWritten=0x55cf1f0*=0x93040, lpOverlapped=0x0) returned 1
	[0121.801] CloseHandle (hObject=0x5dc) returned 1
	[0121.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", lpFilePart=0x0) returned 0x37
	[0121.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0121.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.802] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x82ee2003, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x93040)) returned 1
	[0121.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.802] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.803] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png", lpFilePart=0x0) returned 0x37
	[0121.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.803] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), fInfoLevelId=0x0, lpFileInformation=0x269ccb0 | out: lpFileInformation=0x269ccb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518)) returned 1
	[0121.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png", lpFilePart=0x0) returned 0x37
	[0121.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.804] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.804] GetFileType (hFile=0x5dc) returned 0x1
	[0121.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.804] GetFileType (hFile=0x5dc) returned 0x1
	[0121.804] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1518
	[0121.804] ReadFile (in: hFile=0x5dc, lpBuffer=0x269cec0, nNumberOfBytesToRead=0x1518, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x269cec0*, lpNumberOfBytesRead=0x55cf1fc*=0x1518, lpOverlapped=0x0) returned 1
	[0121.805] CloseHandle (hObject=0x5dc) returned 1
	[0121.805] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0121.805] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.806] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269e474, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0121.806] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.806] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.806] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0121.806] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.806] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x269e52c*=0x1, dwFlags=0x0) returned 1
	[0121.806] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x269e4f8, dwFlags=0x0) returned 1
	[0121.806] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269e53c*, pdwDataLen=0x55cf204*=0x1520, dwBufLen=0x1520 | out: pbData=0x269e53c*, pdwDataLen=0x55cf204*=0x1520) returned 1
	[0121.806] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269fa68*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x269fa68*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.806] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0121.806] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.806] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.806] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png", lpFilePart=0x0) returned 0x37
	[0121.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.807] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.808] GetFileType (hFile=0x5dc) returned 0x1
	[0121.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.808] GetFileType (hFile=0x5dc) returned 0x1
	[0121.808] WriteFile (in: hFile=0x5dc, lpBuffer=0x269e53c*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x269e53c*, lpNumberOfBytesWritten=0x55cf1f0*=0x1520, lpOverlapped=0x0) returned 1
	[0121.809] CloseHandle (hObject=0x5dc) returned 1
	[0121.810] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png", lpFilePart=0x0) returned 0x37
	[0121.810] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0121.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.810] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x82ee2003, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1520)) returned 1
	[0121.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.810] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.811] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini", lpFilePart=0x0) returned 0x34
	[0121.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.811] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\programdata\\microsoft onedrive\\setup\\refcount.ini"), fInfoLevelId=0x0, lpFileInformation=0x269fe54 | out: lpFileInformation=0x269fe54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0121.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.812] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini", lpFilePart=0x0) returned 0x34
	[0121.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.812] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\programdata\\microsoft onedrive\\setup\\refcount.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.812] GetFileType (hFile=0x5dc) returned 0x1
	[0121.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.812] GetFileType (hFile=0x5dc) returned 0x1
	[0121.812] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x0
	[0121.812] CloseHandle (hObject=0x5dc) returned 1
	[0121.813] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0121.813] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.813] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a0108, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0121.813] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.813] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.813] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0121.813] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.813] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26a01c0*=0x1, dwFlags=0x0) returned 1
	[0121.813] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26a018c, dwFlags=0x0) returned 1
	[0121.813] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a01d0*, pdwDataLen=0x55cf204*=0x10, dwBufLen=0x10 | out: pbData=0x26a01d0*, pdwDataLen=0x55cf204*=0x10) returned 1
	[0121.813] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a01ec*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26a01ec*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.814] CryptDestroyKey (hKey=0x82b340) returned 1
	[0121.814] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.814] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.814] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini", lpFilePart=0x0) returned 0x34
	[0121.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.814] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\programdata\\microsoft onedrive\\setup\\refcount.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.814] GetFileType (hFile=0x5dc) returned 0x1
	[0121.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.814] GetFileType (hFile=0x5dc) returned 0x1
	[0121.815] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a0304*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26a0304*, lpNumberOfBytesWritten=0x55cf1c4*=0x10, lpOverlapped=0x0) returned 1
	[0121.816] CloseHandle (hObject=0x5dc) returned 1
	[0121.816] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini", lpFilePart=0x0) returned 0x34
	[0121.816] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x63
	[0121.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.817] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\programdata\\microsoft onedrive\\setup\\refcount.ini"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x82f082b0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1
	[0121.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.817] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\programdata\\microsoft onedrive\\setup\\refcount.ini"), lpNewFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft onedrive\\setup\\refcount.ini id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.818] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0121.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.818] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x26a15cc | out: lpFileInformation=0x26a15cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x354d9570, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272)) returned 1
	[0121.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.818] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0121.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.818] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.819] GetFileType (hFile=0x5dc) returned 0x1
	[0121.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.819] GetFileType (hFile=0x5dc) returned 0x1
	[0121.819] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x272
	[0121.819] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a1ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26a1ab4*, lpNumberOfBytesRead=0x55cf1fc*=0x272, lpOverlapped=0x0) returned 1
	[0121.820] CloseHandle (hObject=0x5dc) returned 1
	[0121.821] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0121.821] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.821] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a2b50, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0121.821] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.821] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.821] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b400) returned 1
	[0121.821] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.821] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x26a2c08*=0x1, dwFlags=0x0) returned 1
	[0121.821] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26a2bd4, dwFlags=0x0) returned 1
	[0121.821] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a2c18*, pdwDataLen=0x55cf204*=0x280, dwBufLen=0x280 | out: pbData=0x26a2c18*, pdwDataLen=0x55cf204*=0x280) returned 1
	[0121.821] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a2ea4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26a2ea4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.821] CryptDestroyKey (hKey=0x82b400) returned 1
	[0121.822] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.822] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.822] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0121.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.822] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.823] GetFileType (hFile=0x5dc) returned 0x1
	[0121.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.823] GetFileType (hFile=0x5dc) returned 0x1
	[0121.823] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a2fe4*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26a2fe4*, lpNumberOfBytesWritten=0x55cf1c4*=0x280, lpOverlapped=0x0) returned 1
	[0121.825] CloseHandle (hObject=0x5dc) returned 1
	[0121.825] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0121.825] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7c
	[0121.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.825] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x82f082b0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0121.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.826] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.829] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", lpFilePart=0x0) returned 0x54
	[0121.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.829] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), fInfoLevelId=0x0, lpFileInformation=0x26a4378 | out: lpFileInformation=0x26a4378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428)) returned 1
	[0121.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.829] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", lpFilePart=0x0) returned 0x54
	[0121.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.830] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.830] GetFileType (hFile=0x5dc) returned 0x1
	[0121.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.830] GetFileType (hFile=0x5dc) returned 0x1
	[0121.830] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x6f428
	[0121.831] ReadFile (in: hFile=0x5dc, lpBuffer=0x70ed188, nNumberOfBytesToRead=0x6f428, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x70ed188*, lpNumberOfBytesRead=0x55cf1fc*=0x6f428, lpOverlapped=0x0) returned 1
	[0121.849] CloseHandle (hObject=0x5dc) returned 1
	[0121.849] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0121.849] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.849] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a46b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0121.849] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.849] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.850] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0121.850] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.850] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26a4768*=0x1, dwFlags=0x0) returned 1
	[0121.850] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26a4734, dwFlags=0x0) returned 1
	[0121.856] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x715c5d0*, pdwDataLen=0x55cf204*=0x6f430, dwBufLen=0x6f430 | out: pbData=0x715c5d0*, pdwDataLen=0x55cf204*=0x6f430) returned 1
	[0121.857] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a4778*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26a4778*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.857] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0121.857] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.857] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.857] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", lpFilePart=0x0) returned 0x54
	[0121.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.857] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.863] GetFileType (hFile=0x5dc) returned 0x1
	[0121.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.863] GetFileType (hFile=0x5dc) returned 0x1
	[0121.863] WriteFile (in: hFile=0x5dc, lpBuffer=0x715c5d0*, nNumberOfBytesToWrite=0x6f430, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x715c5d0*, lpNumberOfBytesWritten=0x55cf1f0*=0x6f430, lpOverlapped=0x0) returned 1
	[0121.871] CloseHandle (hObject=0x5dc) returned 1
	[0121.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", lpFilePart=0x0) returned 0x54
	[0121.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x83
	[0121.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.872] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x82f7a9aa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x6f430)) returned 1
	[0121.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.872] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.873] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0121.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.873] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x26a4c94 | out: lpFileInformation=0x26a4c94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3639a1f2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e)) returned 1
	[0121.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.875] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0121.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.875] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.875] GetFileType (hFile=0x5dc) returned 0x1
	[0121.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.875] GetFileType (hFile=0x5dc) returned 0x1
	[0121.875] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x27e
	[0121.875] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a5188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26a5188*, lpNumberOfBytesRead=0x55cf1fc*=0x27e, lpOverlapped=0x0) returned 1
	[0121.876] CloseHandle (hObject=0x5dc) returned 1
	[0121.877] CryptDestroyKey (hKey=0x82b280) returned 1
	[0121.877] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.877] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a6224, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0121.877] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.877] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.877] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b0c0) returned 1
	[0121.877] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.877] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26a62dc*=0x1, dwFlags=0x0) returned 1
	[0121.877] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x26a62a8, dwFlags=0x0) returned 1
	[0121.877] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a62ec*, pdwDataLen=0x55cf204*=0x280, dwBufLen=0x280 | out: pbData=0x26a62ec*, pdwDataLen=0x55cf204*=0x280) returned 1
	[0121.877] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a6578*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26a6578*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.878] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0121.878] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.878] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0121.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.878] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.879] GetFileType (hFile=0x5dc) returned 0x1
	[0121.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.879] GetFileType (hFile=0x5dc) returned 0x1
	[0121.879] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a66b8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26a66b8*, lpNumberOfBytesWritten=0x55cf1c4*=0x280, lpOverlapped=0x0) returned 1
	[0121.880] CloseHandle (hObject=0x5dc) returned 1
	[0121.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0121.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7c
	[0121.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.881] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x82fa0ae5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0121.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.881] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.888] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", lpFilePart=0x0) returned 0x54
	[0121.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.888] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), fInfoLevelId=0x0, lpFileInformation=0x26a7a4c | out: lpFileInformation=0x26a7a4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8)) returned 1
	[0121.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.889] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", lpFilePart=0x0) returned 0x54
	[0121.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.889] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.889] GetFileType (hFile=0x5dc) returned 0x1
	[0121.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.889] GetFileType (hFile=0x5dc) returned 0x1
	[0121.889] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x710a8
	[0121.891] ReadFile (in: hFile=0x5dc, lpBuffer=0x71cba20, nNumberOfBytesToRead=0x710a8, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x71cba20*, lpNumberOfBytesRead=0x55cf1fc*=0x710a8, lpOverlapped=0x0) returned 1
	[0121.908] CloseHandle (hObject=0x5dc) returned 1
	[0121.908] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0121.908] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.908] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a7d84, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0121.908] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.908] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.908] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0121.908] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.908] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26a7e3c*=0x1, dwFlags=0x0) returned 1
	[0121.908] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x26a7e08, dwFlags=0x0) returned 1
	[0121.915] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x723cae8*, pdwDataLen=0x55cf204*=0x710b0, dwBufLen=0x710b0 | out: pbData=0x723cae8*, pdwDataLen=0x55cf204*=0x710b0) returned 1
	[0121.915] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a7e4c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26a7e4c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.916] CryptDestroyKey (hKey=0x82b100) returned 1
	[0121.916] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.916] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", lpFilePart=0x0) returned 0x54
	[0121.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.916] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.920] GetFileType (hFile=0x5dc) returned 0x1
	[0121.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.921] GetFileType (hFile=0x5dc) returned 0x1
	[0121.921] WriteFile (in: hFile=0x5dc, lpBuffer=0x723cae8*, nNumberOfBytesToWrite=0x710b0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x723cae8*, lpNumberOfBytesWritten=0x55cf1f0*=0x710b0, lpOverlapped=0x0) returned 1
	[0121.931] CloseHandle (hObject=0x5dc) returned 1
	[0121.932] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", lpFilePart=0x0) returned 0x54
	[0121.932] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x83
	[0121.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.932] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x83013499, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x710b0)) returned 1
	[0121.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.932] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.933] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0121.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.933] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x26a8368 | out: lpFileInformation=0x26a8368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x359ea6b6, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272)) returned 1
	[0121.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.934] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0121.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.934] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.934] GetFileType (hFile=0x5dc) returned 0x1
	[0121.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.934] GetFileType (hFile=0x5dc) returned 0x1
	[0121.934] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x272
	[0121.934] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a8850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26a8850*, lpNumberOfBytesRead=0x55cf1fc*=0x272, lpOverlapped=0x0) returned 1
	[0121.936] CloseHandle (hObject=0x5dc) returned 1
	[0121.936] CryptDestroyKey (hKey=0x82b340) returned 1
	[0121.936] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.936] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a98ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0121.936] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.936] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.936] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0121.936] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.936] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x26a99a4*=0x1, dwFlags=0x0) returned 1
	[0121.936] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x26a9970, dwFlags=0x0) returned 1
	[0121.936] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a99b4*, pdwDataLen=0x55cf204*=0x280, dwBufLen=0x280 | out: pbData=0x26a99b4*, pdwDataLen=0x55cf204*=0x280) returned 1
	[0121.937] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a9c40*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26a9c40*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.937] CryptDestroyKey (hKey=0x82b000) returned 1
	[0121.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.937] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0121.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0121.937] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.938] GetFileType (hFile=0x5dc) returned 0x1
	[0121.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0121.939] GetFileType (hFile=0x5dc) returned 0x1
	[0121.939] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a9d80*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26a9d80*, lpNumberOfBytesWritten=0x55cf1c4*=0x280, lpOverlapped=0x0) returned 1
	[0121.940] CloseHandle (hObject=0x5dc) returned 1
	[0121.940] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0121.940] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7c
	[0121.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0121.941] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8303958c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0121.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0121.941] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0121.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", lpFilePart=0x0) returned 0x54
	[0121.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0121.951] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), fInfoLevelId=0x0, lpFileInformation=0x26ab114 | out: lpFileInformation=0x26ab114*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398)) returned 1
	[0121.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0121.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", lpFilePart=0x0) returned 0x54
	[0121.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0121.952] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0121.952] GetFileType (hFile=0x5dc) returned 0x1
	[0121.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0121.952] GetFileType (hFile=0x5dc) returned 0x1
	[0121.952] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x6f398
	[0121.954] ReadFile (in: hFile=0x5dc, lpBuffer=0x72adbb8, nNumberOfBytesToRead=0x6f398, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x72adbb8*, lpNumberOfBytesRead=0x55cf1fc*=0x6f398, lpOverlapped=0x0) returned 1
	[0121.965] CloseHandle (hObject=0x5dc) returned 1
	[0121.965] CryptDestroyKey (hKey=0x82b300) returned 1
	[0121.965] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.965] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ab44c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b4c0) returned 1
	[0121.965] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.965] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.966] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0121.966] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0121.966] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26ab504*=0x1, dwFlags=0x0) returned 1
	[0121.966] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26ab4d0, dwFlags=0x0) returned 1
	[0121.972] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x731cf70*, pdwDataLen=0x55cf204*=0x6f3a0, dwBufLen=0x6f3a0 | out: pbData=0x731cf70*, pdwDataLen=0x55cf204*=0x6f3a0) returned 1
	[0121.973] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ab514*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26ab514*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0121.973] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0121.973] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.973] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0121.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", lpFilePart=0x0) returned 0x54
	[0121.979] WriteFile (in: hFile=0x5dc, lpBuffer=0x731cf70*, nNumberOfBytesToWrite=0x6f3a0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x731cf70*, lpNumberOfBytesWritten=0x55cf1f0*=0x6f3a0, lpOverlapped=0x0) returned 1
	[0122.059] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.067] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0122.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0122.067] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.067] GetFileType (hFile=0x5dc) returned 0x1
	[0122.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0122.067] GetFileType (hFile=0x5dc) returned 0x1
	[0122.067] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2ee
	[0122.067] ReadFile (in: hFile=0x5dc, lpBuffer=0x26abf94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26abf94*, lpNumberOfBytesRead=0x55cf1fc*=0x2ee, lpOverlapped=0x0) returned 1
	[0122.079] CloseHandle (hObject=0x5dc) returned 1
	[0122.079] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0122.079] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.080] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ad030, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0122.080] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.080] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.080] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0122.080] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.080] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26ad0e8*=0x1, dwFlags=0x0) returned 1
	[0122.080] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26ad0b4, dwFlags=0x0) returned 1
	[0122.080] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ad0f8*, pdwDataLen=0x55cf204*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x26ad0f8*, pdwDataLen=0x55cf204*=0x2f0) returned 1
	[0122.080] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ad3f4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26ad3f4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0122.080] CryptDestroyKey (hKey=0x82b280) returned 1
	[0122.080] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.080] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0122.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0122.081] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.082] GetFileType (hFile=0x5dc) returned 0x1
	[0122.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0122.082] GetFileType (hFile=0x5dc) returned 0x1
	[0122.082] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ad534*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26ad534*, lpNumberOfBytesWritten=0x55cf1c4*=0x2f0, lpOverlapped=0x0) returned 1
	[0122.083] CloseHandle (hObject=0x5dc) returned 1
	[0122.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0122.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7c
	[0122.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0122.084] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x83191215, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0122.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0122.084] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.216] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", lpFilePart=0x0) returned 0x55
	[0122.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0122.217] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), fInfoLevelId=0x0, lpFileInformation=0x26ae8c8 | out: lpFileInformation=0x26ae8c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38)) returned 1
	[0122.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0122.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", lpFilePart=0x0) returned 0x55
	[0122.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0122.217] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.218] GetFileType (hFile=0x5dc) returned 0x1
	[0122.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0122.218] GetFileType (hFile=0x5dc) returned 0x1
	[0122.218] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xbee38
	[0122.220] ReadFile (in: hFile=0x5dc, lpBuffer=0x738c330, nNumberOfBytesToRead=0xbee38, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x738c330*, lpNumberOfBytesRead=0x55cf1fc*=0xbee38, lpOverlapped=0x0) returned 1
	[0122.361] CloseHandle (hObject=0x5dc) returned 1
	[0122.361] CryptDestroyKey (hKey=0x82b300) returned 1
	[0122.361] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.361] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26aec00, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0122.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.361] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0122.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0122.361] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26aecb8*=0x1, dwFlags=0x0) returned 1
	[0122.361] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26aec84, dwFlags=0x0) returned 1
	[0122.372] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x744b188*, pdwDataLen=0x55cf204*=0xbee40, dwBufLen=0xbee40 | out: pbData=0x744b188*, pdwDataLen=0x55cf204*=0xbee40) returned 1
	[0122.373] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26aecc8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26aecc8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0122.373] CryptDestroyKey (hKey=0x82b300) returned 1
	[0122.373] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.373] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0122.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", lpFilePart=0x0) returned 0x55
	[0122.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0122.373] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0122.383] GetFileType (hFile=0x5dc) returned 0x1
	[0122.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0122.383] GetFileType (hFile=0x5dc) returned 0x1
	[0122.383] WriteFile (in: hFile=0x5dc, lpBuffer=0x744b188*, nNumberOfBytesToWrite=0xbee40, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x744b188*, lpNumberOfBytesWritten=0x55cf1f0*=0xbee40, lpOverlapped=0x0) returned 1
	[0122.397] CloseHandle (hObject=0x5dc) returned 1
	[0122.397] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", lpFilePart=0x0) returned 0x55
	[0122.397] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x84
	[0122.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0122.397] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8348ba95, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xbee40)) returned 1
	[0122.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0122.397] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0122.398] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", lpFilePart=0x0) returned 0x4d
	[0122.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0122.398] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), fInfoLevelId=0x0, lpFileInformation=0x26af1f0 | out: lpFileInformation=0x26af1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x35efb7db, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e)) returned 1
	[0122.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0122.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.469] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.493] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.539] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.543] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.543] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.551] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.608] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.653] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.663] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.686] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.706] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.743] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.749] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.757] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.836] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.850] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.850] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.851] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.852] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.878] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.882] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.914] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.940] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.950] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.951] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.965] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.966] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.966] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.967] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.968] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.968] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.969] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.969] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.969] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.003] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.005] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.014] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.431] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.500] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.650] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.652] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.654] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.718] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.763] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.775] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.778] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.780] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.797] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.820] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.826] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.833] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.837] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.839] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.884] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.900] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.913] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.924] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.943] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.951] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.959] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.970] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.974] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.976] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.985] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.988] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.989] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv", lpFilePart=0x0) returned 0x2d
	[0123.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0123.991] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\iv5albjbsw7-ybyvu.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.991] GetFileType (hFile=0x5dc) returned 0x1
	[0123.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0123.991] GetFileType (hFile=0x5dc) returned 0x1
	[0123.991] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x702b
	[0123.991] ReadFile (in: hFile=0x5dc, lpBuffer=0x26fd308, nNumberOfBytesToRead=0x702b, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26fd308*, lpNumberOfBytesRead=0x55cf1fc*=0x702b, lpOverlapped=0x0) returned 1
	[0123.992] CloseHandle (hObject=0x5dc) returned 1
	[0123.992] CryptDestroyKey (hKey=0x82b380) returned 1
	[0123.992] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.992] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27043d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0123.993] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.993] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.993] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0123.993] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.993] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2704488*=0x1, dwFlags=0x0) returned 1
	[0123.993] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2704454, dwFlags=0x0) returned 1
	[0123.993] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2704498*, pdwDataLen=0x55cf204*=0x7030, dwBufLen=0x7030 | out: pbData=0x2704498*, pdwDataLen=0x55cf204*=0x7030) returned 1
	[0123.993] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270b4d4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x270b4d4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0123.993] CryptDestroyKey (hKey=0x82b280) returned 1
	[0123.993] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.993] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv", lpFilePart=0x0) returned 0x2d
	[0123.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0123.993] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\iv5albjbsw7-ybyvu.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.995] GetFileType (hFile=0x5dc) returned 0x1
	[0123.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0123.995] GetFileType (hFile=0x5dc) returned 0x1
	[0123.995] WriteFile (in: hFile=0x5dc, lpBuffer=0x2704498*, nNumberOfBytesToWrite=0x7030, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2704498*, lpNumberOfBytesWritten=0x55cf1f0*=0x7030, lpOverlapped=0x0) returned 1
	[0123.997] CloseHandle (hObject=0x5dc) returned 1
	[0123.997] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv", lpFilePart=0x0) returned 0x2d
	[0123.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0123.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0123.998] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\iv5albjbsw7-ybyvu.flv"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e534060, ftCreationTime.dwHighDateTime=0x1d4d3bb, ftLastAccessTime.dwLowDateTime=0x60d71ac0, ftLastAccessTime.dwHighDateTime=0x1d4d4a1, ftLastWriteTime.dwLowDateTime=0x843be924, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7030)) returned 1
	[0123.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0123.998] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\iv5albjbsw7-ybyvu.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\iv5albjbsw7-ybyvu.flv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi", lpFilePart=0x0) returned 0x22
	[0124.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0124.000] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\j 69tu.avi"), fInfoLevelId=0x0, lpFileInformation=0x270b874 | out: lpFileInformation=0x270b874*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65ef5270, ftCreationTime.dwHighDateTime=0x1d4d550, ftLastAccessTime.dwLowDateTime=0x170ba110, ftLastAccessTime.dwHighDateTime=0x1d4ccfc, ftLastWriteTime.dwLowDateTime=0x170ba110, ftLastWriteTime.dwHighDateTime=0x1d4ccfc, nFileSizeHigh=0x0, nFileSizeLow=0xe199)) returned 1
	[0124.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0124.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi", lpFilePart=0x0) returned 0x22
	[0124.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0124.000] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\j 69tu.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.000] GetFileType (hFile=0x5dc) returned 0x1
	[0124.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0124.000] GetFileType (hFile=0x5dc) returned 0x1
	[0124.000] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xe199
	[0124.000] ReadFile (in: hFile=0x5dc, lpBuffer=0x270ba3c, nNumberOfBytesToRead=0xe199, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x270ba3c*, lpNumberOfBytesRead=0x55cf1fc*=0xe199, lpOverlapped=0x0) returned 1
	[0124.001] CloseHandle (hObject=0x5dc) returned 1
	[0124.001] CryptDestroyKey (hKey=0x82b380) returned 1
	[0124.002] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.002] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2719c74, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0124.002] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.002] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.002] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0124.002] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.002] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2719d2c*=0x1, dwFlags=0x0) returned 1
	[0124.002] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2719cf8, dwFlags=0x0) returned 1
	[0124.002] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2719d3c*, pdwDataLen=0x55cf204*=0xe1a0, dwBufLen=0xe1a0 | out: pbData=0x2719d3c*, pdwDataLen=0x55cf204*=0xe1a0) returned 1
	[0124.002] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2727ee8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2727ee8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0124.002] CryptDestroyKey (hKey=0x82b380) returned 1
	[0124.002] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.002] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.002] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi", lpFilePart=0x0) returned 0x22
	[0124.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0124.002] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\j 69tu.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.005] GetFileType (hFile=0x5dc) returned 0x1
	[0124.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0124.005] GetFileType (hFile=0x5dc) returned 0x1
	[0124.005] WriteFile (in: hFile=0x5dc, lpBuffer=0x2719d3c*, nNumberOfBytesToWrite=0xe1a0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2719d3c*, lpNumberOfBytesWritten=0x55cf1f0*=0xe1a0, lpOverlapped=0x0) returned 1
	[0124.007] CloseHandle (hObject=0x5dc) returned 1
	[0124.007] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi", lpFilePart=0x0) returned 0x22
	[0124.007] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x51
	[0124.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0124.007] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\j 69tu.avi"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65ef5270, ftCreationTime.dwHighDateTime=0x1d4d550, ftLastAccessTime.dwLowDateTime=0x170ba110, ftLastAccessTime.dwHighDateTime=0x1d4ccfc, ftLastWriteTime.dwLowDateTime=0x843e4b76, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xe1a0)) returned 1
	[0124.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0124.008] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\j 69tu.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\j 69tU.avi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\j 69tu.avi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.009] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3", lpFilePart=0x0) returned 0x26
	[0124.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0124.009] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\j iunudt48.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2728204 | out: lpFileInformation=0x2728204*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x539ed80, ftCreationTime.dwHighDateTime=0x1d4cd05, ftLastAccessTime.dwLowDateTime=0x4814820, ftLastAccessTime.dwHighDateTime=0x1d4d3e5, ftLastWriteTime.dwLowDateTime=0x4814820, ftLastWriteTime.dwHighDateTime=0x1d4d3e5, nFileSizeHigh=0x0, nFileSizeLow=0x3929)) returned 1
	[0124.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0124.009] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3", lpFilePart=0x0) returned 0x26
	[0124.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0124.010] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\j iunudt48.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.010] GetFileType (hFile=0x5dc) returned 0x1
	[0124.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0124.010] GetFileType (hFile=0x5dc) returned 0x1
	[0124.010] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x3929
	[0124.010] ReadFile (in: hFile=0x5dc, lpBuffer=0x27283ec, nNumberOfBytesToRead=0x3929, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27283ec*, lpNumberOfBytesRead=0x55cf1fc*=0x3929, lpOverlapped=0x0) returned 1
	[0124.011] CloseHandle (hObject=0x5dc) returned 1
	[0124.011] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0124.011] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.011] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272bdb4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b200) returned 1
	[0124.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.011] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0124.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.011] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x272be6c*=0x1, dwFlags=0x0) returned 1
	[0124.011] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x272be38, dwFlags=0x0) returned 1
	[0124.012] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272be7c*, pdwDataLen=0x55cf204*=0x3930, dwBufLen=0x3930 | out: pbData=0x272be7c*, pdwDataLen=0x55cf204*=0x3930) returned 1
	[0124.012] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272f7b8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x272f7b8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0124.012] CryptDestroyKey (hKey=0x82b480) returned 1
	[0124.012] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.012] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.012] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3", lpFilePart=0x0) returned 0x26
	[0124.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0124.012] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\j iunudt48.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.014] GetFileType (hFile=0x5dc) returned 0x1
	[0124.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0124.014] GetFileType (hFile=0x5dc) returned 0x1
	[0124.014] WriteFile (in: hFile=0x5dc, lpBuffer=0x272be7c*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x272be7c*, lpNumberOfBytesWritten=0x55cf1f0*=0x3930, lpOverlapped=0x0) returned 1
	[0124.015] CloseHandle (hObject=0x5dc) returned 1
	[0124.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3", lpFilePart=0x0) returned 0x26
	[0124.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0124.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0124.016] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\j iunudt48.mp3"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x539ed80, ftCreationTime.dwHighDateTime=0x1d4cd05, ftLastAccessTime.dwLowDateTime=0x4814820, ftLastAccessTime.dwHighDateTime=0x1d4d3e5, ftLastWriteTime.dwLowDateTime=0x8440add7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3930)) returned 1
	[0124.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0124.016] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\j iunudt48.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\j IUnUdt48.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\j iunudt48.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.018] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv", lpFilePart=0x0) returned 0x2d
	[0124.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0124.018] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\j-1ovxtzq4djuztym.flv"), fInfoLevelId=0x0, lpFileInformation=0x272fb04 | out: lpFileInformation=0x272fb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25d97f50, ftCreationTime.dwHighDateTime=0x1d4c865, ftLastAccessTime.dwLowDateTime=0xd6797250, ftLastAccessTime.dwHighDateTime=0x1d4cae2, ftLastWriteTime.dwLowDateTime=0xd6797250, ftLastWriteTime.dwHighDateTime=0x1d4cae2, nFileSizeHigh=0x0, nFileSizeLow=0x11c32)) returned 1
	[0124.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0124.018] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv", lpFilePart=0x0) returned 0x2d
	[0124.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0124.018] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\j-1ovxtzq4djuztym.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.018] GetFileType (hFile=0x5dc) returned 0x1
	[0124.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0124.019] GetFileType (hFile=0x5dc) returned 0x1
	[0124.019] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11c32
	[0124.019] ReadFile (in: hFile=0x5dc, lpBuffer=0x272fd1c, nNumberOfBytesToRead=0x11c32, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x272fd1c*, lpNumberOfBytesRead=0x55cf1fc*=0x11c32, lpOverlapped=0x0) returned 1
	[0124.020] CloseHandle (hObject=0x5dc) returned 1
	[0124.020] CryptDestroyKey (hKey=0x82b200) returned 1
	[0124.020] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.020] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27419ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b040) returned 1
	[0124.020] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.020] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.020] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0124.020] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.020] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2741aa4*=0x1, dwFlags=0x0) returned 1
	[0124.021] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2741a70, dwFlags=0x0) returned 1
	[0124.021] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2741ab4*, pdwDataLen=0x55cf204*=0x11c40, dwBufLen=0x11c40 | out: pbData=0x2741ab4*, pdwDataLen=0x55cf204*=0x11c40) returned 1
	[0124.021] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2753700*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2753700*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0124.021] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0124.021] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.021] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.021] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv", lpFilePart=0x0) returned 0x2d
	[0124.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0124.021] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\j-1ovxtzq4djuztym.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.023] GetFileType (hFile=0x5dc) returned 0x1
	[0124.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0124.024] GetFileType (hFile=0x5dc) returned 0x1
	[0124.024] WriteFile (in: hFile=0x5dc, lpBuffer=0x2741ab4*, nNumberOfBytesToWrite=0x11c40, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2741ab4*, lpNumberOfBytesWritten=0x55cf1f0*=0x11c40, lpOverlapped=0x0) returned 1
	[0124.026] CloseHandle (hObject=0x5dc) returned 1
	[0124.026] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv", lpFilePart=0x0) returned 0x2d
	[0124.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0124.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0124.027] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\j-1ovxtzq4djuztym.flv"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25d97f50, ftCreationTime.dwHighDateTime=0x1d4c865, ftLastAccessTime.dwLowDateTime=0xd6797250, ftLastAccessTime.dwHighDateTime=0x1d4cae2, ftLastWriteTime.dwLowDateTime=0x8440add7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11c40)) returned 1
	[0124.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0124.027] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\j-1ovxtzq4djuztym.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\J-1OVxTZq4djuzTyM.flv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\j-1ovxtzq4djuztym.flv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.030] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png", lpFilePart=0x0) returned 0x24
	[0124.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0124.030] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\jcr9qmg8.png"), fInfoLevelId=0x0, lpFileInformation=0x2753aa0 | out: lpFileInformation=0x2753aa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb673d820, ftCreationTime.dwHighDateTime=0x1d4cfe6, ftLastAccessTime.dwLowDateTime=0xb2abaa20, ftLastAccessTime.dwHighDateTime=0x1d4cb94, ftLastWriteTime.dwLowDateTime=0xb2abaa20, ftLastWriteTime.dwHighDateTime=0x1d4cb94, nFileSizeHigh=0x0, nFileSizeLow=0x6156)) returned 1
	[0124.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0124.030] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png", lpFilePart=0x0) returned 0x24
	[0124.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0124.030] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\jcr9qmg8.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.031] GetFileType (hFile=0x5dc) returned 0x1
	[0124.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0124.031] GetFileType (hFile=0x5dc) returned 0x1
	[0124.031] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x6156
	[0124.031] ReadFile (in: hFile=0x5dc, lpBuffer=0x2753c78, nNumberOfBytesToRead=0x6156, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2753c78*, lpNumberOfBytesRead=0x55cf1fc*=0x6156, lpOverlapped=0x0) returned 1
	[0124.032] CloseHandle (hObject=0x5dc) returned 1
	[0124.032] CryptDestroyKey (hKey=0x82b040) returned 1
	[0124.032] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.032] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2759e6c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b440) returned 1
	[0124.032] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.032] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.032] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0124.032] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.033] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2759f24*=0x1, dwFlags=0x0) returned 1
	[0124.033] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2759ef0, dwFlags=0x0) returned 1
	[0124.033] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2759f34*, pdwDataLen=0x55cf204*=0x6160, dwBufLen=0x6160 | out: pbData=0x2759f34*, pdwDataLen=0x55cf204*=0x6160) returned 1
	[0124.033] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27600a0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27600a0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0124.033] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0124.033] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.033] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.033] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png", lpFilePart=0x0) returned 0x24
	[0124.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0124.033] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\jcr9qmg8.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.035] GetFileType (hFile=0x5dc) returned 0x1
	[0124.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0124.035] GetFileType (hFile=0x5dc) returned 0x1
	[0124.035] WriteFile (in: hFile=0x5dc, lpBuffer=0x2759f34*, nNumberOfBytesToWrite=0x6160, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2759f34*, lpNumberOfBytesWritten=0x55cf1f0*=0x6160, lpOverlapped=0x0) returned 1
	[0124.037] CloseHandle (hObject=0x5dc) returned 1
	[0124.037] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png", lpFilePart=0x0) returned 0x24
	[0124.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x53
	[0124.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0124.038] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\jcr9qmg8.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb673d820, ftCreationTime.dwHighDateTime=0x1d4cfe6, ftLastAccessTime.dwLowDateTime=0xb2abaa20, ftLastAccessTime.dwHighDateTime=0x1d4cb94, ftLastWriteTime.dwLowDateTime=0x84430f97, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x6160)) returned 1
	[0124.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0124.038] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\jcr9qmg8.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\jCr9qMg8.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\jcr9qmg8.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg", lpFilePart=0x0) returned 0x26
	[0124.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0124.039] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\kma2qeehmp.jpg"), fInfoLevelId=0x0, lpFileInformation=0x27603d4 | out: lpFileInformation=0x27603d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78965270, ftCreationTime.dwHighDateTime=0x1d4cfd8, ftLastAccessTime.dwLowDateTime=0xa8d2b680, ftLastAccessTime.dwHighDateTime=0x1d4c7fa, ftLastWriteTime.dwLowDateTime=0xa8d2b680, ftLastWriteTime.dwHighDateTime=0x1d4c7fa, nFileSizeHigh=0x0, nFileSizeLow=0x10a0b)) returned 1
	[0124.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0124.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg", lpFilePart=0x0) returned 0x26
	[0124.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0124.040] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\kma2qeehmp.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.040] GetFileType (hFile=0x5dc) returned 0x1
	[0124.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0124.040] GetFileType (hFile=0x5dc) returned 0x1
	[0124.040] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x10a0b
	[0124.040] ReadFile (in: hFile=0x5dc, lpBuffer=0x27605bc, nNumberOfBytesToRead=0x10a0b, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27605bc*, lpNumberOfBytesRead=0x55cf1fc*=0x10a0b, lpOverlapped=0x0) returned 1
	[0124.041] CloseHandle (hObject=0x5dc) returned 1
	[0124.041] CryptDestroyKey (hKey=0x82b440) returned 1
	[0124.041] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.041] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2771064, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0124.041] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.041] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.041] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0124.042] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.042] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x277111c*=0x1, dwFlags=0x0) returned 1
	[0124.042] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27710e8, dwFlags=0x0) returned 1
	[0124.042] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277112c*, pdwDataLen=0x55cf204*=0x10a10, dwBufLen=0x10a10 | out: pbData=0x277112c*, pdwDataLen=0x55cf204*=0x10a10) returned 1
	[0124.042] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2781b48*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2781b48*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0124.042] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0124.042] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.042] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.042] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg", lpFilePart=0x0) returned 0x26
	[0124.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0124.042] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\kma2qeehmp.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.044] GetFileType (hFile=0x5dc) returned 0x1
	[0124.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0124.044] GetFileType (hFile=0x5dc) returned 0x1
	[0124.044] WriteFile (in: hFile=0x5dc, lpBuffer=0x277112c*, nNumberOfBytesToWrite=0x10a10, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x277112c*, lpNumberOfBytesWritten=0x55cf1f0*=0x10a10, lpOverlapped=0x0) returned 1
	[0124.077] CloseHandle (hObject=0x5dc) returned 1
	[0124.097] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg", lpFilePart=0x0) returned 0x26
	[0124.097] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0124.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0124.097] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\kma2qeehmp.jpg"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78965270, ftCreationTime.dwHighDateTime=0x1d4cfd8, ftLastAccessTime.dwLowDateTime=0xa8d2b680, ftLastAccessTime.dwHighDateTime=0x1d4c7fa, ftLastWriteTime.dwLowDateTime=0x8447d4ff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10a10)) returned 1
	[0124.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0124.097] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\kma2qeehmp.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\KmA2QeehMp.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\kma2qeehmp.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.099] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif", lpFilePart=0x0) returned 0x2c
	[0124.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0124.099] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\mffkqcis7xi7uop9.gif"), fInfoLevelId=0x0, lpFileInformation=0x2781e94 | out: lpFileInformation=0x2781e94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8bff70, ftCreationTime.dwHighDateTime=0x1d4d0f9, ftLastAccessTime.dwLowDateTime=0x56f45510, ftLastAccessTime.dwHighDateTime=0x1d4cff4, ftLastWriteTime.dwLowDateTime=0x56f45510, ftLastWriteTime.dwHighDateTime=0x1d4cff4, nFileSizeHigh=0x0, nFileSizeLow=0x176eb)) returned 1
	[0124.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0124.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif", lpFilePart=0x0) returned 0x2c
	[0124.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0124.100] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\mffkqcis7xi7uop9.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.100] GetFileType (hFile=0x5dc) returned 0x1
	[0124.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0124.100] GetFileType (hFile=0x5dc) returned 0x1
	[0124.100] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x176eb
	[0124.100] ReadFile (in: hFile=0x5dc, lpBuffer=0x7794d00, nNumberOfBytesToRead=0x176eb, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x7794d00*, lpNumberOfBytesRead=0x55cf1fc*=0x176eb, lpOverlapped=0x0) returned 1
	[0124.109] CloseHandle (hObject=0x5dc) returned 1
	[0124.109] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0124.109] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.109] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278213c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0124.109] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.109] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.109] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0124.109] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.109] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27821f4*=0x1, dwFlags=0x0) returned 1
	[0124.109] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27821c0, dwFlags=0x0) returned 1
	[0124.111] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x77ac408*, pdwDataLen=0x55cf204*=0x176f0, dwBufLen=0x176f0 | out: pbData=0x77ac408*, pdwDataLen=0x55cf204*=0x176f0) returned 1
	[0124.111] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2782204*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2782204*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0124.111] CryptDestroyKey (hKey=0x82b300) returned 1
	[0124.111] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.111] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.226] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif", lpFilePart=0x0) returned 0x2c
	[0124.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0124.227] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\mffkqcis7xi7uop9.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.237] GetFileType (hFile=0x5dc) returned 0x1
	[0124.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0124.237] GetFileType (hFile=0x5dc) returned 0x1
	[0124.237] WriteFile (in: hFile=0x5dc, lpBuffer=0x77ac408*, nNumberOfBytesToWrite=0x176f0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x77ac408*, lpNumberOfBytesWritten=0x55cf1f0*=0x176f0, lpOverlapped=0x0) returned 1
	[0124.239] CloseHandle (hObject=0x5dc) returned 1
	[0124.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif", lpFilePart=0x0) returned 0x2c
	[0124.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0124.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0124.253] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\mffkqcis7xi7uop9.gif"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8bff70, ftCreationTime.dwHighDateTime=0x1d4d0f9, ftLastAccessTime.dwLowDateTime=0x56f45510, ftLastAccessTime.dwHighDateTime=0x1d4cff4, ftLastWriteTime.dwLowDateTime=0x84620d33, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x176f0)) returned 1
	[0124.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0124.253] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\mffkqcis7xi7uop9.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\mFFKQCIs7xI7UoP9.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\mffkqcis7xi7uop9.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.265] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4", lpFilePart=0x0) returned 0x26
	[0124.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0124.265] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\njevrlfhjt.mp4"), fInfoLevelId=0x0, lpFileInformation=0x2782598 | out: lpFileInformation=0x2782598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2110e0, ftCreationTime.dwHighDateTime=0x1d4d13f, ftLastAccessTime.dwLowDateTime=0xfc15c000, ftLastAccessTime.dwHighDateTime=0x1d4c91f, ftLastWriteTime.dwLowDateTime=0xfc15c000, ftLastWriteTime.dwHighDateTime=0x1d4c91f, nFileSizeHigh=0x0, nFileSizeLow=0x4b46)) returned 1
	[0124.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0124.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.353] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.494] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.517] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.607] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.611] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.628] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.646] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.654] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.662] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.666] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.687] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.796] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.859] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0124.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx", lpFilePart=0x0) returned 0x25
	[0124.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0124.921] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\kgrfcg.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.921] GetFileType (hFile=0x5dc) returned 0x1
	[0124.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0124.921] GetFileType (hFile=0x5dc) returned 0x1
	[0124.921] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x3949
	[0124.922] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c3d74, nNumberOfBytesToRead=0x3949, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26c3d74*, lpNumberOfBytesRead=0x55cf1fc*=0x3949, lpOverlapped=0x0) returned 1
	[0124.922] CloseHandle (hObject=0x5dc) returned 1
	[0124.923] CryptDestroyKey (hKey=0x82b480) returned 1
	[0124.923] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.923] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c775c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b440) returned 1
	[0124.923] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.923] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.923] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0124.923] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.923] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26c7814*=0x1, dwFlags=0x0) returned 1
	[0124.923] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26c77e0, dwFlags=0x0) returned 1
	[0124.923] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c7824*, pdwDataLen=0x55cf204*=0x3950, dwBufLen=0x3950 | out: pbData=0x26c7824*, pdwDataLen=0x55cf204*=0x3950) returned 1
	[0124.923] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26cb180*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26cb180*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0124.924] CryptDestroyKey (hKey=0x82b480) returned 1
	[0124.924] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.924] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx", lpFilePart=0x0) returned 0x25
	[0124.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0124.924] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\kgrfcg.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.925] GetFileType (hFile=0x5dc) returned 0x1
	[0124.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0124.926] GetFileType (hFile=0x5dc) returned 0x1
	[0124.926] WriteFile (in: hFile=0x5dc, lpBuffer=0x26c7824*, nNumberOfBytesToWrite=0x3950, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26c7824*, lpNumberOfBytesWritten=0x55cf1f0*=0x3950, lpOverlapped=0x0) returned 1
	[0124.927] CloseHandle (hObject=0x5dc) returned 1
	[0124.928] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx", lpFilePart=0x0) returned 0x25
	[0124.928] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x54
	[0124.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0124.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\kgrfcg.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd581650, ftCreationTime.dwHighDateTime=0x1d4d045, ftLastAccessTime.dwLowDateTime=0x9a89a20, ftLastAccessTime.dwHighDateTime=0x1d50b3e, ftLastWriteTime.dwLowDateTime=0x84caf55a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3950)) returned 1
	[0124.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0124.928] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\kgrfcg.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\kgrfcg.xlsx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx", lpFilePart=0x0) returned 0x30
	[0124.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0124.929] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\kxkz3cwapbmzqiyzh.pptx"), fInfoLevelId=0x0, lpFileInformation=0x26cb4bc | out: lpFileInformation=0x26cb4bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ddef90, ftCreationTime.dwHighDateTime=0x1d49d7e, ftLastAccessTime.dwLowDateTime=0xb2c6e150, ftLastAccessTime.dwHighDateTime=0x1d4f146, ftLastWriteTime.dwLowDateTime=0xb2c6e150, ftLastWriteTime.dwHighDateTime=0x1d4f146, nFileSizeHigh=0x0, nFileSizeLow=0xdd24)) returned 1
	[0124.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0124.930] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx", lpFilePart=0x0) returned 0x30
	[0124.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0124.930] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\kxkz3cwapbmzqiyzh.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.930] GetFileType (hFile=0x5dc) returned 0x1
	[0124.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0124.930] GetFileType (hFile=0x5dc) returned 0x1
	[0124.930] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xdd24
	[0124.930] ReadFile (in: hFile=0x5dc, lpBuffer=0x26cb6ec, nNumberOfBytesToRead=0xdd24, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26cb6ec*, lpNumberOfBytesRead=0x55cf1fc*=0xdd24, lpOverlapped=0x0) returned 1
	[0124.931] CloseHandle (hObject=0x5dc) returned 1
	[0124.931] CryptDestroyKey (hKey=0x82b440) returned 1
	[0124.932] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.932] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d94ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0124.932] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.932] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.932] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0124.932] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.932] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26d9564*=0x1, dwFlags=0x0) returned 1
	[0124.932] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26d9530, dwFlags=0x0) returned 1
	[0124.932] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d9574*, pdwDataLen=0x55cf204*=0xdd30, dwBufLen=0xdd30 | out: pbData=0x26d9574*, pdwDataLen=0x55cf204*=0xdd30) returned 1
	[0124.932] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e72b0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26e72b0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0124.932] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0124.932] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.932] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.932] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx", lpFilePart=0x0) returned 0x30
	[0124.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0124.932] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\kxkz3cwapbmzqiyzh.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.934] GetFileType (hFile=0x5dc) returned 0x1
	[0124.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0124.934] GetFileType (hFile=0x5dc) returned 0x1
	[0124.934] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d9574*, nNumberOfBytesToWrite=0xdd30, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26d9574*, lpNumberOfBytesWritten=0x55cf1f0*=0xdd30, lpOverlapped=0x0) returned 1
	[0124.936] CloseHandle (hObject=0x5dc) returned 1
	[0124.937] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx", lpFilePart=0x0) returned 0x30
	[0124.937] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0124.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0124.937] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\kxkz3cwapbmzqiyzh.pptx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ddef90, ftCreationTime.dwHighDateTime=0x1d49d7e, ftLastAccessTime.dwLowDateTime=0xb2c6e150, ftLastAccessTime.dwHighDateTime=0x1d4f146, ftLastWriteTime.dwLowDateTime=0x84caf55a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xdd30)) returned 1
	[0124.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0124.938] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\kxkz3cwapbmzqiyzh.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\KXkz3cwapbMzQiyzh.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\kxkz3cwapbmzqiyzh.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.939] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx", lpFilePart=0x0) returned 0x30
	[0124.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0124.940] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\medzqt1lw115rv-rt.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x26e7670 | out: lpFileInformation=0x26e7670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b33aa70, ftCreationTime.dwHighDateTime=0x1d490de, ftLastAccessTime.dwLowDateTime=0x6e072910, ftLastAccessTime.dwHighDateTime=0x1d4dca3, ftLastWriteTime.dwLowDateTime=0x6e072910, ftLastWriteTime.dwHighDateTime=0x1d4dca3, nFileSizeHigh=0x0, nFileSizeLow=0x10510)) returned 1
	[0124.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0124.941] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx", lpFilePart=0x0) returned 0x30
	[0124.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0124.941] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\medzqt1lw115rv-rt.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.941] GetFileType (hFile=0x5dc) returned 0x1
	[0124.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0124.941] GetFileType (hFile=0x5dc) returned 0x1
	[0124.941] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x10510
	[0124.941] ReadFile (in: hFile=0x5dc, lpBuffer=0x26e78a0, nNumberOfBytesToRead=0x10510, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26e78a0*, lpNumberOfBytesRead=0x55cf1fc*=0x10510, lpOverlapped=0x0) returned 1
	[0124.942] CloseHandle (hObject=0x5dc) returned 1
	[0124.942] CryptDestroyKey (hKey=0x82b400) returned 1
	[0124.942] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.942] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f7e4c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b100) returned 1
	[0124.942] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.942] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.943] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0124.943] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.943] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26f7f04*=0x1, dwFlags=0x0) returned 1
	[0124.943] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x26f7ed0, dwFlags=0x0) returned 1
	[0124.943] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f7f14*, pdwDataLen=0x55cf204*=0x10520, dwBufLen=0x10520 | out: pbData=0x26f7f14*, pdwDataLen=0x55cf204*=0x10520) returned 1
	[0124.943] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2708440*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2708440*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0124.943] CryptDestroyKey (hKey=0x82b380) returned 1
	[0124.943] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.943] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx", lpFilePart=0x0) returned 0x30
	[0124.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0124.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\medzqt1lw115rv-rt.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.945] GetFileType (hFile=0x5dc) returned 0x1
	[0124.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0124.945] GetFileType (hFile=0x5dc) returned 0x1
	[0124.945] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f7f14*, nNumberOfBytesToWrite=0x10520, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26f7f14*, lpNumberOfBytesWritten=0x55cf1f0*=0x10520, lpOverlapped=0x0) returned 1
	[0124.947] CloseHandle (hObject=0x5dc) returned 1
	[0124.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx", lpFilePart=0x0) returned 0x30
	[0124.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0124.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0124.947] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\medzqt1lw115rv-rt.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b33aa70, ftCreationTime.dwHighDateTime=0x1d490de, ftLastAccessTime.dwLowDateTime=0x6e072910, ftLastAccessTime.dwHighDateTime=0x1d4dca3, ftLastWriteTime.dwLowDateTime=0x84cd588a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10520)) returned 1
	[0124.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0124.947] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\medzqt1lw115rv-rt.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\meDZqT1lw115RV-Rt.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\medzqt1lw115rv-rt.xlsx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.948] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx", lpFilePart=0x0) returned 0x2a
	[0124.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0124.948] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx" (normalized: "c:\\users\\fd1hvy\\documents\\slbaii0glct.docx"), fInfoLevelId=0x0, lpFileInformation=0x2708800 | out: lpFileInformation=0x2708800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fa7eca0, ftCreationTime.dwHighDateTime=0x1d506da, ftLastAccessTime.dwLowDateTime=0x263f1480, ftLastAccessTime.dwHighDateTime=0x1d4ce2f, ftLastWriteTime.dwLowDateTime=0x263f1480, ftLastWriteTime.dwHighDateTime=0x1d4ce2f, nFileSizeHigh=0x0, nFileSizeLow=0x10158)) returned 1
	[0124.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0124.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx", lpFilePart=0x0) returned 0x2a
	[0124.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0124.949] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx" (normalized: "c:\\users\\fd1hvy\\documents\\slbaii0glct.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.949] GetFileType (hFile=0x5dc) returned 0x1
	[0124.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0124.949] GetFileType (hFile=0x5dc) returned 0x1
	[0124.949] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x10158
	[0124.949] ReadFile (in: hFile=0x5dc, lpBuffer=0x2708a00, nNumberOfBytesToRead=0x10158, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2708a00*, lpNumberOfBytesRead=0x55cf1fc*=0x10158, lpOverlapped=0x0) returned 1
	[0124.950] CloseHandle (hObject=0x5dc) returned 1
	[0124.950] CryptDestroyKey (hKey=0x82b100) returned 1
	[0124.950] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.950] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2718bf4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0124.950] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.950] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.951] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0124.951] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.951] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2718cac*=0x1, dwFlags=0x0) returned 1
	[0124.951] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2718c78, dwFlags=0x0) returned 1
	[0124.951] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2718cbc*, pdwDataLen=0x55cf204*=0x10160, dwBufLen=0x10160 | out: pbData=0x2718cbc*, pdwDataLen=0x55cf204*=0x10160) returned 1
	[0124.951] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2728e28*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2728e28*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0124.951] CryptDestroyKey (hKey=0x82b000) returned 1
	[0124.951] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.951] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.951] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx", lpFilePart=0x0) returned 0x2a
	[0124.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0124.951] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx" (normalized: "c:\\users\\fd1hvy\\documents\\slbaii0glct.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.953] GetFileType (hFile=0x5dc) returned 0x1
	[0124.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0124.953] GetFileType (hFile=0x5dc) returned 0x1
	[0124.953] WriteFile (in: hFile=0x5dc, lpBuffer=0x2718cbc*, nNumberOfBytesToWrite=0x10160, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2718cbc*, lpNumberOfBytesWritten=0x55cf1f0*=0x10160, lpOverlapped=0x0) returned 1
	[0124.955] CloseHandle (hObject=0x5dc) returned 1
	[0124.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx", lpFilePart=0x0) returned 0x2a
	[0124.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0124.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0124.956] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx" (normalized: "c:\\users\\fd1hvy\\documents\\slbaii0glct.docx"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fa7eca0, ftCreationTime.dwHighDateTime=0x1d506da, ftLastAccessTime.dwLowDateTime=0x263f1480, ftLastAccessTime.dwHighDateTime=0x1d4ce2f, ftLastWriteTime.dwLowDateTime=0x84cfbace, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10160)) returned 1
	[0124.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0124.956] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx" (normalized: "c:\\users\\fd1hvy\\documents\\slbaii0glct.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SlbAII0GlcT.docx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\slbaii0glct.docx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx", lpFilePart=0x0) returned 0x2c
	[0124.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0124.957] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\uld9-9kj pjf2.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x27291a0 | out: lpFileInformation=0x27291a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c692970, ftCreationTime.dwHighDateTime=0x1d50401, ftLastAccessTime.dwLowDateTime=0x3d1555a0, ftLastAccessTime.dwHighDateTime=0x1d4fdc5, ftLastWriteTime.dwLowDateTime=0x3d1555a0, ftLastWriteTime.dwHighDateTime=0x1d4fdc5, nFileSizeHigh=0x0, nFileSizeLow=0x10932)) returned 1
	[0124.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.314] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png", lpFilePart=0x0) returned 0x2b
	[0125.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.314] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png" (normalized: "c:\\users\\fd1hvy\\pictures\\kggvr-zfra9y39.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.314] GetFileType (hFile=0x5dc) returned 0x1
	[0125.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.314] GetFileType (hFile=0x5dc) returned 0x1
	[0125.314] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x164ad
	[0125.315] ReadFile (in: hFile=0x5dc, lpBuffer=0x797dbd0, nNumberOfBytesToRead=0x164ad, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x797dbd0*, lpNumberOfBytesRead=0x55cf1fc*=0x164ad, lpOverlapped=0x0) returned 1
	[0125.317] CloseHandle (hObject=0x5dc) returned 1
	[0125.317] CryptDestroyKey (hKey=0x82b340) returned 1
	[0125.317] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.317] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26df300, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0125.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.317] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0125.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.317] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26df3b8*=0x1, dwFlags=0x0) returned 1
	[0125.317] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26df384, dwFlags=0x0) returned 1
	[0125.319] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x79940a0*, pdwDataLen=0x55cf204*=0x164b0, dwBufLen=0x164b0 | out: pbData=0x79940a0*, pdwDataLen=0x55cf204*=0x164b0) returned 1
	[0125.319] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26df3c8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26df3c8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.319] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0125.319] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.319] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png", lpFilePart=0x0) returned 0x2b
	[0125.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png" (normalized: "c:\\users\\fd1hvy\\pictures\\kggvr-zfra9y39.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.321] GetFileType (hFile=0x5dc) returned 0x1
	[0125.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.321] GetFileType (hFile=0x5dc) returned 0x1
	[0125.321] WriteFile (in: hFile=0x5dc, lpBuffer=0x79940a0*, nNumberOfBytesToWrite=0x164b0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x79940a0*, lpNumberOfBytesWritten=0x55cf1f0*=0x164b0, lpOverlapped=0x0) returned 1
	[0125.323] CloseHandle (hObject=0x5dc) returned 1
	[0125.323] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png", lpFilePart=0x0) returned 0x2b
	[0125.324] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5a
	[0125.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png" (normalized: "c:\\users\\fd1hvy\\pictures\\kggvr-zfra9y39.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d74ea0, ftCreationTime.dwHighDateTime=0x1d4cdd7, ftLastAccessTime.dwLowDateTime=0xe21447f0, ftLastAccessTime.dwHighDateTime=0x1d4ce81, ftLastWriteTime.dwLowDateTime=0x85069123, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x164b0)) returned 1
	[0125.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.325] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png" (normalized: "c:\\users\\fd1hvy\\pictures\\kggvr-zfra9y39.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\kggvr-zfra9y39.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.326] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png", lpFilePart=0x0) returned 0x2c
	[0125.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.326] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\krshyfilgybtdze.png"), fInfoLevelId=0x0, lpFileInformation=0x26df750 | out: lpFileInformation=0x26df750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4acdd0, ftCreationTime.dwHighDateTime=0x1d4c7a5, ftLastAccessTime.dwLowDateTime=0xcc7e8910, ftLastAccessTime.dwHighDateTime=0x1d4cc7d, ftLastWriteTime.dwLowDateTime=0xcc7e8910, ftLastWriteTime.dwHighDateTime=0x1d4cc7d, nFileSizeHigh=0x0, nFileSizeLow=0x401b)) returned 1
	[0125.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.326] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png", lpFilePart=0x0) returned 0x2c
	[0125.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.326] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\krshyfilgybtdze.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.326] GetFileType (hFile=0x5dc) returned 0x1
	[0125.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.326] GetFileType (hFile=0x5dc) returned 0x1
	[0125.326] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x401b
	[0125.327] ReadFile (in: hFile=0x5dc, lpBuffer=0x26df960, nNumberOfBytesToRead=0x401b, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26df960*, lpNumberOfBytesRead=0x55cf1fc*=0x401b, lpOverlapped=0x0) returned 1
	[0125.328] CloseHandle (hObject=0x5dc) returned 1
	[0125.328] CryptDestroyKey (hKey=0x82b300) returned 1
	[0125.328] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.328] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e3a18, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0125.328] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.328] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.328] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0125.328] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.328] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26e3ad0*=0x1, dwFlags=0x0) returned 1
	[0125.328] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26e3a9c, dwFlags=0x0) returned 1
	[0125.328] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e3ae0*, pdwDataLen=0x55cf204*=0x4020, dwBufLen=0x4020 | out: pbData=0x26e3ae0*, pdwDataLen=0x55cf204*=0x4020) returned 1
	[0125.328] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e7b0c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26e7b0c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.328] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.328] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.329] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.329] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png", lpFilePart=0x0) returned 0x2c
	[0125.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.329] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\krshyfilgybtdze.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.330] GetFileType (hFile=0x5dc) returned 0x1
	[0125.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.330] GetFileType (hFile=0x5dc) returned 0x1
	[0125.330] WriteFile (in: hFile=0x5dc, lpBuffer=0x26e3ae0*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26e3ae0*, lpNumberOfBytesWritten=0x55cf1f0*=0x4020, lpOverlapped=0x0) returned 1
	[0125.331] CloseHandle (hObject=0x5dc) returned 1
	[0125.332] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png", lpFilePart=0x0) returned 0x2c
	[0125.332] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0125.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.332] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\krshyfilgybtdze.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4acdd0, ftCreationTime.dwHighDateTime=0x1d4c7a5, ftLastAccessTime.dwLowDateTime=0xcc7e8910, ftLastAccessTime.dwHighDateTime=0x1d4cc7d, ftLastWriteTime.dwLowDateTime=0x8508f35f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4020)) returned 1
	[0125.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.332] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\krshyfilgybtdze.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\KrShyFIlgyBtDZE.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\krshyfilgybtdze.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.333] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg", lpFilePart=0x0) returned 0x31
	[0125.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.333] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\lruwascqtt_zef951g6l.jpg"), fInfoLevelId=0x0, lpFileInformation=0x26e7e9c | out: lpFileInformation=0x26e7e9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2982d2b0, ftCreationTime.dwHighDateTime=0x1d4ca9e, ftLastAccessTime.dwLowDateTime=0x16bd9930, ftLastAccessTime.dwHighDateTime=0x1d4ca6c, ftLastWriteTime.dwLowDateTime=0x16bd9930, ftLastWriteTime.dwHighDateTime=0x1d4ca6c, nFileSizeHigh=0x0, nFileSizeLow=0x108b4)) returned 1
	[0125.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.333] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg", lpFilePart=0x0) returned 0x31
	[0125.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.333] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\lruwascqtt_zef951g6l.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.333] GetFileType (hFile=0x5dc) returned 0x1
	[0125.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.333] GetFileType (hFile=0x5dc) returned 0x1
	[0125.333] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x108b4
	[0125.334] ReadFile (in: hFile=0x5dc, lpBuffer=0x26e80d4, nNumberOfBytesToRead=0x108b4, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26e80d4*, lpNumberOfBytesRead=0x55cf1fc*=0x108b4, lpOverlapped=0x0) returned 1
	[0125.335] CloseHandle (hObject=0x5dc) returned 1
	[0125.335] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0125.335] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.335] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f8a24, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0125.335] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.335] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.335] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0125.335] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.335] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26f8adc*=0x1, dwFlags=0x0) returned 1
	[0125.335] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26f8aa8, dwFlags=0x0) returned 1
	[0125.335] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f8aec*, pdwDataLen=0x55cf204*=0x108c0, dwBufLen=0x108c0 | out: pbData=0x26f8aec*, pdwDataLen=0x55cf204*=0x108c0) returned 1
	[0125.335] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27093b8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27093b8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.335] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0125.335] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.335] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.335] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg", lpFilePart=0x0) returned 0x31
	[0125.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.336] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\lruwascqtt_zef951g6l.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.337] GetFileType (hFile=0x5dc) returned 0x1
	[0125.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.337] GetFileType (hFile=0x5dc) returned 0x1
	[0125.337] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f8aec*, nNumberOfBytesToWrite=0x108c0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26f8aec*, lpNumberOfBytesWritten=0x55cf1f0*=0x108c0, lpOverlapped=0x0) returned 1
	[0125.339] CloseHandle (hObject=0x5dc) returned 1
	[0125.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg", lpFilePart=0x0) returned 0x31
	[0125.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x60
	[0125.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.340] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\lruwascqtt_zef951g6l.jpg"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2982d2b0, ftCreationTime.dwHighDateTime=0x1d4ca9e, ftLastAccessTime.dwLowDateTime=0x16bd9930, ftLastAccessTime.dwHighDateTime=0x1d4ca6c, ftLastWriteTime.dwLowDateTime=0x8508f35f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x108c0)) returned 1
	[0125.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.340] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\lruwascqtt_zef951g6l.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\LRuwaScqtt_ZeF951g6L.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\lruwascqtt_zef951g6l.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif", lpFilePart=0x0) returned 0x2f
	[0125.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.341] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\m8_xkm9cvc34p8cxhm.gif"), fInfoLevelId=0x0, lpFileInformation=0x2709788 | out: lpFileInformation=0x2709788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf370970, ftCreationTime.dwHighDateTime=0x1d4c7ae, ftLastAccessTime.dwLowDateTime=0x4bf31d60, ftLastAccessTime.dwHighDateTime=0x1d4ca52, ftLastWriteTime.dwLowDateTime=0x4bf31d60, ftLastWriteTime.dwHighDateTime=0x1d4ca52, nFileSizeHigh=0x0, nFileSizeLow=0x20a4)) returned 1
	[0125.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif", lpFilePart=0x0) returned 0x2f
	[0125.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.341] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\m8_xkm9cvc34p8cxhm.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.341] GetFileType (hFile=0x5dc) returned 0x1
	[0125.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.341] GetFileType (hFile=0x5dc) returned 0x1
	[0125.341] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x20a4
	[0125.341] ReadFile (in: hFile=0x5dc, lpBuffer=0x27099b0, nNumberOfBytesToRead=0x20a4, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27099b0*, lpNumberOfBytesRead=0x55cf1fc*=0x20a4, lpOverlapped=0x0) returned 1
	[0125.342] CloseHandle (hObject=0x5dc) returned 1
	[0125.343] CryptDestroyKey (hKey=0x82b280) returned 1
	[0125.343] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.343] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270baf0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0125.343] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.343] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.343] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0125.343] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.343] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x270bba8*=0x1, dwFlags=0x0) returned 1
	[0125.343] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x270bb74, dwFlags=0x0) returned 1
	[0125.343] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270bbb8*, pdwDataLen=0x55cf204*=0x20b0, dwBufLen=0x20b0 | out: pbData=0x270bbb8*, pdwDataLen=0x55cf204*=0x20b0) returned 1
	[0125.343] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270dc74*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x270dc74*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.343] CryptDestroyKey (hKey=0x82b080) returned 1
	[0125.343] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.343] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif", lpFilePart=0x0) returned 0x2f
	[0125.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.343] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\m8_xkm9cvc34p8cxhm.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.345] GetFileType (hFile=0x5dc) returned 0x1
	[0125.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.345] GetFileType (hFile=0x5dc) returned 0x1
	[0125.345] WriteFile (in: hFile=0x5dc, lpBuffer=0x270bbb8*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x270bbb8*, lpNumberOfBytesWritten=0x55cf1f0*=0x20b0, lpOverlapped=0x0) returned 1
	[0125.346] CloseHandle (hObject=0x5dc) returned 1
	[0125.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif", lpFilePart=0x0) returned 0x2f
	[0125.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0125.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.346] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\m8_xkm9cvc34p8cxhm.gif"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf370970, ftCreationTime.dwHighDateTime=0x1d4c7ae, ftLastAccessTime.dwLowDateTime=0x4bf31d60, ftLastAccessTime.dwHighDateTime=0x1d4ca52, ftLastWriteTime.dwLowDateTime=0x850b574c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x20b0)) returned 1
	[0125.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.346] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\m8_xkm9cvc34p8cxhm.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\M8_xKM9Cvc34P8CxhM.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\m8_xkm9cvc34p8cxhm.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.347] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif", lpFilePart=0x0) returned 0x27
	[0125.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.347] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\mhpwtamfyl.gif"), fInfoLevelId=0x0, lpFileInformation=0x270e02c | out: lpFileInformation=0x270e02c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5acd0e0, ftCreationTime.dwHighDateTime=0x1d4c952, ftLastAccessTime.dwLowDateTime=0x611494a0, ftLastAccessTime.dwHighDateTime=0x1d4c78a, ftLastWriteTime.dwLowDateTime=0x611494a0, ftLastWriteTime.dwHighDateTime=0x1d4c78a, nFileSizeHigh=0x0, nFileSizeLow=0x7d68)) returned 1
	[0125.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif", lpFilePart=0x0) returned 0x27
	[0125.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.348] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\mhpwtamfyl.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.348] GetFileType (hFile=0x5dc) returned 0x1
	[0125.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.348] GetFileType (hFile=0x5dc) returned 0x1
	[0125.348] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x7d68
	[0125.348] ReadFile (in: hFile=0x5dc, lpBuffer=0x270e214, nNumberOfBytesToRead=0x7d68, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x270e214*, lpNumberOfBytesRead=0x55cf1fc*=0x7d68, lpOverlapped=0x0) returned 1
	[0125.349] CloseHandle (hObject=0x5dc) returned 1
	[0125.349] CryptDestroyKey (hKey=0x82b540) returned 1
	[0125.349] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.350] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2716018, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0125.350] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.350] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.350] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b200) returned 1
	[0125.350] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.350] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x27160d0*=0x1, dwFlags=0x0) returned 1
	[0125.350] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x271609c, dwFlags=0x0) returned 1
	[0125.350] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27160e0*, pdwDataLen=0x55cf204*=0x7d70, dwBufLen=0x7d70 | out: pbData=0x27160e0*, pdwDataLen=0x55cf204*=0x7d70) returned 1
	[0125.350] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271de5c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x271de5c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.350] CryptDestroyKey (hKey=0x82b200) returned 1
	[0125.350] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.350] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.350] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif", lpFilePart=0x0) returned 0x27
	[0125.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\mhpwtamfyl.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.352] GetFileType (hFile=0x5dc) returned 0x1
	[0125.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.352] GetFileType (hFile=0x5dc) returned 0x1
	[0125.352] WriteFile (in: hFile=0x5dc, lpBuffer=0x27160e0*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27160e0*, lpNumberOfBytesWritten=0x55cf1f0*=0x7d70, lpOverlapped=0x0) returned 1
	[0125.353] CloseHandle (hObject=0x5dc) returned 1
	[0125.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif", lpFilePart=0x0) returned 0x27
	[0125.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0125.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.353] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\mhpwtamfyl.gif"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5acd0e0, ftCreationTime.dwHighDateTime=0x1d4c952, ftLastAccessTime.dwLowDateTime=0x611494a0, ftLastAccessTime.dwHighDateTime=0x1d4c78a, ftLastWriteTime.dwLowDateTime=0x850b574c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7d70)) returned 1
	[0125.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.354] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\mhpwtamfyl.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\mhpWTamFyl.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\mhpwtamfyl.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.354] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp", lpFilePart=0x0) returned 0x2d
	[0125.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.355] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ntzbinu6vqnqrauq.bmp"), fInfoLevelId=0x0, lpFileInformation=0x271e1b4 | out: lpFileInformation=0x271e1b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd9e910, ftCreationTime.dwHighDateTime=0x1d4cd60, ftLastAccessTime.dwLowDateTime=0xade6ccb0, ftLastAccessTime.dwHighDateTime=0x1d4c8ef, ftLastWriteTime.dwLowDateTime=0xade6ccb0, ftLastWriteTime.dwHighDateTime=0x1d4c8ef, nFileSizeHigh=0x0, nFileSizeLow=0xfe8a)) returned 1
	[0125.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp", lpFilePart=0x0) returned 0x2d
	[0125.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.355] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ntzbinu6vqnqrauq.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.355] GetFileType (hFile=0x5dc) returned 0x1
	[0125.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.356] GetFileType (hFile=0x5dc) returned 0x1
	[0125.356] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xfe8a
	[0125.356] ReadFile (in: hFile=0x5dc, lpBuffer=0x271e3cc, nNumberOfBytesToRead=0xfe8a, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x271e3cc*, lpNumberOfBytesRead=0x55cf1fc*=0xfe8a, lpOverlapped=0x0) returned 1
	[0125.357] CloseHandle (hObject=0x5dc) returned 1
	[0125.357] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0125.357] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.357] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272e2f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0125.357] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.357] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.357] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0125.357] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.357] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x272e3ac*=0x1, dwFlags=0x0) returned 1
	[0125.357] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x272e378, dwFlags=0x0) returned 1
	[0125.357] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272e3bc*, pdwDataLen=0x55cf204*=0xfe90, dwBufLen=0xfe90 | out: pbData=0x272e3bc*, pdwDataLen=0x55cf204*=0xfe90) returned 1
	[0125.357] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273e258*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x273e258*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.357] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0125.357] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.358] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.358] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp", lpFilePart=0x0) returned 0x2d
	[0125.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.358] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ntzbinu6vqnqrauq.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.368] GetFileType (hFile=0x5dc) returned 0x1
	[0125.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.368] GetFileType (hFile=0x5dc) returned 0x1
	[0125.368] WriteFile (in: hFile=0x5dc, lpBuffer=0x272e3bc*, nNumberOfBytesToWrite=0xfe90, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x272e3bc*, lpNumberOfBytesWritten=0x55cf1f0*=0xfe90, lpOverlapped=0x0) returned 1
	[0125.370] CloseHandle (hObject=0x5dc) returned 1
	[0125.370] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp", lpFilePart=0x0) returned 0x2d
	[0125.370] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0125.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.370] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ntzbinu6vqnqrauq.bmp"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd9e910, ftCreationTime.dwHighDateTime=0x1d4cd60, ftLastAccessTime.dwLowDateTime=0xade6ccb0, ftLastAccessTime.dwHighDateTime=0x1d4c8ef, ftLastWriteTime.dwLowDateTime=0x850db7d3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xfe90)) returned 1
	[0125.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.370] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ntzbinu6vqnqrauq.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ntZbINu6VQNQRAUq.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\ntzbinu6vqnqrauq.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif", lpFilePart=0x0) returned 0x2e
	[0125.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.371] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\oti h5ubvp4xzwe2u.gif"), fInfoLevelId=0x0, lpFileInformation=0x273e5f8 | out: lpFileInformation=0x273e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c517170, ftCreationTime.dwHighDateTime=0x1d4ce94, ftLastAccessTime.dwLowDateTime=0x5ef5f7c0, ftLastAccessTime.dwHighDateTime=0x1d4d42a, ftLastWriteTime.dwLowDateTime=0x5ef5f7c0, ftLastWriteTime.dwHighDateTime=0x1d4d42a, nFileSizeHigh=0x0, nFileSizeLow=0x1820)) returned 1
	[0125.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif", lpFilePart=0x0) returned 0x2e
	[0125.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.371] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\oti h5ubvp4xzwe2u.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.372] GetFileType (hFile=0x5dc) returned 0x1
	[0125.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.372] GetFileType (hFile=0x5dc) returned 0x1
	[0125.372] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1820
	[0125.372] ReadFile (in: hFile=0x5dc, lpBuffer=0x273e818, nNumberOfBytesToRead=0x1820, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x273e818*, lpNumberOfBytesRead=0x55cf1fc*=0x1820, lpOverlapped=0x0) returned 1
	[0125.372] CloseHandle (hObject=0x5dc) returned 1
	[0125.373] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.373] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.373] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27400d4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0125.373] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.373] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.373] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0125.373] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.373] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x274018c*=0x1, dwFlags=0x0) returned 1
	[0125.373] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2740158, dwFlags=0x0) returned 1
	[0125.373] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274019c*, pdwDataLen=0x55cf204*=0x1830, dwBufLen=0x1830 | out: pbData=0x274019c*, pdwDataLen=0x55cf204*=0x1830) returned 1
	[0125.373] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27419d8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27419d8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.373] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0125.373] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.373] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.373] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif", lpFilePart=0x0) returned 0x2e
	[0125.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.373] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\oti h5ubvp4xzwe2u.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.374] GetFileType (hFile=0x5dc) returned 0x1
	[0125.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.375] GetFileType (hFile=0x5dc) returned 0x1
	[0125.375] WriteFile (in: hFile=0x5dc, lpBuffer=0x274019c*, nNumberOfBytesToWrite=0x1830, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x274019c*, lpNumberOfBytesWritten=0x55cf1f0*=0x1830, lpOverlapped=0x0) returned 1
	[0125.376] CloseHandle (hObject=0x5dc) returned 1
	[0125.376] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif", lpFilePart=0x0) returned 0x2e
	[0125.376] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0125.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.376] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\oti h5ubvp4xzwe2u.gif"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c517170, ftCreationTime.dwHighDateTime=0x1d4ce94, ftLastAccessTime.dwLowDateTime=0x5ef5f7c0, ftLastAccessTime.dwHighDateTime=0x1d4d42a, ftLastWriteTime.dwLowDateTime=0x85101a9f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1830)) returned 1
	[0125.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.376] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\oti h5ubvp4xzwe2u.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\oTI H5UbvP4xzwE2u.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\oti h5ubvp4xzwe2u.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.377] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp", lpFilePart=0x0) returned 0x2c
	[0125.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.377] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\otqyoxfe34cnlml.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2741d80 | out: lpFileInformation=0x2741d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd17a0, ftCreationTime.dwHighDateTime=0x1d4d583, ftLastAccessTime.dwLowDateTime=0x8e218e20, ftLastAccessTime.dwHighDateTime=0x1d4c664, ftLastWriteTime.dwLowDateTime=0x8e218e20, ftLastWriteTime.dwHighDateTime=0x1d4c664, nFileSizeHigh=0x0, nFileSizeLow=0xc447)) returned 1
	[0125.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.377] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp", lpFilePart=0x0) returned 0x2c
	[0125.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.377] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\otqyoxfe34cnlml.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.377] GetFileType (hFile=0x5dc) returned 0x1
	[0125.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.378] GetFileType (hFile=0x5dc) returned 0x1
	[0125.378] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xc447
	[0125.378] ReadFile (in: hFile=0x5dc, lpBuffer=0x2741f90, nNumberOfBytesToRead=0xc447, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2741f90*, lpNumberOfBytesRead=0x55cf1fc*=0xc447, lpOverlapped=0x0) returned 1
	[0125.379] CloseHandle (hObject=0x5dc) returned 1
	[0125.379] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.379] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.379] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274e474, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0125.379] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.379] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.379] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0125.379] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.379] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x274e52c*=0x1, dwFlags=0x0) returned 1
	[0125.379] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x274e4f8, dwFlags=0x0) returned 1
	[0125.379] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274e53c*, pdwDataLen=0x55cf204*=0xc450, dwBufLen=0xc450 | out: pbData=0x274e53c*, pdwDataLen=0x55cf204*=0xc450) returned 1
	[0125.379] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275a998*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x275a998*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.379] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0125.380] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.380] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp", lpFilePart=0x0) returned 0x2c
	[0125.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.380] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\otqyoxfe34cnlml.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.382] GetFileType (hFile=0x5dc) returned 0x1
	[0125.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.382] GetFileType (hFile=0x5dc) returned 0x1
	[0125.382] WriteFile (in: hFile=0x5dc, lpBuffer=0x274e53c*, nNumberOfBytesToWrite=0xc450, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x274e53c*, lpNumberOfBytesWritten=0x55cf1f0*=0xc450, lpOverlapped=0x0) returned 1
	[0125.384] CloseHandle (hObject=0x5dc) returned 1
	[0125.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp", lpFilePart=0x0) returned 0x2c
	[0125.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0125.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\otqyoxfe34cnlml.bmp"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd17a0, ftCreationTime.dwHighDateTime=0x1d4d583, ftLastAccessTime.dwLowDateTime=0x8e218e20, ftLastAccessTime.dwHighDateTime=0x1d4c664, ftLastWriteTime.dwLowDateTime=0x85101a9f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xc450)) returned 1
	[0125.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.384] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\otqyoxfe34cnlml.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\OtqYOXFE34cNlmL.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\otqyoxfe34cnlml.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.385] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\q4J6.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\q4J6.png", lpFilePart=0x0) returned 0x21
	[0125.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.385] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\q4J6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\q4j6.png"), fInfoLevelId=0x0, lpFileInformation=0x275ad28 | out: lpFileInformation=0x275ad28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310e8b20, ftCreationTime.dwHighDateTime=0x1d4c8cb, ftLastAccessTime.dwLowDateTime=0xf9517aa0, ftLastAccessTime.dwHighDateTime=0x1d4d309, ftLastWriteTime.dwLowDateTime=0xf9517aa0, ftLastWriteTime.dwHighDateTime=0x1d4d309, nFileSizeHigh=0x0, nFileSizeLow=0x6cc8)) returned 1
	[0125.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.385] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\q4J6.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\q4J6.png", lpFilePart=0x0) returned 0x21
	[0125.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.386] ReadFile (in: hFile=0x5dc, lpBuffer=0x275aee0, nNumberOfBytesToRead=0x6cc8, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x275aee0*, lpNumberOfBytesRead=0x55cf1fc*=0x6cc8, lpOverlapped=0x0) returned 1
	[0125.387] CryptDestroyKey (hKey=0x82b280) returned 1
	[0125.387] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.387] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2761c44, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0125.387] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.387] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.387] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0125.387] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.387] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2761cfc*=0x1, dwFlags=0x0) returned 1
	[0125.387] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2761cc8, dwFlags=0x0) returned 1
	[0125.387] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2761d0c*, pdwDataLen=0x55cf204*=0x6cd0, dwBufLen=0x6cd0 | out: pbData=0x2761d0c*, pdwDataLen=0x55cf204*=0x6cd0) returned 1
	[0125.387] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27689e8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27689e8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.387] CryptDestroyKey (hKey=0x82b280) returned 1
	[0125.387] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.387] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\q4J6.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\q4J6.png", lpFilePart=0x0) returned 0x21
	[0125.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.387] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\q4J6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\q4j6.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.389] GetFileType (hFile=0x5dc) returned 0x1
	[0125.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.389] GetFileType (hFile=0x5dc) returned 0x1
	[0125.389] WriteFile (in: hFile=0x5dc, lpBuffer=0x2761d0c*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2761d0c*, lpNumberOfBytesWritten=0x55cf1f0*=0x6cd0, lpOverlapped=0x0) returned 1
	[0125.391] CloseHandle (hObject=0x5dc) returned 1
	[0125.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\q4J6.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\q4J6.png", lpFilePart=0x0) returned 0x21
	[0125.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\q4J6.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\q4J6.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x50
	[0125.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\q4J6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\q4j6.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310e8b20, ftCreationTime.dwHighDateTime=0x1d4c8cb, ftLastAccessTime.dwLowDateTime=0xf9517aa0, ftLastAccessTime.dwHighDateTime=0x1d4d309, ftLastWriteTime.dwLowDateTime=0x85127c92, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x6cd0)) returned 1
	[0125.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.392] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\q4J6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\q4j6.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\q4J6.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\q4j6.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif", lpFilePart=0x0) returned 0x30
	[0125.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.392] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\qqnotkq9ij4jqtpr9bs.gif"), fInfoLevelId=0x0, lpFileInformation=0x2768cf8 | out: lpFileInformation=0x2768cf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ad1e70, ftCreationTime.dwHighDateTime=0x1d4c6b8, ftLastAccessTime.dwLowDateTime=0x7a5b3850, ftLastAccessTime.dwHighDateTime=0x1d4cb14, ftLastWriteTime.dwLowDateTime=0x7a5b3850, ftLastWriteTime.dwHighDateTime=0x1d4cb14, nFileSizeHigh=0x0, nFileSizeLow=0x12bef)) returned 1
	[0125.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif", lpFilePart=0x0) returned 0x30
	[0125.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.393] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\qqnotkq9ij4jqtpr9bs.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.393] GetFileType (hFile=0x5dc) returned 0x1
	[0125.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.393] GetFileType (hFile=0x5dc) returned 0x1
	[0125.393] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x12bef
	[0125.393] ReadFile (in: hFile=0x5dc, lpBuffer=0x2768f28, nNumberOfBytesToRead=0x12bef, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2768f28*, lpNumberOfBytesRead=0x55cf1fc*=0x12bef, lpOverlapped=0x0) returned 1
	[0125.394] CloseHandle (hObject=0x5dc) returned 1
	[0125.394] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0125.394] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.394] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277bbb4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b480) returned 1
	[0125.394] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.395] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.395] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b440) returned 1
	[0125.395] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.395] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x277bc6c*=0x1, dwFlags=0x0) returned 1
	[0125.395] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x277bc38, dwFlags=0x0) returned 1
	[0125.395] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277bc7c*, pdwDataLen=0x55cf204*=0x12bf0, dwBufLen=0x12bf0 | out: pbData=0x277bc7c*, pdwDataLen=0x55cf204*=0x12bf0) returned 1
	[0125.395] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278e878*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x278e878*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.395] CryptDestroyKey (hKey=0x82b440) returned 1
	[0125.395] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.395] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.395] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif", lpFilePart=0x0) returned 0x30
	[0125.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.395] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\qqnotkq9ij4jqtpr9bs.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.397] GetFileType (hFile=0x5dc) returned 0x1
	[0125.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.397] GetFileType (hFile=0x5dc) returned 0x1
	[0125.397] WriteFile (in: hFile=0x5dc, lpBuffer=0x277bc7c*, nNumberOfBytesToWrite=0x12bf0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x277bc7c*, lpNumberOfBytesWritten=0x55cf1f0*=0x12bf0, lpOverlapped=0x0) returned 1
	[0125.399] CloseHandle (hObject=0x5dc) returned 1
	[0125.399] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif", lpFilePart=0x0) returned 0x30
	[0125.399] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0125.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.399] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\qqnotkq9ij4jqtpr9bs.gif"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ad1e70, ftCreationTime.dwHighDateTime=0x1d4c6b8, ftLastAccessTime.dwLowDateTime=0x7a5b3850, ftLastAccessTime.dwHighDateTime=0x1d4cb14, ftLastWriteTime.dwLowDateTime=0x85127c92, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x12bf0)) returned 1
	[0125.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.400] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\qqnotkq9ij4jqtpr9bs.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\QQnoTkQ9iJ4jqTpr9Bs.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\qqnotkq9ij4jqtpr9bs.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.400] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp", lpFilePart=0x0) returned 0x26
	[0125.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sz_pp5vqm.bmp"), fInfoLevelId=0x0, lpFileInformation=0x278ec38 | out: lpFileInformation=0x278ec38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0319a30, ftCreationTime.dwHighDateTime=0x1d4c844, ftLastAccessTime.dwLowDateTime=0x1b854790, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0x1b854790, ftLastWriteTime.dwHighDateTime=0x1d4cc26, nFileSizeHigh=0x0, nFileSizeLow=0xbca4)) returned 1
	[0125.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.401] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp", lpFilePart=0x0) returned 0x26
	[0125.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.401] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sz_pp5vqm.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.401] GetFileType (hFile=0x5dc) returned 0x1
	[0125.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.401] GetFileType (hFile=0x5dc) returned 0x1
	[0125.401] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xbca4
	[0125.401] ReadFile (in: hFile=0x5dc, lpBuffer=0x278ee18, nNumberOfBytesToRead=0xbca4, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x278ee18*, lpNumberOfBytesRead=0x55cf1fc*=0xbca4, lpOverlapped=0x0) returned 1
	[0125.402] CloseHandle (hObject=0x5dc) returned 1
	[0125.402] CryptDestroyKey (hKey=0x82b480) returned 1
	[0125.402] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.402] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279ab58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0125.403] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.403] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.403] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0125.403] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.403] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x279ac10*=0x1, dwFlags=0x0) returned 1
	[0125.403] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x279abdc, dwFlags=0x0) returned 1
	[0125.403] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279ac20*, pdwDataLen=0x55cf204*=0xbcb0, dwBufLen=0xbcb0 | out: pbData=0x279ac20*, pdwDataLen=0x55cf204*=0xbcb0) returned 1
	[0125.403] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a68dc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27a68dc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.403] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0125.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.403] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp", lpFilePart=0x0) returned 0x26
	[0125.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.403] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sz_pp5vqm.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.405] GetFileType (hFile=0x5dc) returned 0x1
	[0125.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.405] GetFileType (hFile=0x5dc) returned 0x1
	[0125.405] WriteFile (in: hFile=0x5dc, lpBuffer=0x279ac20*, nNumberOfBytesToWrite=0xbcb0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x279ac20*, lpNumberOfBytesWritten=0x55cf1f0*=0xbcb0, lpOverlapped=0x0) returned 1
	[0125.564] CloseHandle (hObject=0x5dc) returned 1
	[0125.564] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp", lpFilePart=0x0) returned 0x26
	[0125.564] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0125.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sz_pp5vqm.bmp"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0319a30, ftCreationTime.dwHighDateTime=0x1d4c844, ftLastAccessTime.dwLowDateTime=0x1b854790, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0x852cb6ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xbcb0)) returned 1
	[0125.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.565] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sz_pp5vqm.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\SZ_pP5VqM.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\sz_pp5vqm.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.566] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg", lpFilePart=0x0) returned 0x2d
	[0125.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.566] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tijfe9vvglzrw8se.jpg"), fInfoLevelId=0x0, lpFileInformation=0x27a6c24 | out: lpFileInformation=0x27a6c24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61902da0, ftCreationTime.dwHighDateTime=0x1d4c7d4, ftLastAccessTime.dwLowDateTime=0xa67922f0, ftLastAccessTime.dwHighDateTime=0x1d4cd88, ftLastWriteTime.dwLowDateTime=0xa67922f0, ftLastWriteTime.dwHighDateTime=0x1d4cd88, nFileSizeHigh=0x0, nFileSizeLow=0x15e68)) returned 1
	[0125.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.566] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg", lpFilePart=0x0) returned 0x2d
	[0125.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.566] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tijfe9vvglzrw8se.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.567] GetFileType (hFile=0x5dc) returned 0x1
	[0125.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.567] GetFileType (hFile=0x5dc) returned 0x1
	[0125.567] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x15e68
	[0125.567] ReadFile (in: hFile=0x5dc, lpBuffer=0x79aa570, nNumberOfBytesToRead=0x15e68, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x79aa570*, lpNumberOfBytesRead=0x55cf1fc*=0x15e68, lpOverlapped=0x0) returned 1
	[0125.569] CloseHandle (hObject=0x5dc) returned 1
	[0125.569] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.569] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.569] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a6ecc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b200) returned 1
	[0125.570] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.570] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.570] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0125.570] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.570] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27a6f84*=0x1, dwFlags=0x0) returned 1
	[0125.570] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27a6f50, dwFlags=0x0) returned 1
	[0125.571] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x79c03f8*, pdwDataLen=0x55cf204*=0x15e70, dwBufLen=0x15e70 | out: pbData=0x79c03f8*, pdwDataLen=0x55cf204*=0x15e70) returned 1
	[0125.571] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a6f94*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27a6f94*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.571] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0125.571] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.571] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.571] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg", lpFilePart=0x0) returned 0x2d
	[0125.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.571] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tijfe9vvglzrw8se.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.573] GetFileType (hFile=0x5dc) returned 0x1
	[0125.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.573] GetFileType (hFile=0x5dc) returned 0x1
	[0125.573] WriteFile (in: hFile=0x5dc, lpBuffer=0x79c03f8*, nNumberOfBytesToWrite=0x15e70, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x79c03f8*, lpNumberOfBytesWritten=0x55cf1f0*=0x15e70, lpOverlapped=0x0) returned 1
	[0125.575] CloseHandle (hObject=0x5dc) returned 1
	[0125.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg", lpFilePart=0x0) returned 0x2d
	[0125.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0125.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.576] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tijfe9vvglzrw8se.jpg"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61902da0, ftCreationTime.dwHighDateTime=0x1d4c7d4, ftLastAccessTime.dwLowDateTime=0xa67922f0, ftLastAccessTime.dwHighDateTime=0x1d4cd88, ftLastWriteTime.dwLowDateTime=0x852cb6ce, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x15e70)) returned 1
	[0125.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.576] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tijfe9vvglzrw8se.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tijFE9VvGlZRW8SE.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\tijfe9vvglzrw8se.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg", lpFilePart=0x0) returned 0x26
	[0125.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.577] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tzaclkw0m.jpg"), fInfoLevelId=0x0, lpFileInformation=0x27a7334 | out: lpFileInformation=0x27a7334*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ca15000, ftCreationTime.dwHighDateTime=0x1d4d1ab, ftLastAccessTime.dwLowDateTime=0x343225d0, ftLastAccessTime.dwHighDateTime=0x1d4c869, ftLastWriteTime.dwLowDateTime=0x343225d0, ftLastWriteTime.dwHighDateTime=0x1d4c869, nFileSizeHigh=0x0, nFileSizeLow=0x142d4)) returned 1
	[0125.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.578] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg", lpFilePart=0x0) returned 0x26
	[0125.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.578] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tzaclkw0m.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.578] GetFileType (hFile=0x5dc) returned 0x1
	[0125.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.578] GetFileType (hFile=0x5dc) returned 0x1
	[0125.578] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x142d4
	[0125.578] ReadFile (in: hFile=0x5dc, lpBuffer=0x27a7514, nNumberOfBytesToRead=0x142d4, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27a7514*, lpNumberOfBytesRead=0x55cf1fc*=0x142d4, lpOverlapped=0x0) returned 1
	[0125.580] CloseHandle (hObject=0x5dc) returned 1
	[0125.580] CryptDestroyKey (hKey=0x82b200) returned 1
	[0125.580] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.580] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27bb884, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0125.580] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.580] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.580] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0125.580] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.580] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27bb93c*=0x1, dwFlags=0x0) returned 1
	[0125.580] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27bb908, dwFlags=0x0) returned 1
	[0125.580] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27bb94c*, pdwDataLen=0x55cf204*=0x142e0, dwBufLen=0x142e0 | out: pbData=0x27bb94c*, pdwDataLen=0x55cf204*=0x142e0) returned 1
	[0125.580] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cfc38*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27cfc38*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.580] CryptDestroyKey (hKey=0x82b540) returned 1
	[0125.580] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.580] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.581] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg", lpFilePart=0x0) returned 0x26
	[0125.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.581] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tzaclkw0m.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.582] GetFileType (hFile=0x5dc) returned 0x1
	[0125.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.583] GetFileType (hFile=0x5dc) returned 0x1
	[0125.583] WriteFile (in: hFile=0x5dc, lpBuffer=0x27bb94c*, nNumberOfBytesToWrite=0x142e0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27bb94c*, lpNumberOfBytesWritten=0x55cf1f0*=0x142e0, lpOverlapped=0x0) returned 1
	[0125.585] CloseHandle (hObject=0x5dc) returned 1
	[0125.585] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg", lpFilePart=0x0) returned 0x26
	[0125.585] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0125.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tzaclkw0m.jpg"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ca15000, ftCreationTime.dwHighDateTime=0x1d4d1ab, ftLastAccessTime.dwLowDateTime=0x343225d0, ftLastAccessTime.dwHighDateTime=0x1d4c869, ftLastWriteTime.dwLowDateTime=0x852f1a3b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x142e0)) returned 1
	[0125.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.585] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tzaclkw0m.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\TzAclKw0M.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\tzaclkw0m.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp", lpFilePart=0x0) returned 0x23
	[0125.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.684] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\t_re9h.bmp"), fInfoLevelId=0x0, lpFileInformation=0x27cff80 | out: lpFileInformation=0x27cff80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7f9a820, ftCreationTime.dwHighDateTime=0x1d4cacc, ftLastAccessTime.dwLowDateTime=0x92491b00, ftLastAccessTime.dwHighDateTime=0x1d4c815, ftLastWriteTime.dwLowDateTime=0x92491b00, ftLastWriteTime.dwHighDateTime=0x1d4c815, nFileSizeHigh=0x0, nFileSizeLow=0x16f80)) returned 1
	[0125.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp", lpFilePart=0x0) returned 0x23
	[0125.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.685] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\t_re9h.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.685] GetFileType (hFile=0x5dc) returned 0x1
	[0125.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.685] GetFileType (hFile=0x5dc) returned 0x1
	[0125.685] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x16f80
	[0125.685] ReadFile (in: hFile=0x5dc, lpBuffer=0x79d6288, nNumberOfBytesToRead=0x16f80, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x79d6288*, lpNumberOfBytesRead=0x55cf1fc*=0x16f80, lpOverlapped=0x0) returned 1
	[0125.688] CloseHandle (hObject=0x5dc) returned 1
	[0125.688] CryptDestroyKey (hKey=0x82b280) returned 1
	[0125.688] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.688] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d01d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0125.688] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.689] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.689] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0125.689] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.689] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x27d0290*=0x1, dwFlags=0x0) returned 1
	[0125.689] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x27d025c, dwFlags=0x0) returned 1
	[0125.690] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x79ed228*, pdwDataLen=0x55cf204*=0x16f90, dwBufLen=0x16f90 | out: pbData=0x79ed228*, pdwDataLen=0x55cf204*=0x16f90) returned 1
	[0125.691] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d02a0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27d02a0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.691] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0125.691] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.691] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp", lpFilePart=0x0) returned 0x23
	[0125.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.691] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\t_re9h.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.693] GetFileType (hFile=0x5dc) returned 0x1
	[0125.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.693] GetFileType (hFile=0x5dc) returned 0x1
	[0125.693] WriteFile (in: hFile=0x5dc, lpBuffer=0x79ed228*, nNumberOfBytesToWrite=0x16f90, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x79ed228*, lpNumberOfBytesWritten=0x55cf1f0*=0x16f90, lpOverlapped=0x0) returned 1
	[0125.696] CloseHandle (hObject=0x5dc) returned 1
	[0125.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp", lpFilePart=0x0) returned 0x23
	[0125.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0125.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\t_re9h.bmp"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7f9a820, ftCreationTime.dwHighDateTime=0x1d4cacc, ftLastAccessTime.dwLowDateTime=0x92491b00, ftLastAccessTime.dwHighDateTime=0x1d4c815, ftLastWriteTime.dwLowDateTime=0x853fe02a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x16f90)) returned 1
	[0125.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.696] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\t_re9h.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\t_re9H.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\t_re9h.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.697] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uST.gif", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uST.gif", lpFilePart=0x0) returned 0x20
	[0125.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.697] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uST.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ust.gif"), fInfoLevelId=0x0, lpFileInformation=0x27d05c8 | out: lpFileInformation=0x27d05c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720e05e0, ftCreationTime.dwHighDateTime=0x1d4d11f, ftLastAccessTime.dwLowDateTime=0xdfcedaf0, ftLastAccessTime.dwHighDateTime=0x1d4cdb4, ftLastWriteTime.dwLowDateTime=0xdfcedaf0, ftLastWriteTime.dwHighDateTime=0x1d4cdb4, nFileSizeHigh=0x0, nFileSizeLow=0x962a)) returned 1
	[0125.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.697] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uST.gif", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uST.gif", lpFilePart=0x0) returned 0x20
	[0125.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.698] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uST.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ust.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.698] GetFileType (hFile=0x5dc) returned 0x1
	[0125.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.698] GetFileType (hFile=0x5dc) returned 0x1
	[0125.698] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x962a
	[0125.698] ReadFile (in: hFile=0x5dc, lpBuffer=0x27d0778, nNumberOfBytesToRead=0x962a, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27d0778*, lpNumberOfBytesRead=0x55cf1fc*=0x962a, lpOverlapped=0x0) returned 1
	[0125.699] CloseHandle (hObject=0x5dc) returned 1
	[0125.699] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.699] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.699] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d9e40, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0125.699] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.699] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.699] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0125.699] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.699] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27d9ef8*=0x1, dwFlags=0x0) returned 1
	[0125.699] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27d9ec4, dwFlags=0x0) returned 1
	[0125.699] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d9f08*, pdwDataLen=0x55cf204*=0x9630, dwBufLen=0x9630 | out: pbData=0x27d9f08*, pdwDataLen=0x55cf204*=0x9630) returned 1
	[0125.700] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e3544*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27e3544*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.700] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.700] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.700] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.700] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uST.gif", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uST.gif", lpFilePart=0x0) returned 0x20
	[0125.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.700] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uST.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ust.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.704] GetFileType (hFile=0x5dc) returned 0x1
	[0125.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.704] GetFileType (hFile=0x5dc) returned 0x1
	[0125.704] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d9f08*, nNumberOfBytesToWrite=0x9630, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27d9f08*, lpNumberOfBytesWritten=0x55cf1f0*=0x9630, lpOverlapped=0x0) returned 1
	[0125.706] CloseHandle (hObject=0x5dc) returned 1
	[0125.706] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uST.gif", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uST.gif", lpFilePart=0x0) returned 0x20
	[0125.706] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uST.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uST.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x4f
	[0125.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.706] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uST.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ust.gif"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720e05e0, ftCreationTime.dwHighDateTime=0x1d4d11f, ftLastAccessTime.dwLowDateTime=0xdfcedaf0, ftLastAccessTime.dwHighDateTime=0x1d4cdb4, ftLastWriteTime.dwLowDateTime=0x85422c41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9630)) returned 1
	[0125.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.707] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\uST.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ust.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\uST.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\ust.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\vlex.gif", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\vlex.gif", lpFilePart=0x0) returned 0x21
	[0125.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\vlex.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vlex.gif"), fInfoLevelId=0x0, lpFileInformation=0x27e3844 | out: lpFileInformation=0x27e3844*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b89c5f0, ftCreationTime.dwHighDateTime=0x1d4d0bc, ftLastAccessTime.dwLowDateTime=0x6d17c380, ftLastAccessTime.dwHighDateTime=0x1d4cf0f, ftLastWriteTime.dwLowDateTime=0x6d17c380, ftLastWriteTime.dwHighDateTime=0x1d4cf0f, nFileSizeHigh=0x0, nFileSizeLow=0x18ce4)) returned 1
	[0125.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.708] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\vlex.gif", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\vlex.gif", lpFilePart=0x0) returned 0x21
	[0125.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.708] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\vlex.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vlex.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.708] GetFileType (hFile=0x5dc) returned 0x1
	[0125.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.708] GetFileType (hFile=0x5dc) returned 0x1
	[0125.708] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x18ce4
	[0125.709] ReadFile (in: hFile=0x5dc, lpBuffer=0x7a041d8, nNumberOfBytesToRead=0x18ce4, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x7a041d8*, lpNumberOfBytesRead=0x55cf1fc*=0x18ce4, lpOverlapped=0x0) returned 1
	[0125.711] CloseHandle (hObject=0x5dc) returned 1
	[0125.711] CryptDestroyKey (hKey=0x82b300) returned 1
	[0125.711] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.711] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e3a8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0125.711] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.711] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.711] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0125.711] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.711] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27e3b44*=0x1, dwFlags=0x0) returned 1
	[0125.711] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27e3b10, dwFlags=0x0) returned 1
	[0125.713] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7a1ced8*, pdwDataLen=0x55cf204*=0x18cf0, dwBufLen=0x18cf0 | out: pbData=0x7a1ced8*, pdwDataLen=0x55cf204*=0x18cf0) returned 1
	[0125.713] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e3b54*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27e3b54*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.713] CryptDestroyKey (hKey=0x82b280) returned 1
	[0125.713] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.713] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.713] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\vlex.gif", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\vlex.gif", lpFilePart=0x0) returned 0x21
	[0125.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.713] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\vlex.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vlex.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.715] GetFileType (hFile=0x5dc) returned 0x1
	[0125.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.715] GetFileType (hFile=0x5dc) returned 0x1
	[0125.715] WriteFile (in: hFile=0x5dc, lpBuffer=0x7a1ced8*, nNumberOfBytesToWrite=0x18cf0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x7a1ced8*, lpNumberOfBytesWritten=0x55cf1f0*=0x18cf0, lpOverlapped=0x0) returned 1
	[0125.750] CloseHandle (hObject=0x5dc) returned 1
	[0125.750] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\vlex.gif", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\vlex.gif", lpFilePart=0x0) returned 0x21
	[0125.751] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\vlex.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\vlex.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x50
	[0125.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.751] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\vlex.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vlex.gif"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b89c5f0, ftCreationTime.dwHighDateTime=0x1d4d0bc, ftLastAccessTime.dwLowDateTime=0x6d17c380, ftLastAccessTime.dwHighDateTime=0x1d4cf0f, ftLastWriteTime.dwLowDateTime=0x854951b3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x18cf0)) returned 1
	[0125.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.751] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vlex.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vlex.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vlex.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\vlex.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.752] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png", lpFilePart=0x0) returned 0x2e
	[0125.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png" (normalized: "c:\\users\\fd1hvy\\pictures\\x eyiyzusstvexn83.png"), fInfoLevelId=0x0, lpFileInformation=0x27e3e64 | out: lpFileInformation=0x27e3e64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4161330, ftCreationTime.dwHighDateTime=0x1d4cdb6, ftLastAccessTime.dwLowDateTime=0xf6479190, ftLastAccessTime.dwHighDateTime=0x1d4cc5c, ftLastWriteTime.dwLowDateTime=0xf6479190, ftLastWriteTime.dwHighDateTime=0x1d4cc5c, nFileSizeHigh=0x0, nFileSizeLow=0xe1e1)) returned 1
	[0125.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.752] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png", lpFilePart=0x0) returned 0x2e
	[0125.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.752] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png" (normalized: "c:\\users\\fd1hvy\\pictures\\x eyiyzusstvexn83.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.752] GetFileType (hFile=0x5dc) returned 0x1
	[0125.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.752] GetFileType (hFile=0x5dc) returned 0x1
	[0125.752] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xe1e1
	[0125.753] ReadFile (in: hFile=0x5dc, lpBuffer=0x27e4084, nNumberOfBytesToRead=0xe1e1, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27e4084*, lpNumberOfBytesRead=0x55cf1fc*=0xe1e1, lpOverlapped=0x0) returned 1
	[0125.754] CloseHandle (hObject=0x5dc) returned 1
	[0125.754] CryptDestroyKey (hKey=0x82b380) returned 1
	[0125.754] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.754] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f2304, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0125.754] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.754] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.754] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0125.754] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.754] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27f23bc*=0x1, dwFlags=0x0) returned 1
	[0125.754] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27f2388, dwFlags=0x0) returned 1
	[0125.754] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f23cc*, pdwDataLen=0x55cf204*=0xe1f0, dwBufLen=0xe1f0 | out: pbData=0x27f23cc*, pdwDataLen=0x55cf204*=0xe1f0) returned 1
	[0125.754] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28005c8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x28005c8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.754] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.754] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.754] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.754] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png", lpFilePart=0x0) returned 0x2e
	[0125.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.755] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png" (normalized: "c:\\users\\fd1hvy\\pictures\\x eyiyzusstvexn83.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.756] GetFileType (hFile=0x5dc) returned 0x1
	[0125.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.756] GetFileType (hFile=0x5dc) returned 0x1
	[0125.756] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f23cc*, nNumberOfBytesToWrite=0xe1f0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x27f23cc*, lpNumberOfBytesWritten=0x55cf1f0*=0xe1f0, lpOverlapped=0x0) returned 1
	[0125.758] CloseHandle (hObject=0x5dc) returned 1
	[0125.758] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png", lpFilePart=0x0) returned 0x2e
	[0125.758] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0125.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.758] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png" (normalized: "c:\\users\\fd1hvy\\pictures\\x eyiyzusstvexn83.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4161330, ftCreationTime.dwHighDateTime=0x1d4cdb6, ftLastAccessTime.dwLowDateTime=0xf6479190, ftLastAccessTime.dwHighDateTime=0x1d4cc5c, ftLastWriteTime.dwLowDateTime=0x854951b3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xe1f0)) returned 1
	[0125.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.759] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png" (normalized: "c:\\users\\fd1hvy\\pictures\\x eyiyzusstvexn83.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\X EyiYzuSSTvExN83.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\x eyiyzusstvexn83.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif", lpFilePart=0x0) returned 0x23
	[0125.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.760] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\y1dqbk.gif"), fInfoLevelId=0x0, lpFileInformation=0x2800970 | out: lpFileInformation=0x2800970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2134e80, ftCreationTime.dwHighDateTime=0x1d4c849, ftLastAccessTime.dwLowDateTime=0x3c2c5120, ftLastAccessTime.dwHighDateTime=0x1d4d052, ftLastWriteTime.dwLowDateTime=0x3c2c5120, ftLastWriteTime.dwHighDateTime=0x1d4d052, nFileSizeHigh=0x0, nFileSizeLow=0x6ee3)) returned 1
	[0125.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif", lpFilePart=0x0) returned 0x23
	[0125.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.760] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\y1dqbk.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.760] GetFileType (hFile=0x5dc) returned 0x1
	[0125.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.760] GetFileType (hFile=0x5dc) returned 0x1
	[0125.760] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x6ee3
	[0125.760] ReadFile (in: hFile=0x5dc, lpBuffer=0x2800b38, nNumberOfBytesToRead=0x6ee3, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2800b38*, lpNumberOfBytesRead=0x55cf1fc*=0x6ee3, lpOverlapped=0x0) returned 1
	[0125.761] CloseHandle (hObject=0x5dc) returned 1
	[0125.761] CryptDestroyKey (hKey=0x82b340) returned 1
	[0125.761] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.762] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2807ab8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0125.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.762] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0125.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.762] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2807b70*=0x1, dwFlags=0x0) returned 1
	[0125.762] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2807b3c, dwFlags=0x0) returned 1
	[0125.762] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2807b80*, pdwDataLen=0x55cf204*=0x6ef0, dwBufLen=0x6ef0 | out: pbData=0x2807b80*, pdwDataLen=0x55cf204*=0x6ef0) returned 1
	[0125.762] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x280ea7c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x280ea7c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.762] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.762] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.762] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.762] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif", lpFilePart=0x0) returned 0x23
	[0125.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.762] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\y1dqbk.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.764] GetFileType (hFile=0x5dc) returned 0x1
	[0125.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.764] GetFileType (hFile=0x5dc) returned 0x1
	[0125.764] WriteFile (in: hFile=0x5dc, lpBuffer=0x2807b80*, nNumberOfBytesToWrite=0x6ef0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2807b80*, lpNumberOfBytesWritten=0x55cf1f0*=0x6ef0, lpOverlapped=0x0) returned 1
	[0125.765] CloseHandle (hObject=0x5dc) returned 1
	[0125.765] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif", lpFilePart=0x0) returned 0x23
	[0125.765] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0125.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.765] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\y1dqbk.gif"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2134e80, ftCreationTime.dwHighDateTime=0x1d4c849, ftLastAccessTime.dwLowDateTime=0x3c2c5120, ftLastAccessTime.dwHighDateTime=0x1d4d052, ftLastWriteTime.dwLowDateTime=0x854bb4d7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x6ef0)) returned 1
	[0125.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.766] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\y1dqbk.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Y1Dqbk.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\y1dqbk.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.766] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\y3ns.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\y3ns.png", lpFilePart=0x0) returned 0x21
	[0125.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.766] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\y3ns.png" (normalized: "c:\\users\\fd1hvy\\pictures\\y3ns.png"), fInfoLevelId=0x0, lpFileInformation=0x280eda4 | out: lpFileInformation=0x280eda4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee7a0, ftCreationTime.dwHighDateTime=0x1d4c603, ftLastAccessTime.dwLowDateTime=0x3bb31a00, ftLastAccessTime.dwHighDateTime=0x1d4cae2, ftLastWriteTime.dwLowDateTime=0x3bb31a00, ftLastWriteTime.dwHighDateTime=0x1d4cae2, nFileSizeHigh=0x0, nFileSizeLow=0x851e)) returned 1
	[0125.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.766] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\y3ns.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\y3ns.png", lpFilePart=0x0) returned 0x21
	[0125.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.766] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\y3ns.png" (normalized: "c:\\users\\fd1hvy\\pictures\\y3ns.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.767] GetFileType (hFile=0x5dc) returned 0x1
	[0125.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.767] GetFileType (hFile=0x5dc) returned 0x1
	[0125.767] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x851e
	[0125.767] ReadFile (in: hFile=0x5dc, lpBuffer=0x280ef5c, nNumberOfBytesToRead=0x851e, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x280ef5c*, lpNumberOfBytesRead=0x55cf1fc*=0x851e, lpOverlapped=0x0) returned 1
	[0125.768] CloseHandle (hObject=0x5dc) returned 1
	[0125.768] CryptDestroyKey (hKey=0x82b400) returned 1
	[0125.768] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.768] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2817518, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b200) returned 1
	[0125.768] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.768] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.768] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b040) returned 1
	[0125.768] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.768] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x28175d0*=0x1, dwFlags=0x0) returned 1
	[0125.768] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x281759c, dwFlags=0x0) returned 1
	[0125.768] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28175e0*, pdwDataLen=0x55cf204*=0x8520, dwBufLen=0x8520 | out: pbData=0x28175e0*, pdwDataLen=0x55cf204*=0x8520) returned 1
	[0125.768] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x281fb0c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x281fb0c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.768] CryptDestroyKey (hKey=0x82b040) returned 1
	[0125.768] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.769] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.769] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\y3ns.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\y3ns.png", lpFilePart=0x0) returned 0x21
	[0125.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.769] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\y3ns.png" (normalized: "c:\\users\\fd1hvy\\pictures\\y3ns.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.770] GetFileType (hFile=0x5dc) returned 0x1
	[0125.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.770] GetFileType (hFile=0x5dc) returned 0x1
	[0125.770] WriteFile (in: hFile=0x5dc, lpBuffer=0x28175e0*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x28175e0*, lpNumberOfBytesWritten=0x55cf1f0*=0x8520, lpOverlapped=0x0) returned 1
	[0125.772] CloseHandle (hObject=0x5dc) returned 1
	[0125.772] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\y3ns.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\y3ns.png", lpFilePart=0x0) returned 0x21
	[0125.772] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\y3ns.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\y3ns.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x50
	[0125.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.772] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\y3ns.png" (normalized: "c:\\users\\fd1hvy\\pictures\\y3ns.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee7a0, ftCreationTime.dwHighDateTime=0x1d4c603, ftLastAccessTime.dwLowDateTime=0x3bb31a00, ftLastAccessTime.dwHighDateTime=0x1d4cae2, ftLastWriteTime.dwLowDateTime=0x854bb4d7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8520)) returned 1
	[0125.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.772] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\y3ns.png" (normalized: "c:\\users\\fd1hvy\\pictures\\y3ns.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\y3ns.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\y3ns.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.773] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp", lpFilePart=0x0) returned 0x28
	[0125.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.773] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yzjsq0dypgu.bmp"), fInfoLevelId=0x0, lpFileInformation=0x281fe1c | out: lpFileInformation=0x281fe1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c3bcda0, ftCreationTime.dwHighDateTime=0x1d4cce7, ftLastAccessTime.dwLowDateTime=0xb3939b20, ftLastAccessTime.dwHighDateTime=0x1d4cdef, ftLastWriteTime.dwLowDateTime=0xb3939b20, ftLastWriteTime.dwHighDateTime=0x1d4cdef, nFileSizeHigh=0x0, nFileSizeLow=0xab36)) returned 1
	[0125.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.773] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp", lpFilePart=0x0) returned 0x28
	[0125.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.773] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yzjsq0dypgu.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.774] GetFileType (hFile=0x5dc) returned 0x1
	[0125.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.774] GetFileType (hFile=0x5dc) returned 0x1
	[0125.774] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xab36
	[0125.774] ReadFile (in: hFile=0x5dc, lpBuffer=0x282000c, nNumberOfBytesToRead=0xab36, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x282000c*, lpNumberOfBytesRead=0x55cf1fc*=0xab36, lpOverlapped=0x0) returned 1
	[0125.775] CloseHandle (hObject=0x5dc) returned 1
	[0125.775] CryptDestroyKey (hKey=0x82b200) returned 1
	[0125.775] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.775] CryptImportKey (in: hProv=0x7f93c0, pbData=0x282abe0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0125.775] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.775] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.775] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0125.775] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.775] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x282ac98*=0x1, dwFlags=0x0) returned 1
	[0125.775] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x282ac64, dwFlags=0x0) returned 1
	[0125.775] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x282aca8*, pdwDataLen=0x55cf204*=0xab40, dwBufLen=0xab40 | out: pbData=0x282aca8*, pdwDataLen=0x55cf204*=0xab40) returned 1
	[0125.775] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28357f4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x28357f4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.775] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0125.776] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.776] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.776] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp", lpFilePart=0x0) returned 0x28
	[0125.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.776] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yzjsq0dypgu.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.777] GetFileType (hFile=0x5dc) returned 0x1
	[0125.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.777] GetFileType (hFile=0x5dc) returned 0x1
	[0125.777] WriteFile (in: hFile=0x5dc, lpBuffer=0x282aca8*, nNumberOfBytesToWrite=0xab40, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x282aca8*, lpNumberOfBytesWritten=0x55cf1f0*=0xab40, lpOverlapped=0x0) returned 1
	[0125.779] CloseHandle (hObject=0x5dc) returned 1
	[0125.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp", lpFilePart=0x0) returned 0x28
	[0125.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0125.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.779] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yzjsq0dypgu.bmp"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c3bcda0, ftCreationTime.dwHighDateTime=0x1d4cce7, ftLastAccessTime.dwLowDateTime=0xb3939b20, ftLastAccessTime.dwHighDateTime=0x1d4cdef, ftLastWriteTime.dwLowDateTime=0x854bb4d7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xab40)) returned 1
	[0125.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.780] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yzjsq0dypgu.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\yzjSQ0dyPgU.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\yzjsq0dypgu.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.781] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png", lpFilePart=0x0) returned 0x30
	[0125.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zknde12vutug6otsbga.png"), fInfoLevelId=0x0, lpFileInformation=0x2835b54 | out: lpFileInformation=0x2835b54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c93550, ftCreationTime.dwHighDateTime=0x1d4c656, ftLastAccessTime.dwLowDateTime=0x25ea7800, ftLastAccessTime.dwHighDateTime=0x1d4d265, ftLastWriteTime.dwLowDateTime=0x25ea7800, ftLastWriteTime.dwHighDateTime=0x1d4d265, nFileSizeHigh=0x0, nFileSizeLow=0xa26e)) returned 1
	[0125.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.781] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png", lpFilePart=0x0) returned 0x30
	[0125.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.781] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zknde12vutug6otsbga.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.782] GetFileType (hFile=0x5dc) returned 0x1
	[0125.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.782] GetFileType (hFile=0x5dc) returned 0x1
	[0125.782] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xa26e
	[0125.782] ReadFile (in: hFile=0x5dc, lpBuffer=0x2835d84, nNumberOfBytesToRead=0xa26e, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2835d84*, lpNumberOfBytesRead=0x55cf1fc*=0xa26e, lpOverlapped=0x0) returned 1
	[0125.783] CloseHandle (hObject=0x5dc) returned 1
	[0125.783] CryptDestroyKey (hKey=0x82b540) returned 1
	[0125.783] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.783] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2840090, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b480) returned 1
	[0125.783] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.783] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.783] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0125.783] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.783] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2840148*=0x1, dwFlags=0x0) returned 1
	[0125.783] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2840114, dwFlags=0x0) returned 1
	[0125.785] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2636700*, pdwDataLen=0x55cf204*=0xa270, dwBufLen=0xa270 | out: pbData=0x2636700*, pdwDataLen=0x55cf204*=0xa270) returned 1
	[0125.785] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264097c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x264097c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.785] CryptDestroyKey (hKey=0x82b380) returned 1
	[0125.785] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.785] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.785] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png", lpFilePart=0x0) returned 0x30
	[0125.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.785] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zknde12vutug6otsbga.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.787] GetFileType (hFile=0x5dc) returned 0x1
	[0125.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.787] GetFileType (hFile=0x5dc) returned 0x1
	[0125.787] WriteFile (in: hFile=0x5dc, lpBuffer=0x2636700*, nNumberOfBytesToWrite=0xa270, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2636700*, lpNumberOfBytesWritten=0x55cf1f0*=0xa270, lpOverlapped=0x0) returned 1
	[0125.789] CloseHandle (hObject=0x5dc) returned 1
	[0125.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png", lpFilePart=0x0) returned 0x30
	[0125.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0125.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zknde12vutug6otsbga.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c93550, ftCreationTime.dwHighDateTime=0x1d4c656, ftLastAccessTime.dwLowDateTime=0x25ea7800, ftLastAccessTime.dwHighDateTime=0x1d4d265, ftLastWriteTime.dwLowDateTime=0x854e174a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xa270)) returned 1
	[0125.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.789] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zknde12vutug6otsbga.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ZknDe12VuTUg6otSbga.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\zknde12vutug6otsbga.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png", lpFilePart=0x0) returned 0x2f
	[0125.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.790] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zqw5boj24vcxjewhw1.png"), fInfoLevelId=0x0, lpFileInformation=0x2640d3c | out: lpFileInformation=0x2640d3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdede6ee0, ftCreationTime.dwHighDateTime=0x1d4c7be, ftLastAccessTime.dwLowDateTime=0x60ac4200, ftLastAccessTime.dwHighDateTime=0x1d4c7ef, ftLastWriteTime.dwLowDateTime=0x60ac4200, ftLastWriteTime.dwHighDateTime=0x1d4c7ef, nFileSizeHigh=0x0, nFileSizeLow=0x28de)) returned 1
	[0125.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png", lpFilePart=0x0) returned 0x2f
	[0125.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.790] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zqw5boj24vcxjewhw1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.791] GetFileType (hFile=0x5dc) returned 0x1
	[0125.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.791] GetFileType (hFile=0x5dc) returned 0x1
	[0125.791] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x28de
	[0125.791] ReadFile (in: hFile=0x5dc, lpBuffer=0x2640f64, nNumberOfBytesToRead=0x28de, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2640f64*, lpNumberOfBytesRead=0x55cf1fc*=0x28de, lpOverlapped=0x0) returned 1
	[0125.792] CloseHandle (hObject=0x5dc) returned 1
	[0125.792] CryptDestroyKey (hKey=0x82b480) returned 1
	[0125.792] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.792] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26438e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0125.792] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.792] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.792] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b200) returned 1
	[0125.792] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.792] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2643998*=0x1, dwFlags=0x0) returned 1
	[0125.792] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2643964, dwFlags=0x0) returned 1
	[0125.792] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26439a8*, pdwDataLen=0x55cf204*=0x28e0, dwBufLen=0x28e0 | out: pbData=0x26439a8*, pdwDataLen=0x55cf204*=0x28e0) returned 1
	[0125.792] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2646294*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2646294*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.793] CryptDestroyKey (hKey=0x82b200) returned 1
	[0125.793] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.793] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png", lpFilePart=0x0) returned 0x2f
	[0125.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.793] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zqw5boj24vcxjewhw1.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.794] GetFileType (hFile=0x5dc) returned 0x1
	[0125.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.794] GetFileType (hFile=0x5dc) returned 0x1
	[0125.794] WriteFile (in: hFile=0x5dc, lpBuffer=0x26439a8*, nNumberOfBytesToWrite=0x28e0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x26439a8*, lpNumberOfBytesWritten=0x55cf1f0*=0x28e0, lpOverlapped=0x0) returned 1
	[0125.795] CloseHandle (hObject=0x5dc) returned 1
	[0125.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png", lpFilePart=0x0) returned 0x2f
	[0125.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0125.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.866] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zqw5boj24vcxjewhw1.png"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdede6ee0, ftCreationTime.dwHighDateTime=0x1d4c7be, ftLastAccessTime.dwLowDateTime=0x60ac4200, ftLastAccessTime.dwHighDateTime=0x1d4c7ef, ftLastWriteTime.dwLowDateTime=0x854e174a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x28e0)) returned 1
	[0125.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.866] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zqw5boj24vcxjewhw1.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\zQw5BOj24vCxjewHw1.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\zqw5boj24vcxjewhw1.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.867] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif", lpFilePart=0x0) returned 0x2e
	[0125.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.867] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zv3cyst6osxropbb5.gif"), fInfoLevelId=0x0, lpFileInformation=0x264664c | out: lpFileInformation=0x264664c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdf045d0, ftCreationTime.dwHighDateTime=0x1d4cfa9, ftLastAccessTime.dwLowDateTime=0x8612b3e0, ftLastAccessTime.dwHighDateTime=0x1d4c582, ftLastWriteTime.dwLowDateTime=0x8612b3e0, ftLastWriteTime.dwHighDateTime=0x1d4c582, nFileSizeHigh=0x0, nFileSizeLow=0x5b1b)) returned 1
	[0125.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif", lpFilePart=0x0) returned 0x2e
	[0125.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.868] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zv3cyst6osxropbb5.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.868] GetFileType (hFile=0x5dc) returned 0x1
	[0125.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.868] GetFileType (hFile=0x5dc) returned 0x1
	[0125.868] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x5b1b
	[0125.868] ReadFile (in: hFile=0x5dc, lpBuffer=0x264686c, nNumberOfBytesToRead=0x5b1b, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x264686c*, lpNumberOfBytesRead=0x55cf1fc*=0x5b1b, lpOverlapped=0x0) returned 1
	[0125.869] CloseHandle (hObject=0x5dc) returned 1
	[0125.869] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0125.869] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.869] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264c424, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0125.869] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.869] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.869] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0125.869] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.869] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x264c4dc*=0x1, dwFlags=0x0) returned 1
	[0125.869] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x264c4a8, dwFlags=0x0) returned 1
	[0125.869] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264c4ec*, pdwDataLen=0x55cf204*=0x5b20, dwBufLen=0x5b20 | out: pbData=0x264c4ec*, pdwDataLen=0x55cf204*=0x5b20) returned 1
	[0125.870] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2652018*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2652018*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.870] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0125.870] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.870] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif", lpFilePart=0x0) returned 0x2e
	[0125.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.870] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zv3cyst6osxropbb5.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.871] GetFileType (hFile=0x5dc) returned 0x1
	[0125.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.871] GetFileType (hFile=0x5dc) returned 0x1
	[0125.871] WriteFile (in: hFile=0x5dc, lpBuffer=0x264c4ec*, nNumberOfBytesToWrite=0x5b20, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x264c4ec*, lpNumberOfBytesWritten=0x55cf1f0*=0x5b20, lpOverlapped=0x0) returned 1
	[0125.872] CloseHandle (hObject=0x5dc) returned 1
	[0125.872] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif", lpFilePart=0x0) returned 0x2e
	[0125.873] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0125.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zv3cyst6osxropbb5.gif"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdf045d0, ftCreationTime.dwHighDateTime=0x1d4cfa9, ftLastAccessTime.dwLowDateTime=0x8612b3e0, ftLastAccessTime.dwHighDateTime=0x1d4c582, ftLastWriteTime.dwLowDateTime=0x855a0358, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5b20)) returned 1
	[0125.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.873] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zv3cyst6osxropbb5.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\zv3Cyst6OSxrOPBB5.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\zv3cyst6osxropbb5.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg", lpFilePart=0x0) returned 0x2d
	[0125.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.874] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\_jpebcfhotvrhff_.jpg"), fInfoLevelId=0x0, lpFileInformation=0x26523c0 | out: lpFileInformation=0x26523c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa10e3160, ftCreationTime.dwHighDateTime=0x1d4caaa, ftLastAccessTime.dwLowDateTime=0x548a29e0, ftLastAccessTime.dwHighDateTime=0x1d4d539, ftLastWriteTime.dwLowDateTime=0x548a29e0, ftLastWriteTime.dwHighDateTime=0x1d4d539, nFileSizeHigh=0x0, nFileSizeLow=0xa376)) returned 1
	[0125.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg", lpFilePart=0x0) returned 0x2d
	[0125.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.875] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\_jpebcfhotvrhff_.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.875] GetFileType (hFile=0x5dc) returned 0x1
	[0125.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.875] GetFileType (hFile=0x5dc) returned 0x1
	[0125.875] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xa376
	[0125.875] ReadFile (in: hFile=0x5dc, lpBuffer=0x26525d8, nNumberOfBytesToRead=0xa376, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26525d8*, lpNumberOfBytesRead=0x55cf1fc*=0xa376, lpOverlapped=0x0) returned 1
	[0125.876] CloseHandle (hObject=0x5dc) returned 1
	[0125.876] CryptDestroyKey (hKey=0x82b300) returned 1
	[0125.876] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.876] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265c9ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0125.876] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.876] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.876] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0125.876] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.876] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x265caa4*=0x1, dwFlags=0x0) returned 1
	[0125.877] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x265ca70, dwFlags=0x0) returned 1
	[0125.877] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265cab4*, pdwDataLen=0x55cf204*=0xa380, dwBufLen=0xa380 | out: pbData=0x265cab4*, pdwDataLen=0x55cf204*=0xa380) returned 1
	[0125.877] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2666e40*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2666e40*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.877] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0125.877] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.877] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg", lpFilePart=0x0) returned 0x2d
	[0125.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.877] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\_jpebcfhotvrhff_.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.878] GetFileType (hFile=0x5dc) returned 0x1
	[0125.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0125.879] GetFileType (hFile=0x5dc) returned 0x1
	[0125.879] WriteFile (in: hFile=0x5dc, lpBuffer=0x265cab4*, nNumberOfBytesToWrite=0xa380, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x265cab4*, lpNumberOfBytesWritten=0x55cf1f0*=0xa380, lpOverlapped=0x0) returned 1
	[0125.880] CloseHandle (hObject=0x5dc) returned 1
	[0125.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg", lpFilePart=0x0) returned 0x2d
	[0125.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0125.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0125.880] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\_jpebcfhotvrhff_.jpg"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa10e3160, ftCreationTime.dwHighDateTime=0x1d4caaa, ftLastAccessTime.dwLowDateTime=0x548a29e0, ftLastAccessTime.dwHighDateTime=0x1d4d539, ftLastWriteTime.dwLowDateTime=0x855c66a8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xa380)) returned 1
	[0125.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0125.881] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\_jpebcfhotvrhff_.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\_jpEbCfhotvRhFf_.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\_jpebcfhotvrhff_.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", lpFilePart=0x0) returned 0x27
	[0125.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.881] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26671e0 | out: lpFileInformation=0x26671e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a)) returned 1
	[0125.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", lpFilePart=0x0) returned 0x27
	[0125.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.882] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.882] GetFileType (hFile=0x5dc) returned 0x1
	[0125.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.882] GetFileType (hFile=0x5dc) returned 0x1
	[0125.882] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x11a
	[0125.882] ReadFile (in: hFile=0x5dc, lpBuffer=0x26674e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26674e0*, lpNumberOfBytesRead=0x55cf1fc*=0x11a, lpOverlapped=0x0) returned 1
	[0125.883] CloseHandle (hObject=0x5dc) returned 1
	[0125.883] CryptDestroyKey (hKey=0x82b540) returned 1
	[0125.883] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.883] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266857c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0125.883] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.883] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.883] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0125.883] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.883] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2668634*=0x1, dwFlags=0x0) returned 1
	[0125.883] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2668600, dwFlags=0x0) returned 1
	[0125.883] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2668644*, pdwDataLen=0x55cf204*=0x120, dwBufLen=0x120 | out: pbData=0x2668644*, pdwDataLen=0x55cf204*=0x120) returned 1
	[0125.883] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2668770*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2668770*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.883] CryptDestroyKey (hKey=0x82b100) returned 1
	[0125.883] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.883] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", lpFilePart=0x0) returned 0x27
	[0125.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.884] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0125.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0125.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0125.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.885] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x2668c6c | out: lpFileInformation=0x2668c6c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c)) returned 1
	[0125.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.886] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0125.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.886] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.886] GetFileType (hFile=0x5dc) returned 0x1
	[0125.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.886] GetFileType (hFile=0x5dc) returned 0x1
	[0125.886] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x20c
	[0125.886] ReadFile (in: hFile=0x5dc, lpBuffer=0x2669054, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2669054*, lpNumberOfBytesRead=0x55cf1fc*=0x20c, lpOverlapped=0x0) returned 1
	[0125.887] CloseHandle (hObject=0x5dc) returned 1
	[0125.887] CryptDestroyKey (hKey=0x82b300) returned 1
	[0125.887] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.887] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266a0f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0125.887] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.887] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.887] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0125.887] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.887] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x266a1a8*=0x1, dwFlags=0x0) returned 1
	[0125.887] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x266a174, dwFlags=0x0) returned 1
	[0125.887] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266a1b8*, pdwDataLen=0x55cf204*=0x210, dwBufLen=0x210 | out: pbData=0x266a1b8*, pdwDataLen=0x55cf204*=0x210) returned 1
	[0125.888] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266a3d4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x266a3d4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.888] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0125.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.888] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0125.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.888] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0125.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0125.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", lpFilePart=0x0) returned 0x2d
	[0125.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.890] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), fInfoLevelId=0x0, lpFileInformation=0x266a8bc | out: lpFileInformation=0x266a8bc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8)) returned 1
	[0125.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.891] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", lpFilePart=0x0) returned 0x2d
	[0125.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.891] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.891] GetFileType (hFile=0x5dc) returned 0x1
	[0125.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.891] GetFileType (hFile=0x5dc) returned 0x1
	[0125.891] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xf8
	[0125.891] ReadFile (in: hFile=0x5dc, lpBuffer=0x266abd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x266abd8*, lpNumberOfBytesRead=0x55cf1fc*=0xf8, lpOverlapped=0x0) returned 1
	[0125.892] CloseHandle (hObject=0x5dc) returned 1
	[0125.892] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0125.892] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.893] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266bc74, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b440) returned 1
	[0125.893] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.893] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.893] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0125.893] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.893] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x266bd2c*=0x1, dwFlags=0x0) returned 1
	[0125.893] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x266bcf8, dwFlags=0x0) returned 1
	[0125.893] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266bd3c*, pdwDataLen=0x55cf204*=0x100, dwBufLen=0x100 | out: pbData=0x266bd3c*, pdwDataLen=0x55cf204*=0x100) returned 1
	[0125.893] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266be48*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x266be48*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.893] CryptDestroyKey (hKey=0x82b340) returned 1
	[0125.893] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.893] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.893] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", lpFilePart=0x0) returned 0x2d
	[0125.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.893] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0125.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0125.895] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", lpFilePart=0x0) returned 0x34
	[0125.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.895] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), fInfoLevelId=0x0, lpFileInformation=0x266c388 | out: lpFileInformation=0x266c388*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8)) returned 1
	[0125.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0125.895] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", lpFilePart=0x0) returned 0x34
	[0125.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0125.895] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.896] GetFileType (hFile=0x5dc) returned 0x1
	[0125.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0125.896] GetFileType (hFile=0x5dc) returned 0x1
	[0125.896] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xf8
	[0125.896] ReadFile (in: hFile=0x5dc, lpBuffer=0x266c6dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x266c6dc*, lpNumberOfBytesRead=0x55cf1fc*=0xf8, lpOverlapped=0x0) returned 1
	[0125.897] CloseHandle (hObject=0x5dc) returned 1
	[0125.897] CryptDestroyKey (hKey=0x82b440) returned 1
	[0125.897] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.897] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266d778, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0125.897] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.897] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.897] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0125.897] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.897] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x266d830*=0x1, dwFlags=0x0) returned 1
	[0125.897] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x266d7fc, dwFlags=0x0) returned 1
	[0125.898] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266d840*, pdwDataLen=0x55cf204*=0x100, dwBufLen=0x100 | out: pbData=0x266d840*, pdwDataLen=0x55cf204*=0x100) returned 1
	[0125.898] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266d94c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x266d94c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0125.898] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0125.898] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.898] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.898] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", lpFilePart=0x0) returned 0x34
	[0125.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0125.898] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0125.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0125.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpFilePart=0x0) returned 0x63
	[0125.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0125.900] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), fInfoLevelId=0x0, lpFileInformation=0x266ded4 | out: lpFileInformation=0x266ded4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357)) returned 1
	[0125.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0126.318] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.469] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.518] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.627] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.728] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.774] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0126.827] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.090] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.297] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.393] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.415] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.430] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.481] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.514] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.615] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.639] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.646] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.855] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.950] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0127.953] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0128.007] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0128.069] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0128.096] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0128.156] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.292] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.309] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.357] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.370] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.403] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.433] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.488] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.510] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.531] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.595] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.658] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.674] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.676] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.677] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.678] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.679] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.679] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.680] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.684] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.695] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.696] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.708] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.715] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.902] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.905] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.907] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.907] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.909] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.910] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.910] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.912] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.913] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.916] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.940] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.942] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.943] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.945] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.952] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.978] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.039] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.047] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.157] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.159] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.160] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.179] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.201] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.205] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.218] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.243] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.275] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.279] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.284] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.305] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.318] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.318] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.319] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.323] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.115] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.117] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.118] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.119] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.120] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.120] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.125] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.125] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.125] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.126] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.126] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.127] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.127] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.129] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.133] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.135] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.136] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.136] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.137] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.142] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.146] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.248] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.321] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.323] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.324] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.325] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.325] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.326] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.327] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.328] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.330] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.330] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.331] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.343] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.347] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.347] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.348] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.355] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.364] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.364] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.365] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.365] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.366] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.366] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.367] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.369] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.369] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.370] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.370] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.370] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.370] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.377] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.377] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.378] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", lpFilePart=0x0) returned 0x52
	[0133.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0133.386] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0133.386] GetFileType (hFile=0x5dc) returned 0x1
	[0133.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0133.387] GetFileType (hFile=0x5dc) returned 0x1
	[0133.387] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xb4b
	[0133.387] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a9934, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26a9934*, lpNumberOfBytesRead=0x55cf1fc*=0xb4b, lpOverlapped=0x0) returned 1
	[0133.575] CloseHandle (hObject=0x5dc) returned 1
	[0133.575] CryptDestroyKey (hKey=0x82b100) returned 1
	[0133.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.575] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26aa9d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0133.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.575] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0133.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.575] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26aaa88*=0x1, dwFlags=0x0) returned 1
	[0133.575] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26aaa54, dwFlags=0x0) returned 1
	[0133.576] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26aaa98*, pdwDataLen=0x55cf204*=0xb50, dwBufLen=0xb50 | out: pbData=0x26aaa98*, pdwDataLen=0x55cf204*=0xb50) returned 1
	[0133.576] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ab5f4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26ab5f4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0133.576] CryptDestroyKey (hKey=0x82b280) returned 1
	[0133.576] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.576] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.576] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", lpFilePart=0x0) returned 0x52
	[0133.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0133.576] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0133.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0133.578] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", lpFilePart=0x0) returned 0x52
	[0133.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0133.578] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), fInfoLevelId=0x0, lpFileInformation=0x26abc84 | out: lpFileInformation=0x26abc84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b)) returned 1
	[0133.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0133.580] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", lpFilePart=0x0) returned 0x52
	[0133.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0133.580] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0133.580] GetFileType (hFile=0x5dc) returned 0x1
	[0133.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0133.580] GetFileType (hFile=0x5dc) returned 0x1
	[0133.580] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xb4b
	[0133.580] ReadFile (in: hFile=0x5dc, lpBuffer=0x26acad4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26acad4*, lpNumberOfBytesRead=0x55cf1fc*=0xb4b, lpOverlapped=0x0) returned 1
	[0133.595] CloseHandle (hObject=0x5dc) returned 1
	[0133.595] CryptDestroyKey (hKey=0x82b400) returned 1
	[0133.595] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.595] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26adb70, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0133.595] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.595] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.595] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0133.595] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.595] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26adc28*=0x1, dwFlags=0x0) returned 1
	[0133.596] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26adbf4, dwFlags=0x0) returned 1
	[0133.596] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26adc38*, pdwDataLen=0x55cf204*=0xb50, dwBufLen=0xb50 | out: pbData=0x26adc38*, pdwDataLen=0x55cf204*=0xb50) returned 1
	[0133.596] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ae794*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26ae794*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0133.596] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0133.596] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.596] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", lpFilePart=0x0) returned 0x52
	[0133.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0133.596] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0133.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0133.597] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", lpFilePart=0x0) returned 0x40
	[0133.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0133.598] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), fInfoLevelId=0x0, lpFileInformation=0x26aee24 | out: lpFileInformation=0x26aee24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed)) returned 1
	[0133.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0133.598] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", lpFilePart=0x0) returned 0x40
	[0133.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0133.598] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0133.614] GetFileType (hFile=0x5dc) returned 0x1
	[0133.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0133.614] GetFileType (hFile=0x5dc) returned 0x1
	[0133.614] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x3ed
	[0133.614] ReadFile (in: hFile=0x5dc, lpBuffer=0x26af488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26af488*, lpNumberOfBytesRead=0x55cf1fc*=0x3ed, lpOverlapped=0x0) returned 1
	[0133.756] CloseHandle (hObject=0x5dc) returned 1
	[0133.756] CryptDestroyKey (hKey=0x82b280) returned 1
	[0133.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.756] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b0524, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0133.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.756] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0133.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.756] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26b05dc*=0x1, dwFlags=0x0) returned 1
	[0133.756] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26b05a8, dwFlags=0x0) returned 1
	[0133.756] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b05ec*, pdwDataLen=0x55cf204*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x26b05ec*, pdwDataLen=0x55cf204*=0x3f0) returned 1
	[0133.756] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b09e8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26b09e8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0133.756] CryptDestroyKey (hKey=0x82b300) returned 1
	[0133.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.756] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", lpFilePart=0x0) returned 0x40
	[0133.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0133.756] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0133.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0133.758] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", lpFilePart=0x0) returned 0x3f
	[0133.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0133.758] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), fInfoLevelId=0x0, lpFileInformation=0x26b0fc4 | out: lpFileInformation=0x26b0fc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x85f)) returned 1
	[0133.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0133.803] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", lpFilePart=0x0) returned 0x3f
	[0133.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0133.803] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0133.803] GetFileType (hFile=0x5dc) returned 0x1
	[0133.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0133.803] GetFileType (hFile=0x5dc) returned 0x1
	[0133.803] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x85f
	[0133.803] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b1a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26b1a88*, lpNumberOfBytesRead=0x55cf1fc*=0x85f, lpOverlapped=0x0) returned 1
	[0133.804] CloseHandle (hObject=0x5dc) returned 1
	[0133.804] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0133.804] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.804] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b2b24, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0133.805] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.805] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.805] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b200) returned 1
	[0133.805] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.805] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26b2bdc*=0x1, dwFlags=0x0) returned 1
	[0133.805] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26b2ba8, dwFlags=0x0) returned 1
	[0133.805] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b2bec*, pdwDataLen=0x55cf204*=0x860, dwBufLen=0x860 | out: pbData=0x26b2bec*, pdwDataLen=0x55cf204*=0x860) returned 1
	[0133.805] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b3458*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26b3458*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0133.805] CryptDestroyKey (hKey=0x82b200) returned 1
	[0133.805] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.805] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", lpFilePart=0x0) returned 0x3f
	[0133.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0133.805] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0133.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0133.806] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", lpFilePart=0x0) returned 0x49
	[0133.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0133.807] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), fInfoLevelId=0x0, lpFileInformation=0x26b3a24 | out: lpFileInformation=0x26b3a24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd59)) returned 1
	[0133.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0133.810] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", lpFilePart=0x0) returned 0x49
	[0133.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0133.810] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0133.810] GetFileType (hFile=0x5dc) returned 0x1
	[0133.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0133.811] GetFileType (hFile=0x5dc) returned 0x1
	[0133.811] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xd59
	[0133.811] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b4a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26b4a34*, lpNumberOfBytesRead=0x55cf1fc*=0xd59, lpOverlapped=0x0) returned 1
	[0133.812] CloseHandle (hObject=0x5dc) returned 1
	[0133.812] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0133.812] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.812] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b5ad0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0133.812] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.812] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.812] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0133.812] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.812] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26b5b88*=0x1, dwFlags=0x0) returned 1
	[0133.812] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26b5b54, dwFlags=0x0) returned 1
	[0133.812] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b5b98*, pdwDataLen=0x55cf204*=0xd60, dwBufLen=0xd60 | out: pbData=0x26b5b98*, pdwDataLen=0x55cf204*=0xd60) returned 1
	[0133.812] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b6904*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26b6904*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0133.812] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0133.812] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.812] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.813] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", lpFilePart=0x0) returned 0x49
	[0133.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0133.813] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0133.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0133.814] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", lpFilePart=0x0) returned 0x41
	[0133.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0133.814] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), fInfoLevelId=0x0, lpFileInformation=0x26b6f34 | out: lpFileInformation=0x26b6f34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa2e)) returned 1
	[0133.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0133.863] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", lpFilePart=0x0) returned 0x41
	[0133.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0133.863] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0133.863] GetFileType (hFile=0x5dc) returned 0x1
	[0133.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0133.864] GetFileType (hFile=0x5dc) returned 0x1
	[0133.864] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xa2e
	[0133.864] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b7bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26b7bd8*, lpNumberOfBytesRead=0x55cf1fc*=0xa2e, lpOverlapped=0x0) returned 1
	[0133.865] CloseHandle (hObject=0x5dc) returned 1
	[0133.865] CryptDestroyKey (hKey=0x82b400) returned 1
	[0133.865] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.865] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b8c74, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0133.865] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.865] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.866] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0133.866] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.866] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26b8d2c*=0x1, dwFlags=0x0) returned 1
	[0133.866] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26b8cf8, dwFlags=0x0) returned 1
	[0133.866] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b8d3c*, pdwDataLen=0x55cf204*=0xa30, dwBufLen=0xa30 | out: pbData=0x26b8d3c*, pdwDataLen=0x55cf204*=0xa30) returned 1
	[0133.866] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b9778*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26b9778*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0133.866] CryptDestroyKey (hKey=0x82b300) returned 1
	[0133.866] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.866] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.866] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", lpFilePart=0x0) returned 0x41
	[0133.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0133.866] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0133.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0133.868] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", lpFilePart=0x0) returned 0x38
	[0133.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0133.868] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), fInfoLevelId=0x0, lpFileInformation=0x26b9d58 | out: lpFileInformation=0x26b9d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c)) returned 1
	[0133.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0133.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", lpFilePart=0x0) returned 0x38
	[0133.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0133.869] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0133.869] GetFileType (hFile=0x5dc) returned 0x1
	[0133.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0133.869] GetFileType (hFile=0x5dc) returned 0x1
	[0133.870] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x37c
	[0133.870] ReadFile (in: hFile=0x5dc, lpBuffer=0x26ba308, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26ba308*, lpNumberOfBytesRead=0x55cf1fc*=0x37c, lpOverlapped=0x0) returned 1
	[0133.951] CloseHandle (hObject=0x5dc) returned 1
	[0133.951] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0133.952] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.952] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bb3a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0133.952] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.952] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.952] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0133.952] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0133.952] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26bb45c*=0x1, dwFlags=0x0) returned 1
	[0133.952] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26bb428, dwFlags=0x0) returned 1
	[0133.952] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bb46c*, pdwDataLen=0x55cf204*=0x380, dwBufLen=0x380 | out: pbData=0x26bb46c*, pdwDataLen=0x55cf204*=0x380) returned 1
	[0133.952] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bb7f8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26bb7f8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0133.952] CryptDestroyKey (hKey=0x82b300) returned 1
	[0133.952] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.952] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0133.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", lpFilePart=0x0) returned 0x38
	[0133.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0133.952] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0133.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0133.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1", lpFilePart=0x0) returned 0x3f
	[0133.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0133.954] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\programdata\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1"), fInfoLevelId=0x0, lpFileInformation=0x26bbd84 | out: lpFileInformation=0x26bbd84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147)) returned 1
	[0134.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0134.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1", lpFilePart=0x0) returned 0x3f
	[0134.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0134.001] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\programdata\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.002] GetFileType (hFile=0x5dc) returned 0x1
	[0134.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0134.002] GetFileType (hFile=0x5dc) returned 0x1
	[0134.002] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x147
	[0134.002] ReadFile (in: hFile=0x5dc, lpBuffer=0x26bc150, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26bc150*, lpNumberOfBytesRead=0x55cf1fc*=0x147, lpOverlapped=0x0) returned 1
	[0134.002] CloseHandle (hObject=0x5dc) returned 1
	[0134.003] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0134.003] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.003] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bd1ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b000) returned 1
	[0134.003] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.003] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.003] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0134.003] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.003] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26bd2a4*=0x1, dwFlags=0x0) returned 1
	[0134.003] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26bd270, dwFlags=0x0) returned 1
	[0134.003] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bd2b4*, pdwDataLen=0x55cf204*=0x150, dwBufLen=0x150 | out: pbData=0x26bd2b4*, pdwDataLen=0x55cf204*=0x150) returned 1
	[0134.003] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bd410*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26bd410*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0134.003] CryptDestroyKey (hKey=0x82b540) returned 1
	[0134.003] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.003] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.003] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1", lpFilePart=0x0) returned 0x3f
	[0134.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0134.003] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\programdata\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0134.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0134.005] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", lpFilePart=0x0) returned 0x43
	[0134.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0134.005] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), fInfoLevelId=0x0, lpFileInformation=0x26bd9ec | out: lpFileInformation=0x26bd9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x25ec)) returned 1
	[0134.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0134.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", lpFilePart=0x0) returned 0x43
	[0134.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0134.042] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.043] GetFileType (hFile=0x5dc) returned 0x1
	[0134.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0134.043] GetFileType (hFile=0x5dc) returned 0x1
	[0134.043] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x25ec
	[0134.043] ReadFile (in: hFile=0x5dc, lpBuffer=0x26bdc7c, nNumberOfBytesToRead=0x25ec, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26bdc7c*, lpNumberOfBytesRead=0x55cf1fc*=0x25ec, lpOverlapped=0x0) returned 1
	[0134.143] CloseHandle (hObject=0x5dc) returned 1
	[0134.143] CryptDestroyKey (hKey=0x82b000) returned 1
	[0134.143] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.143] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c0304, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0134.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.143] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0134.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.143] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26c03bc*=0x1, dwFlags=0x0) returned 1
	[0134.143] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26c0388, dwFlags=0x0) returned 1
	[0134.143] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c03cc*, pdwDataLen=0x55cf204*=0x25f0, dwBufLen=0x25f0 | out: pbData=0x26c03cc*, pdwDataLen=0x55cf204*=0x25f0) returned 1
	[0134.143] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c29c8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26c29c8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0134.144] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0134.144] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.144] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", lpFilePart=0x0) returned 0x43
	[0134.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0134.144] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0134.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0134.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", lpFilePart=0x0) returned 0x47
	[0134.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0134.145] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), fInfoLevelId=0x0, lpFileInformation=0x26c2fc8 | out: lpFileInformation=0x26c2fc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c20)) returned 1
	[0134.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0134.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", lpFilePart=0x0) returned 0x47
	[0134.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0134.146] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.146] GetFileType (hFile=0x5dc) returned 0x1
	[0134.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0134.146] GetFileType (hFile=0x5dc) returned 0x1
	[0134.146] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c20
	[0134.146] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c3278, nNumberOfBytesToRead=0x2c20, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26c3278*, lpNumberOfBytesRead=0x55cf1fc*=0x2c20, lpOverlapped=0x0) returned 1
	[0134.300] CloseHandle (hObject=0x5dc) returned 1
	[0134.300] CryptDestroyKey (hKey=0x82b300) returned 1
	[0134.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.300] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c5f34, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0134.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.300] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0134.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.300] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26c5fec*=0x1, dwFlags=0x0) returned 1
	[0134.300] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26c5fb8, dwFlags=0x0) returned 1
	[0134.301] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c5ffc*, pdwDataLen=0x55cf204*=0x2c30, dwBufLen=0x2c30 | out: pbData=0x26c5ffc*, pdwDataLen=0x55cf204*=0x2c30) returned 1
	[0134.301] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c8c38*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26c8c38*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0134.301] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0134.301] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.301] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.301] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", lpFilePart=0x0) returned 0x47
	[0134.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0134.301] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0134.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0134.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", lpFilePart=0x0) returned 0x48
	[0134.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0134.303] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), fInfoLevelId=0x0, lpFileInformation=0x26c9260 | out: lpFileInformation=0x26c9260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724)) returned 1
	[0134.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0134.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", lpFilePart=0x0) returned 0x48
	[0134.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0134.304] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.304] GetFileType (hFile=0x5dc) returned 0x1
	[0134.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0134.304] GetFileType (hFile=0x5dc) returned 0x1
	[0134.304] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x3724
	[0134.304] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c9518, nNumberOfBytesToRead=0x3724, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26c9518*, lpNumberOfBytesRead=0x55cf1fc*=0x3724, lpOverlapped=0x0) returned 1
	[0134.365] CloseHandle (hObject=0x5dc) returned 1
	[0134.365] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0134.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.365] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26cccd8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b0c0) returned 1
	[0134.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.365] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0134.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.366] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26ccd90*=0x1, dwFlags=0x0) returned 1
	[0134.366] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26ccd5c, dwFlags=0x0) returned 1
	[0134.366] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ccda0*, pdwDataLen=0x55cf204*=0x3730, dwBufLen=0x3730 | out: pbData=0x26ccda0*, pdwDataLen=0x55cf204*=0x3730) returned 1
	[0134.366] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d04dc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26d04dc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0134.366] CryptDestroyKey (hKey=0x82b300) returned 1
	[0134.366] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.366] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.366] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", lpFilePart=0x0) returned 0x48
	[0134.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0134.366] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0134.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cdb20) returned 1
	[0134.368] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", lpFilePart=0x0) returned 0x6d
	[0134.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0134.368] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), fInfoLevelId=0x0, lpFileInformation=0x26d0b10 | out: lpFileInformation=0x26d0b10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9e)) returned 1
	[0134.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0134.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", lpFilePart=0x0) returned 0x6d
	[0134.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0134.369] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.369] GetFileType (hFile=0x5dc) returned 0x1
	[0134.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0134.369] GetFileType (hFile=0x5dc) returned 0x1
	[0134.369] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x9e
	[0134.369] ReadFile (in: hFile=0x5dc, lpBuffer=0x26d0f24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26d0f24*, lpNumberOfBytesRead=0x55cf1fc*=0x9e, lpOverlapped=0x0) returned 1
	[0134.370] CloseHandle (hObject=0x5dc) returned 1
	[0134.370] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0134.370] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.370] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d1fc0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0134.370] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.370] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.370] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0134.370] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.370] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26d2078*=0x1, dwFlags=0x0) returned 1
	[0134.371] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26d2044, dwFlags=0x0) returned 1
	[0134.371] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d2088*, pdwDataLen=0x55cf204*=0xa0, dwBufLen=0xa0 | out: pbData=0x26d2088*, pdwDataLen=0x55cf204*=0xa0) returned 1
	[0134.371] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d2134*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26d2134*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0134.371] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0134.371] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.371] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.371] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", lpFilePart=0x0) returned 0x6d
	[0134.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0134.371] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.372] GetFileType (hFile=0x5dc) returned 0x1
	[0134.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0134.372] GetFileType (hFile=0x5dc) returned 0x1
	[0134.372] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d22f4*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26d22f4*, lpNumberOfBytesWritten=0x55cf1c4*=0xa0, lpOverlapped=0x0) returned 1
	[0134.374] CloseHandle (hObject=0x5dc) returned 1
	[0134.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", lpFilePart=0x0) returned 0x6d
	[0134.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9c
	[0134.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0134.374] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8a6d39e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xa0)) returned 1
	[0134.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0134.374] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), lpNewFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0134.375] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", lpFilePart=0x0) returned 0x6d
	[0134.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0134.375] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), fInfoLevelId=0x0, lpFileInformation=0x26d3788 | out: lpFileInformation=0x26d3788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x6e)) returned 1
	[0134.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0134.376] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", lpFilePart=0x0) returned 0x6d
	[0134.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0134.376] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.376] GetFileType (hFile=0x5dc) returned 0x1
	[0134.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0134.376] GetFileType (hFile=0x5dc) returned 0x1
	[0134.376] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x6e
	[0134.376] ReadFile (in: hFile=0x5dc, lpBuffer=0x26d3b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26d3b6c*, lpNumberOfBytesRead=0x55cf1fc*=0x6e, lpOverlapped=0x0) returned 1
	[0134.377] CloseHandle (hObject=0x5dc) returned 1
	[0134.377] CryptDestroyKey (hKey=0x82b340) returned 1
	[0134.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.377] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d4c08, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0134.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.377] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0134.377] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.377] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26d4cc0*=0x1, dwFlags=0x0) returned 1
	[0134.378] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26d4c8c, dwFlags=0x0) returned 1
	[0134.378] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d4cd0*, pdwDataLen=0x55cf204*=0x70, dwBufLen=0x70 | out: pbData=0x26d4cd0*, pdwDataLen=0x55cf204*=0x70) returned 1
	[0134.378] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d4d4c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26d4d4c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0134.378] CryptDestroyKey (hKey=0x82b340) returned 1
	[0134.378] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.378] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.378] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", lpFilePart=0x0) returned 0x6d
	[0134.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0134.378] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.379] GetFileType (hFile=0x5dc) returned 0x1
	[0134.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0134.379] GetFileType (hFile=0x5dc) returned 0x1
	[0134.379] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d4f0c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26d4f0c*, lpNumberOfBytesWritten=0x55cf1c4*=0x70, lpOverlapped=0x0) returned 1
	[0134.380] CloseHandle (hObject=0x5dc) returned 1
	[0134.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", lpFilePart=0x0) returned 0x6d
	[0134.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9c
	[0134.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0134.381] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8a6d39e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
	[0134.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0134.381] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), lpNewFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0134.382] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", lpFilePart=0x0) returned 0x6d
	[0134.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0134.382] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), fInfoLevelId=0x0, lpFileInformation=0x26d63a0 | out: lpFileInformation=0x26d63a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x106)) returned 1
	[0134.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0134.382] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", lpFilePart=0x0) returned 0x6d
	[0134.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0134.382] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.382] GetFileType (hFile=0x5dc) returned 0x1
	[0134.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0134.383] GetFileType (hFile=0x5dc) returned 0x1
	[0134.383] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x106
	[0134.383] ReadFile (in: hFile=0x5dc, lpBuffer=0x26d681c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26d681c*, lpNumberOfBytesRead=0x55cf1fc*=0x106, lpOverlapped=0x0) returned 1
	[0134.385] CloseHandle (hObject=0x5dc) returned 1
	[0134.385] CryptDestroyKey (hKey=0x82b540) returned 1
	[0134.385] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.385] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d78b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b100) returned 1
	[0134.385] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.385] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.385] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0134.385] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.385] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26d7970*=0x1, dwFlags=0x0) returned 1
	[0134.385] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26d793c, dwFlags=0x0) returned 1
	[0134.385] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d7980*, pdwDataLen=0x55cf204*=0x110, dwBufLen=0x110 | out: pbData=0x26d7980*, pdwDataLen=0x55cf204*=0x110) returned 1
	[0134.385] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d7a9c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26d7a9c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0134.385] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0134.385] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.385] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", lpFilePart=0x0) returned 0x6d
	[0134.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0134.386] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.387] GetFileType (hFile=0x5dc) returned 0x1
	[0134.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0134.387] GetFileType (hFile=0x5dc) returned 0x1
	[0134.387] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d7c5c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26d7c5c*, lpNumberOfBytesWritten=0x55cf1c4*=0x110, lpOverlapped=0x0) returned 1
	[0134.388] CloseHandle (hObject=0x5dc) returned 1
	[0134.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", lpFilePart=0x0) returned 0x6d
	[0134.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9c
	[0134.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0134.389] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8a6d39e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0134.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0134.389] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), lpNewFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0134.390] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", lpFilePart=0x0) returned 0x4f
	[0134.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0134.390] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), fInfoLevelId=0x0, lpFileInformation=0x26d90f0 | out: lpFileInformation=0x26d90f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc)) returned 1
	[0134.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0134.390] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", lpFilePart=0x0) returned 0x4f
	[0134.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0134.390] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.391] GetFileType (hFile=0x5dc) returned 0x1
	[0134.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0134.391] GetFileType (hFile=0x5dc) returned 0x1
	[0134.391] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1bc
	[0134.391] ReadFile (in: hFile=0x5dc, lpBuffer=0x26d9530, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26d9530*, lpNumberOfBytesRead=0x55cf1fc*=0x1bc, lpOverlapped=0x0) returned 1
	[0134.392] CloseHandle (hObject=0x5dc) returned 1
	[0134.392] CryptDestroyKey (hKey=0x82b100) returned 1
	[0134.392] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.392] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26da5cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b200) returned 1
	[0134.392] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.392] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.392] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0134.392] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.392] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26da684*=0x1, dwFlags=0x0) returned 1
	[0134.392] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26da650, dwFlags=0x0) returned 1
	[0134.392] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26da694*, pdwDataLen=0x55cf204*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x26da694*, pdwDataLen=0x55cf204*=0x1c0) returned 1
	[0134.392] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26da860*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26da860*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0134.410] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0134.410] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.410] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.411] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", lpFilePart=0x0) returned 0x4f
	[0134.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0134.411] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.412] GetFileType (hFile=0x5dc) returned 0x1
	[0134.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0134.412] GetFileType (hFile=0x5dc) returned 0x1
	[0134.412] WriteFile (in: hFile=0x5dc, lpBuffer=0x26da9a8*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26da9a8*, lpNumberOfBytesWritten=0x55cf1c4*=0x1c0, lpOverlapped=0x0) returned 1
	[0134.413] CloseHandle (hObject=0x5dc) returned 1
	[0134.413] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", lpFilePart=0x0) returned 0x4f
	[0134.413] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7e
	[0134.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0134.413] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8a71fd5c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1c0)) returned 1
	[0134.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0134.414] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), lpNewFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0134.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", lpFilePart=0x0) returned 0x47
	[0134.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0134.416] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), fInfoLevelId=0x0, lpFileInformation=0x26dbd4c | out: lpFileInformation=0x26dbd4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33)) returned 1
	[0134.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0134.437] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", lpFilePart=0x0) returned 0x47
	[0134.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0134.438] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.438] GetFileType (hFile=0x5dc) returned 0x1
	[0134.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0134.438] GetFileType (hFile=0x5dc) returned 0x1
	[0134.438] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x33
	[0134.438] ReadFile (in: hFile=0x5dc, lpBuffer=0x26dc024, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26dc024*, lpNumberOfBytesRead=0x55cf1fc*=0x33, lpOverlapped=0x0) returned 1
	[0134.439] CloseHandle (hObject=0x5dc) returned 1
	[0134.439] CryptDestroyKey (hKey=0x82b200) returned 1
	[0134.439] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.439] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26dd0c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0134.439] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.439] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.439] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0134.439] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0134.439] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26dd178*=0x1, dwFlags=0x0) returned 1
	[0134.439] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26dd144, dwFlags=0x0) returned 1
	[0134.439] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26dd188*, pdwDataLen=0x55cf204*=0x40, dwBufLen=0x40 | out: pbData=0x26dd188*, pdwDataLen=0x55cf204*=0x40) returned 1
	[0134.440] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dd1d4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26dd1d4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0134.440] CryptDestroyKey (hKey=0x82b540) returned 1
	[0134.440] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.440] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0134.440] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", lpFilePart=0x0) returned 0x47
	[0134.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0134.440] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.441] GetFileType (hFile=0x5dc) returned 0x1
	[0134.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0134.441] GetFileType (hFile=0x5dc) returned 0x1
	[0134.441] WriteFile (in: hFile=0x5dc, lpBuffer=0x26dd32c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26dd32c*, lpNumberOfBytesWritten=0x55cf1c4*=0x40, lpOverlapped=0x0) returned 1
	[0134.442] CloseHandle (hObject=0x5dc) returned 1
	[0134.442] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", lpFilePart=0x0) returned 0x47
	[0134.442] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x76
	[0134.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0134.443] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8a76c3ca, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1
	[0134.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0134.443] MoveFileW (lpExistingFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), lpNewFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0134.444] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFilePart=0x0) returned 0x39
	[0134.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0134.444] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\programdata\\oracle\\java\\installcache_x64\\baseimagefam8"), fInfoLevelId=0x0, lpFileInformation=0x26de690 | out: lpFileInformation=0x26de690*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475)) returned 1
	[0134.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0134.445] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFilePart=0x0) returned 0x39
	[0134.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0134.445] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\programdata\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0134.445] GetFileType (hFile=0x5dc) returned 0x1
	[0134.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0134.445] GetFileType (hFile=0x5dc) returned 0x1
	[0134.445] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x4eba475
	[0134.850] ReadFile (in: hFile=0x5dc, lpBuffer=0x9ea1018, nNumberOfBytesToRead=0x4eba475, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x9ea1018*, lpNumberOfBytesRead=0x55cf1fc*=0x4eba475, lpOverlapped=0x0) returned 1
	[0150.218] CloseHandle (hObject=0x5dc) returned 1
	[0150.218] CryptDestroyKey (hKey=0x82b400) returned 1
	[0150.218] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0150.218] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26de948, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0150.218] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0150.218] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0150.218] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0150.218] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0150.218] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26dea00*=0x1, dwFlags=0x0) returned 1
	[0150.218] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26de9cc, dwFlags=0x0) returned 1
	[0150.661] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xeea1018*, pdwDataLen=0x55cf204*=0x4eba480, dwBufLen=0x4eba480 | out: pbData=0xeea1018*, pdwDataLen=0x55cf204*=0x4eba480) returned 1
	[0150.727] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dea10*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26dea10*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0150.727] CryptDestroyKey (hKey=0x82b280) returned 1
	[0150.727] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0150.727] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0150.727] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFilePart=0x0) returned 0x39
	[0150.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0150.727] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\programdata\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0151.002] GetFileType (hFile=0x5dc) returned 0x1
	[0151.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0151.002] GetFileType (hFile=0x5dc) returned 0x1
	[0151.002] WriteFile (in: hFile=0x5dc, lpBuffer=0xeea1018*, nNumberOfBytesToWrite=0x4eba480, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0xeea1018*, lpNumberOfBytesWritten=0x55cf1f0*=0x4eba480, lpOverlapped=0x0) returned 1
	[0155.145] CloseHandle (hObject=0x5dc) returned 1
	[0155.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFilePart=0x0) returned 0x39
	[0155.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0155.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0155.145] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\programdata\\oracle\\java\\installcache_x64\\baseimagefam8"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x96cd5b08, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4eba480)) returned 1
	[0155.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0155.145] MoveFileW (lpExistingFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\programdata\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\oracle\\java\\installcache_x64\\baseimagefam8 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0155.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe", lpFilePart=0x0) returned 0x2c
	[0155.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0155.146] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\programdata\\oracle\\java\\javapath\\java.exe"), fInfoLevelId=0x0, lpFileInformation=0x26dee18 | out: lpFileInformation=0x26dee18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840)) returned 1
	[0155.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0155.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.221] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.261] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.358] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.652] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.089] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.230] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.328] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.699] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.988] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0157.082] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0160.868] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0160.972] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.207] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.331] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.474] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.519] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.644] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.957] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.003] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.207] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.304] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.348] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.381] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.566] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x6c
	[0166.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0166.566] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0166.566] GetFileType (hFile=0x318) returned 0x1
	[0166.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0166.566] GetFileType (hFile=0x318) returned 0x1
	[0166.566] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x564f
	[0166.566] ReadFile (in: hFile=0x318, lpBuffer=0x26028cc, nNumberOfBytesToRead=0x564f, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26028cc*, lpNumberOfBytesRead=0x55cf1fc*=0x564f, lpOverlapped=0x0) returned 1
	[0166.583] CloseHandle (hObject=0x318) returned 1
	[0166.583] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0166.583] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0166.583] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2607fb8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0166.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0166.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0166.583] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0166.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0166.583] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2608070*=0x1, dwFlags=0x0) returned 1
	[0166.583] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x260803c, dwFlags=0x0) returned 1
	[0166.583] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2608080*, pdwDataLen=0x55cf204*=0x5650, dwBufLen=0x5650 | out: pbData=0x2608080*, pdwDataLen=0x55cf204*=0x5650) returned 1
	[0166.583] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260d6dc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x260d6dc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0166.583] CryptDestroyKey (hKey=0x82b100) returned 1
	[0166.583] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0166.583] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0166.583] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x6c
	[0166.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0166.583] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0166.585] GetFileType (hFile=0x318) returned 0x1
	[0166.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0166.585] GetFileType (hFile=0x318) returned 0x1
	[0166.585] WriteFile (in: hFile=0x318, lpBuffer=0x2608080*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2608080*, lpNumberOfBytesWritten=0x55cf1f0*=0x5650, lpOverlapped=0x0) returned 1
	[0166.586] CloseHandle (hObject=0x318) returned 1
	[0166.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x6c
	[0166.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9b
	[0166.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0166.586] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x9d9ec2d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5650)) returned 1
	[0166.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0166.586] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0166.587] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash", lpFilePart=0x0) returned 0x5e
	[0166.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0166.587] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash"), fInfoLevelId=0x0, lpFileInformation=0x260dcfc | out: lpFileInformation=0x260dcfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66)) returned 1
	[0166.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0166.589] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash", lpFilePart=0x0) returned 0x5e
	[0166.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0166.590] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0166.590] GetFileType (hFile=0x318) returned 0x1
	[0166.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0166.590] GetFileType (hFile=0x318) returned 0x1
	[0166.590] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x66
	[0166.590] ReadFile (in: hFile=0x318, lpBuffer=0x260e030, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x260e030*, lpNumberOfBytesRead=0x55cf1fc*=0x66, lpOverlapped=0x0) returned 1
	[0166.591] CloseHandle (hObject=0x318) returned 1
	[0166.591] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0166.591] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0166.591] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260f0cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b480) returned 1
	[0166.591] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0166.591] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0166.591] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0166.591] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0166.591] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x260f184*=0x1, dwFlags=0x0) returned 1
	[0166.591] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x260f150, dwFlags=0x0) returned 1
	[0166.591] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260f194*, pdwDataLen=0x55cf204*=0x70, dwBufLen=0x70 | out: pbData=0x260f194*, pdwDataLen=0x55cf204*=0x70) returned 1
	[0166.591] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260f210*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x260f210*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0166.592] CryptDestroyKey (hKey=0x82b340) returned 1
	[0166.592] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0166.592] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0166.592] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash", lpFilePart=0x0) returned 0x5e
	[0166.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0166.592] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0166.593] GetFileType (hFile=0x318) returned 0x1
	[0166.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0166.593] GetFileType (hFile=0x318) returned 0x1
	[0166.593] WriteFile (in: hFile=0x318, lpBuffer=0x260f37c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x260f37c*, lpNumberOfBytesWritten=0x55cf1c4*=0x70, lpOverlapped=0x0) returned 1
	[0166.593] CloseHandle (hObject=0x318) returned 1
	[0166.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash", lpFilePart=0x0) returned 0x5e
	[0166.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8d
	[0166.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0166.594] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x9da12475, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
	[0166.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0166.594] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0166.595] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a
	[0166.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0166.595] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x2610794 | out: lpFileInformation=0x2610794*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4)) returned 1
	[0166.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0166.597] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a
	[0166.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0166.597] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0166.597] GetFileType (hFile=0x318) returned 0x1
	[0166.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0166.597] GetFileType (hFile=0x318) returned 0x1
	[0166.597] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0xd77c4
	[0167.650] ReadFile (in: hFile=0x318, lpBuffer=0x34494c8, nNumberOfBytesToRead=0xd77c4, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesRead=0x55cf1fc*=0xd77c4, lpOverlapped=0x0) returned 1
	[0167.746] CloseHandle (hObject=0x318) returned 1
	[0167.746] CryptDestroyKey (hKey=0x82b480) returned 1
	[0167.746] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0167.746] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2600fec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0167.746] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0167.746] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0167.746] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0167.746] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0167.746] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26010a4*=0x1, dwFlags=0x0) returned 1
	[0167.746] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2601070, dwFlags=0x0) returned 1
	[0167.759] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3520ca8*, pdwDataLen=0x55cf204*=0xd77d0, dwBufLen=0xd77d0 | out: pbData=0x3520ca8*, pdwDataLen=0x55cf204*=0xd77d0) returned 1
	[0167.759] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26010b4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26010b4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0167.760] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0167.760] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0167.760] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0167.760] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a
	[0167.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0167.760] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0167.769] GetFileType (hFile=0x318) returned 0x1
	[0167.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0167.769] GetFileType (hFile=0x318) returned 0x1
	[0167.769] WriteFile (in: hFile=0x318, lpBuffer=0x3520ca8*, nNumberOfBytesToWrite=0xd77d0, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x3520ca8*, lpNumberOfBytesWritten=0x55cf1f0*=0xd77d0, lpOverlapped=0x0) returned 1
	[0167.819] CloseHandle (hObject=0x318) returned 1
	[0167.819] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a
	[0167.820] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x99
	[0167.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0167.820] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x9e5b4b97, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xd77d0)) returned 1
	[0167.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0167.820] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0167.821] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x6e
	[0167.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0167.821] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x26027c8 | out: lpFileInformation=0x26027c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211)) returned 1
	[0167.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0167.821] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x6e
	[0167.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0167.822] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0167.822] GetFileType (hFile=0x318) returned 0x1
	[0167.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0167.822] GetFileType (hFile=0x318) returned 0x1
	[0167.822] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x5211
	[0167.822] ReadFile (in: hFile=0x318, lpBuffer=0x2602b00, nNumberOfBytesToRead=0x5211, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2602b00*, lpNumberOfBytesRead=0x55cf1fc*=0x5211, lpOverlapped=0x0) returned 1
	[0167.865] CloseHandle (hObject=0x318) returned 1
	[0167.865] CryptDestroyKey (hKey=0x82b380) returned 1
	[0167.865] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0167.866] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2607db0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b000) returned 1
	[0167.866] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0167.866] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0167.866] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0167.866] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0167.866] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2607e68*=0x1, dwFlags=0x0) returned 1
	[0167.866] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2607e34, dwFlags=0x0) returned 1
	[0167.866] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2607e78*, pdwDataLen=0x55cf204*=0x5220, dwBufLen=0x5220 | out: pbData=0x2607e78*, pdwDataLen=0x55cf204*=0x5220) returned 1
	[0167.866] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260d0a4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x260d0a4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0167.866] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0167.866] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0167.866] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0167.866] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x6e
	[0167.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0167.866] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0167.868] GetFileType (hFile=0x318) returned 0x1
	[0167.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0167.868] GetFileType (hFile=0x318) returned 0x1
	[0167.868] WriteFile (in: hFile=0x318, lpBuffer=0x2607e78*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x2607e78*, lpNumberOfBytesWritten=0x55cf1f0*=0x5220, lpOverlapped=0x0) returned 1
	[0167.869] CloseHandle (hObject=0x318) returned 1
	[0167.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x6e
	[0167.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9d
	[0167.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0167.869] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x9e627236, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5220)) returned 1
	[0167.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0167.870] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0167.870] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash", lpFilePart=0x0) returned 0x5c
	[0167.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0167.870] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash"), fInfoLevelId=0x0, lpFileInformation=0x260d6d8 | out: lpFileInformation=0x260d6d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66)) returned 1
	[0167.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0167.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash", lpFilePart=0x0) returned 0x5c
	[0167.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0167.871] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0167.872] GetFileType (hFile=0x318) returned 0x1
	[0167.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0167.872] GetFileType (hFile=0x318) returned 0x1
	[0167.872] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x66
	[0167.872] ReadFile (in: hFile=0x318, lpBuffer=0x260f11c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x260f11c*, lpNumberOfBytesRead=0x55cf1fc*=0x66, lpOverlapped=0x0) returned 1
	[0167.873] CloseHandle (hObject=0x318) returned 1
	[0167.873] CryptDestroyKey (hKey=0x82b000) returned 1
	[0167.873] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0167.873] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26101b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0167.873] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0167.873] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0167.873] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0167.873] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0167.873] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2610270*=0x1, dwFlags=0x0) returned 1
	[0167.873] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x261023c, dwFlags=0x0) returned 1
	[0167.874] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2610280*, pdwDataLen=0x55cf204*=0x70, dwBufLen=0x70 | out: pbData=0x2610280*, pdwDataLen=0x55cf204*=0x70) returned 1
	[0167.874] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26102fc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26102fc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0167.874] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0167.874] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0167.874] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0167.874] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash", lpFilePart=0x0) returned 0x5c
	[0167.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0167.874] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0167.875] GetFileType (hFile=0x318) returned 0x1
	[0167.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0167.875] GetFileType (hFile=0x318) returned 0x1
	[0167.875] WriteFile (in: hFile=0x318, lpBuffer=0x2610ab4*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2610ab4*, lpNumberOfBytesWritten=0x55cf1c4*=0x70, lpOverlapped=0x0) returned 1
	[0167.876] CloseHandle (hObject=0x318) returned 1
	[0167.876] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash", lpFilePart=0x0) returned 0x5c
	[0167.876] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8b
	[0167.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0167.876] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x9e64d3f0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
	[0167.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0167.877] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0167.877] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c
	[0167.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0167.877] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x2611ebc | out: lpFileInformation=0x2611ebc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a)) returned 1
	[0167.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0167.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c
	[0167.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0167.878] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0167.878] GetFileType (hFile=0x318) returned 0x1
	[0167.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0167.878] GetFileType (hFile=0x318) returned 0x1
	[0167.878] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x38480a
	[0167.887] ReadFile (in: hFile=0x318, lpBuffer=0x35f8498, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x35f8498*, lpNumberOfBytesRead=0x55cf1fc*=0x38480a, lpOverlapped=0x0) returned 1
	[0168.148] CloseHandle (hObject=0x318) returned 1
	[0168.148] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0168.148] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.148] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2612274, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b4c0) returned 1
	[0168.148] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.148] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.148] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0168.148] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.149] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x261232c*=0x1, dwFlags=0x0) returned 1
	[0168.149] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26122f8, dwFlags=0x0) returned 1
	[0168.260] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x397ccc0*, pdwDataLen=0x55cf204*=0x384810, dwBufLen=0x384810 | out: pbData=0x397ccc0*, pdwDataLen=0x55cf204*=0x384810) returned 1
	[0168.262] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2600f5c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2600f5c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0168.263] CryptDestroyKey (hKey=0x82b540) returned 1
	[0168.282] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.282] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.282] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c
	[0168.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0168.282] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.288] GetFileType (hFile=0x318) returned 0x1
	[0168.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0168.288] GetFileType (hFile=0x318) returned 0x1
	[0168.288] WriteFile (in: hFile=0x318, lpBuffer=0x397ccc0*, nNumberOfBytesToWrite=0x384810, lpNumberOfBytesWritten=0x55cf1f0, lpOverlapped=0x0 | out: lpBuffer=0x397ccc0*, lpNumberOfBytesWritten=0x55cf1f0*=0x384810, lpOverlapped=0x0) returned 1
	[0168.374] CloseHandle (hObject=0x318) returned 1
	[0168.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c
	[0168.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9b
	[0168.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0168.374] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x9eb11fd6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x384810)) returned 1
	[0168.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0168.374] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0168.375] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x6c
	[0168.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0168.375] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x260259c | out: lpFileInformation=0x260259c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd7b21800, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x564f)) returned 1
	[0168.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0168.394] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.396] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.397] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.139] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.176] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.260] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.274] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.276] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.276] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.291] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.292] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.295] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.296] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.298] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.299] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.302] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.303] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.353] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.363] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.364] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.366] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.367] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.502] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.135] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.201] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.248] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.334] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.451] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.472] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.476] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.495] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.497] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.500] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.540] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.543] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.543] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.237] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.255] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.258] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.259] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.263] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.264] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.266] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.270] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.272] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.275] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.277] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.327] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.350] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.357] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.452] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.470] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.473] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.474] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.478] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.481] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.484] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.485] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.487] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.488] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.491] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.492] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.540] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.615] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.617] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.624] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.627] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.629] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.631] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.632] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.646] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.647] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.650] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.660] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.661] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.720] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.778] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.792] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.887] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.948] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.044] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.230] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.293] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.348] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.356] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.443] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.444] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.446] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.447] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.448] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.449] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.451] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.452] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.459] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.517] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.519] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.520] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.527] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.528] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.529] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.530] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.532] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.533] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.540] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.547] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.575] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.699] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.749] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.800] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.887] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.901] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.911] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.012] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.039] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.041] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.042] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.044] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.046] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.047] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.049] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.052] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.052] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.054] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.058] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.060] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.063] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.780] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.932] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.970] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.973] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.975] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.977] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.982] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.985] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.986] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.988] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.990] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.994] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.034] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.090] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.137] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.246] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.349] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.377] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.378] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.380] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.381] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.386] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.387] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.390] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.391] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.393] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.480] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.527] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.668] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.256] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.319] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.381] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.421] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.443] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.446] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.447] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.510] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.631] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.694] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.697] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.136] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.163] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.178] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.179] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.183] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.184] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.189] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.198] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.207] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.208] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.212] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.213] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.234] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.235] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.256] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.258] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.385] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.389] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.390] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.395] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.396] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.401] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.421] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.422] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.428] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.430] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.434] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.435] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.446] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.447] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.451] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.452] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.456] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.457] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.461] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.462] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.467] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.468] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.472] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.473] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.478] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.481] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.485] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.486] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.491] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.491] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.497] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.511] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.735] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.744] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.748] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.749] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.754] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.754] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.760] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.761] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.818] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.903] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.909] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.910] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.915] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.916] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.920] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.921] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.926] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.927] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.931] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.932] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.942] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.943] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.948] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.953] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.953] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.958] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.959] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.963] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.964] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.968] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.969] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.973] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.974] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.978] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.985] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.989] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.990] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.994] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.995] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.000] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.000] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.005] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.006] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.019] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.020] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.027] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.034] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.035] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.039] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.040] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.051] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.051] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.391] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.397] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.398] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.403] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.413] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.417] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.417] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.421] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.422] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.427] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.432] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.433] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.445] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.474] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.483] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.484] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.489] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.490] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.572] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0182.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0182.573] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.573] GetFileType (hFile=0x318) returned 0x1
	[0182.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0182.573] GetFileType (hFile=0x318) returned 0x1
	[0182.573] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c8
	[0182.573] ReadFile (in: hFile=0x318, lpBuffer=0x27d38c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27d38c8*, lpNumberOfBytesRead=0x55cf1fc*=0x2c8, lpOverlapped=0x0) returned 1
	[0182.674] CloseHandle (hObject=0x318) returned 1
	[0182.674] CryptDestroyKey (hKey=0x82b540) returned 1
	[0182.674] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.674] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d4964, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0182.674] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.674] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.675] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0182.675] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.675] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27d4a1c*=0x1, dwFlags=0x0) returned 1
	[0182.675] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27d49e8, dwFlags=0x0) returned 1
	[0182.675] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d4a2c*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27d4a2c*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0182.675] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d4d08*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27d4d08*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0182.675] CryptDestroyKey (hKey=0x82b300) returned 1
	[0182.675] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.675] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0182.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0182.675] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.676] GetFileType (hFile=0x318) returned 0x1
	[0182.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0182.676] GetFileType (hFile=0x318) returned 0x1
	[0182.677] WriteFile (in: hFile=0x318, lpBuffer=0x27d4f4c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27d4f4c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0182.677] CloseHandle (hObject=0x318) returned 1
	[0182.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0182.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0182.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0182.678] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa737d20e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0182.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0182.678] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0182.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0182.679] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d6540 | out: lpFileInformation=0x27d6540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0182.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0182.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0182.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0182.680] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.680] GetFileType (hFile=0x318) returned 0x1
	[0182.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0182.682] GetFileType (hFile=0x318) returned 0x1
	[0182.682] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x290
	[0182.682] ReadFile (in: hFile=0x318, lpBuffer=0x27d6c5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27d6c5c*, lpNumberOfBytesRead=0x55cf1fc*=0x290, lpOverlapped=0x0) returned 1
	[0182.791] CloseHandle (hObject=0x318) returned 1
	[0182.791] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0182.791] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.791] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d7cf8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0182.791] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.791] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.791] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0182.791] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.791] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27d7db0*=0x1, dwFlags=0x0) returned 1
	[0182.791] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27d7d7c, dwFlags=0x0) returned 1
	[0182.791] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d7dc0*, pdwDataLen=0x55cf204*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x27d7dc0*, pdwDataLen=0x55cf204*=0x2a0) returned 1
	[0182.791] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d806c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27d806c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0182.791] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0182.791] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.791] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.791] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0182.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0182.792] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.793] GetFileType (hFile=0x318) returned 0x1
	[0182.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0182.793] GetFileType (hFile=0x318) returned 0x1
	[0182.793] WriteFile (in: hFile=0x318, lpBuffer=0x27d82b8*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27d82b8*, lpNumberOfBytesWritten=0x55cf1c4*=0x2a0, lpOverlapped=0x0) returned 1
	[0182.794] CloseHandle (hObject=0x318) returned 1
	[0182.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0182.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0182.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0182.794] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa74882bd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0182.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0182.795] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.796] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0182.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0182.796] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d98bc | out: lpFileInformation=0x27d98bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286)) returned 1
	[0182.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0182.796] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0182.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0182.796] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.796] GetFileType (hFile=0x318) returned 0x1
	[0182.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0182.796] GetFileType (hFile=0x318) returned 0x1
	[0182.796] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x286
	[0182.797] ReadFile (in: hFile=0x318, lpBuffer=0x27d9fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27d9fd0*, lpNumberOfBytesRead=0x55cf1fc*=0x286, lpOverlapped=0x0) returned 1
	[0182.859] CloseHandle (hObject=0x318) returned 1
	[0182.859] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0182.859] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.859] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27db06c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0182.859] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.859] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.859] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0182.859] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.859] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x27db124*=0x1, dwFlags=0x0) returned 1
	[0182.859] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x27db0f0, dwFlags=0x0) returned 1
	[0182.859] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27db134*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x27db134*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0182.859] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27db3d0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27db3d0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0182.860] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0182.860] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.860] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.860] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0182.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0182.860] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.861] GetFileType (hFile=0x318) returned 0x1
	[0182.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0182.861] GetFileType (hFile=0x318) returned 0x1
	[0182.861] WriteFile (in: hFile=0x318, lpBuffer=0x27db61c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27db61c*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0182.862] CloseHandle (hObject=0x318) returned 1
	[0182.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0182.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0182.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0182.863] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7520ba4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0182.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0182.863] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.864] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0182.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0182.864] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27dcc20 | out: lpFileInformation=0x27dcc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4)) returned 1
	[0182.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0182.865] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0182.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0182.865] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.865] GetFileType (hFile=0x318) returned 0x1
	[0182.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0182.865] GetFileType (hFile=0x318) returned 0x1
	[0182.865] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d4
	[0182.865] ReadFile (in: hFile=0x318, lpBuffer=0x27dd390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27dd390*, lpNumberOfBytesRead=0x55cf1fc*=0x2d4, lpOverlapped=0x0) returned 1
	[0182.890] CloseHandle (hObject=0x318) returned 1
	[0182.890] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0182.890] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.890] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27de42c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0182.891] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.891] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.891] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b200) returned 1
	[0182.891] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.891] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x27de4e4*=0x1, dwFlags=0x0) returned 1
	[0182.891] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x27de4b0, dwFlags=0x0) returned 1
	[0182.891] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27de4f4*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27de4f4*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0182.891] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27de7e0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27de7e0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0182.891] CryptDestroyKey (hKey=0x82b200) returned 1
	[0182.891] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.891] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0182.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0182.891] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.892] GetFileType (hFile=0x318) returned 0x1
	[0182.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0182.892] GetFileType (hFile=0x318) returned 0x1
	[0182.893] WriteFile (in: hFile=0x318, lpBuffer=0x27dea34*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27dea34*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0182.893] CloseHandle (hObject=0x318) returned 1
	[0182.894] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0182.894] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0182.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0182.894] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa756d125, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0182.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0182.894] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.895] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0182.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0182.895] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e003c | out: lpFileInformation=0x27e003c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6)) returned 1
	[0182.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0182.895] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0182.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0182.895] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.896] GetFileType (hFile=0x318) returned 0x1
	[0182.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0182.896] GetFileType (hFile=0x318) returned 0x1
	[0182.896] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d6
	[0182.896] ReadFile (in: hFile=0x318, lpBuffer=0x27e0800, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27e0800*, lpNumberOfBytesRead=0x55cf1fc*=0x2d6, lpOverlapped=0x0) returned 1
	[0182.924] CloseHandle (hObject=0x318) returned 1
	[0182.924] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0182.924] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.924] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e189c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b040) returned 1
	[0182.924] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.924] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.924] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0182.924] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.924] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x27e1954*=0x1, dwFlags=0x0) returned 1
	[0182.924] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x27e1920, dwFlags=0x0) returned 1
	[0182.924] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e1964*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27e1964*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0182.924] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e1c50*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27e1c50*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0182.924] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0182.924] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.924] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.924] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0182.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0182.925] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.926] GetFileType (hFile=0x318) returned 0x1
	[0182.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0182.926] GetFileType (hFile=0x318) returned 0x1
	[0182.926] WriteFile (in: hFile=0x318, lpBuffer=0x27e1ecc*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27e1ecc*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0182.927] CloseHandle (hObject=0x318) returned 1
	[0182.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0182.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0182.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0182.928] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa75df748, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0182.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0182.928] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0182.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0182.929] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e3530 | out: lpFileInformation=0x27e3530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0182.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0182.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0182.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0182.930] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.930] GetFileType (hFile=0x318) returned 0x1
	[0182.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0182.930] GetFileType (hFile=0x318) returned 0x1
	[0182.930] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c0
	[0182.930] ReadFile (in: hFile=0x318, lpBuffer=0x27e3c7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27e3c7c*, lpNumberOfBytesRead=0x55cf1fc*=0x2c0, lpOverlapped=0x0) returned 1
	[0182.950] CloseHandle (hObject=0x318) returned 1
	[0182.950] CryptDestroyKey (hKey=0x82b040) returned 1
	[0182.950] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.951] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e4d18, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b480) returned 1
	[0182.951] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.951] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.951] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0182.951] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.951] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x27e4dd0*=0x1, dwFlags=0x0) returned 1
	[0182.951] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x27e4d9c, dwFlags=0x0) returned 1
	[0182.951] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e4de0*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27e4de0*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0182.951] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e50bc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27e50bc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0182.951] CryptDestroyKey (hKey=0x82b000) returned 1
	[0182.951] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.951] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0182.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0182.951] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.953] GetFileType (hFile=0x318) returned 0x1
	[0182.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0182.953] GetFileType (hFile=0x318) returned 0x1
	[0182.953] WriteFile (in: hFile=0x318, lpBuffer=0x27e5308*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27e5308*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0182.954] CloseHandle (hObject=0x318) returned 1
	[0182.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0182.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0182.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0182.954] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7605a5b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0182.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0182.955] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.955] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0182.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0182.956] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e6900 | out: lpFileInformation=0x27e6900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8)) returned 1
	[0182.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0182.956] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0182.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0182.956] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.956] GetFileType (hFile=0x318) returned 0x1
	[0182.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0182.956] GetFileType (hFile=0x318) returned 0x1
	[0182.956] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d8
	[0182.956] ReadFile (in: hFile=0x318, lpBuffer=0x27e7094, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27e7094*, lpNumberOfBytesRead=0x55cf1fc*=0x2d8, lpOverlapped=0x0) returned 1
	[0182.959] CloseHandle (hObject=0x318) returned 1
	[0182.959] CryptDestroyKey (hKey=0x82b480) returned 1
	[0182.959] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.959] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e8130, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0182.959] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.959] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.960] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0182.960] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.960] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27e81e8*=0x1, dwFlags=0x0) returned 1
	[0182.960] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27e81b4, dwFlags=0x0) returned 1
	[0182.960] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e81f8*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27e81f8*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0182.960] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e84e4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27e84e4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0182.960] CryptDestroyKey (hKey=0x82b100) returned 1
	[0182.960] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.960] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.960] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0182.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0182.960] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.968] GetFileType (hFile=0x318) returned 0x1
	[0182.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0182.968] GetFileType (hFile=0x318) returned 0x1
	[0182.968] WriteFile (in: hFile=0x318, lpBuffer=0x27e8748*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27e8748*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0182.970] CloseHandle (hObject=0x318) returned 1
	[0182.970] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0182.970] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0182.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0182.970] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7648508, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0182.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0182.970] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.971] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0182.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0182.971] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e9d70 | out: lpFileInformation=0x27e9d70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de)) returned 1
	[0182.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0182.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0182.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0182.973] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.973] GetFileType (hFile=0x318) returned 0x1
	[0182.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0182.973] GetFileType (hFile=0x318) returned 0x1
	[0182.973] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2de
	[0182.973] ReadFile (in: hFile=0x318, lpBuffer=0x27ea50c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27ea50c*, lpNumberOfBytesRead=0x55cf1fc*=0x2de, lpOverlapped=0x0) returned 1
	[0182.991] CloseHandle (hObject=0x318) returned 1
	[0182.991] CryptDestroyKey (hKey=0x82b340) returned 1
	[0182.991] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.991] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27eb5a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0182.991] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.991] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.992] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0182.992] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0182.992] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27eb660*=0x1, dwFlags=0x0) returned 1
	[0182.992] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27eb62c, dwFlags=0x0) returned 1
	[0182.993] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27eb670*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27eb670*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0182.993] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27eb95c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27eb95c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0182.993] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0182.993] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.993] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0182.993] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0182.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0182.993] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.994] GetFileType (hFile=0x318) returned 0x1
	[0182.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0182.994] GetFileType (hFile=0x318) returned 0x1
	[0182.994] WriteFile (in: hFile=0x318, lpBuffer=0x27ebbc0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27ebbc0*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0182.995] CloseHandle (hObject=0x318) returned 1
	[0182.996] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0182.996] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0182.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0182.996] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa76872ed, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0182.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0182.996] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0182.997] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0182.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0182.997] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ed1e8 | out: lpFileInformation=0x27ed1e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0182.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0182.998] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0182.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0182.998] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0182.998] GetFileType (hFile=0x318) returned 0x1
	[0182.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0182.998] GetFileType (hFile=0x318) returned 0x1
	[0182.998] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1e0
	[0182.998] ReadFile (in: hFile=0x318, lpBuffer=0x27ed7f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27ed7f4*, lpNumberOfBytesRead=0x55cf1fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0182.999] CloseHandle (hObject=0x318) returned 1
	[0182.999] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0182.999] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.000] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ee890, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b4c0) returned 1
	[0183.000] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.000] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.000] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0183.000] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.000] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27ee948*=0x1, dwFlags=0x0) returned 1
	[0183.000] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27ee914, dwFlags=0x0) returned 1
	[0183.000] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ee958*, pdwDataLen=0x55cf204*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x27ee958*, pdwDataLen=0x55cf204*=0x1f0) returned 1
	[0183.000] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27eeb54*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27eeb54*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.000] CryptDestroyKey (hKey=0x82b280) returned 1
	[0183.000] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.000] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.000] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.001] GetFileType (hFile=0x318) returned 0x1
	[0183.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.002] GetFileType (hFile=0x318) returned 0x1
	[0183.002] WriteFile (in: hFile=0x318, lpBuffer=0x27eed70*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27eed70*, lpNumberOfBytesWritten=0x55cf1c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0183.003] CloseHandle (hObject=0x318) returned 1
	[0183.006] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.006] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0183.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.006] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7699912, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0183.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.006] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.008] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0183.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.008] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f0314 | out: lpFileInformation=0x27f0314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4)) returned 1
	[0183.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.008] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0183.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.008] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.008] GetFileType (hFile=0x318) returned 0x1
	[0183.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.008] GetFileType (hFile=0x318) returned 0x1
	[0183.008] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d4
	[0183.008] ReadFile (in: hFile=0x318, lpBuffer=0x27f0b04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27f0b04*, lpNumberOfBytesRead=0x55cf1fc*=0x2d4, lpOverlapped=0x0) returned 1
	[0183.016] CloseHandle (hObject=0x318) returned 1
	[0183.017] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0183.017] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.017] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f1ba0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0183.017] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.017] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.017] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0183.017] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.017] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27f1c58*=0x1, dwFlags=0x0) returned 1
	[0183.017] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27f1c24, dwFlags=0x0) returned 1
	[0183.017] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f1c68*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27f1c68*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.017] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f1f54*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27f1f54*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.017] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0183.017] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.017] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.017] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0183.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.017] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.018] GetFileType (hFile=0x318) returned 0x1
	[0183.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.018] GetFileType (hFile=0x318) returned 0x1
	[0183.018] WriteFile (in: hFile=0x318, lpBuffer=0x27f21e8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27f21e8*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.019] CloseHandle (hObject=0x318) returned 1
	[0183.019] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0183.019] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdb
	[0183.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.019] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa76bfe01, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.020] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.020] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0183.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.020] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f3870 | out: lpFileInformation=0x27f3870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29c)) returned 1
	[0183.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.021] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0183.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.021] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.021] GetFileType (hFile=0x318) returned 0x1
	[0183.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.021] GetFileType (hFile=0x318) returned 0x1
	[0183.021] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x29c
	[0183.021] ReadFile (in: hFile=0x318, lpBuffer=0x27f4028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27f4028*, lpNumberOfBytesRead=0x55cf1fc*=0x29c, lpOverlapped=0x0) returned 1
	[0183.035] CloseHandle (hObject=0x318) returned 1
	[0183.035] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0183.035] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.035] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f50c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0183.035] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.035] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.035] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0183.035] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.036] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27f517c*=0x1, dwFlags=0x0) returned 1
	[0183.036] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27f5148, dwFlags=0x0) returned 1
	[0183.036] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f518c*, pdwDataLen=0x55cf204*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x27f518c*, pdwDataLen=0x55cf204*=0x2a0) returned 1
	[0183.036] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f5438*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27f5438*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.036] CryptDestroyKey (hKey=0x82b340) returned 1
	[0183.036] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.036] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0183.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.036] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.037] GetFileType (hFile=0x318) returned 0x1
	[0183.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.037] GetFileType (hFile=0x318) returned 0x1
	[0183.037] WriteFile (in: hFile=0x318, lpBuffer=0x27f56cc*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27f56cc*, lpNumberOfBytesWritten=0x55cf1c4*=0x2a0, lpOverlapped=0x0) returned 1
	[0183.038] CloseHandle (hObject=0x318) returned 1
	[0183.038] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0183.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdb
	[0183.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.039] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa76e60a2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0183.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.039] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.040] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0183.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.040] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f6d54 | out: lpFileInformation=0x27f6d54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27f)) returned 1
	[0183.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.040] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0183.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.040] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.040] GetFileType (hFile=0x318) returned 0x1
	[0183.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.041] GetFileType (hFile=0x318) returned 0x1
	[0183.041] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x27f
	[0183.041] ReadFile (in: hFile=0x318, lpBuffer=0x27f7450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27f7450*, lpNumberOfBytesRead=0x55cf1fc*=0x27f, lpOverlapped=0x0) returned 1
	[0183.046] CloseHandle (hObject=0x318) returned 1
	[0183.046] CryptDestroyKey (hKey=0x82b300) returned 1
	[0183.046] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.046] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f84ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0183.046] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.046] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.046] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0183.046] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.046] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27f85a4*=0x1, dwFlags=0x0) returned 1
	[0183.046] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x27f8570, dwFlags=0x0) returned 1
	[0183.046] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f85b4*, pdwDataLen=0x55cf204*=0x280, dwBufLen=0x280 | out: pbData=0x27f85b4*, pdwDataLen=0x55cf204*=0x280) returned 1
	[0183.046] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f8840*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27f8840*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.046] CryptDestroyKey (hKey=0x82b080) returned 1
	[0183.046] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.046] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.046] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0183.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.046] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.047] GetFileType (hFile=0x318) returned 0x1
	[0183.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.048] GetFileType (hFile=0x318) returned 0x1
	[0183.048] WriteFile (in: hFile=0x318, lpBuffer=0x27f8a84*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27f8a84*, lpNumberOfBytesWritten=0x55cf1c4*=0x280, lpOverlapped=0x0) returned 1
	[0183.048] CloseHandle (hObject=0x318) returned 1
	[0183.049] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0183.049] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0183.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.049] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa76e60a2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0183.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.049] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.050] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.050] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27fa078 | out: lpFileInformation=0x27fa078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c4)) returned 1
	[0183.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.050] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.050] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.050] GetFileType (hFile=0x318) returned 0x1
	[0183.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.051] GetFileType (hFile=0x318) returned 0x1
	[0183.051] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1c4
	[0183.051] ReadFile (in: hFile=0x318, lpBuffer=0x27fa668, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27fa668*, lpNumberOfBytesRead=0x55cf1fc*=0x1c4, lpOverlapped=0x0) returned 1
	[0183.052] CloseHandle (hObject=0x318) returned 1
	[0183.052] CryptDestroyKey (hKey=0x82b540) returned 1
	[0183.052] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.052] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fb704, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0183.052] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.052] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.052] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0183.052] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.052] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27fb7bc*=0x1, dwFlags=0x0) returned 1
	[0183.052] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27fb788, dwFlags=0x0) returned 1
	[0183.052] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27fb7cc*, pdwDataLen=0x55cf204*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27fb7cc*, pdwDataLen=0x55cf204*=0x1d0) returned 1
	[0183.052] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fb9a8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27fb9a8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.052] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.052] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.052] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.052] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.053] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.054] GetFileType (hFile=0x318) returned 0x1
	[0183.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.054] GetFileType (hFile=0x318) returned 0x1
	[0183.054] WriteFile (in: hFile=0x318, lpBuffer=0x27fbbc4*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27fbbc4*, lpNumberOfBytesWritten=0x55cf1c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0183.055] CloseHandle (hObject=0x318) returned 1
	[0183.055] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.055] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0183.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.055] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa770c382, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0183.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.055] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.057] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.057] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27fd168 | out: lpFileInformation=0x27fd168*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd)) returned 1
	[0183.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.057] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.057] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.057] GetFileType (hFile=0x318) returned 0x1
	[0183.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.057] GetFileType (hFile=0x318) returned 0x1
	[0183.057] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2bd
	[0183.057] ReadFile (in: hFile=0x318, lpBuffer=0x27fd8b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27fd8b4*, lpNumberOfBytesRead=0x55cf1fc*=0x2bd, lpOverlapped=0x0) returned 1
	[0183.059] CloseHandle (hObject=0x318) returned 1
	[0183.059] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0183.059] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.059] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fe950, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0183.059] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.059] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.059] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0183.059] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.059] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x27fea08*=0x1, dwFlags=0x0) returned 1
	[0183.059] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x27fe9d4, dwFlags=0x0) returned 1
	[0183.059] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27fea18*, pdwDataLen=0x55cf204*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x27fea18*, pdwDataLen=0x55cf204*=0x2c0) returned 1
	[0183.060] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fece4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27fece4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.060] CryptDestroyKey (hKey=0x82b000) returned 1
	[0183.060] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.060] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.060] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.060] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.061] GetFileType (hFile=0x318) returned 0x1
	[0183.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.061] GetFileType (hFile=0x318) returned 0x1
	[0183.061] WriteFile (in: hFile=0x318, lpBuffer=0x27fef30*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27fef30*, lpNumberOfBytesWritten=0x55cf1c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0183.062] CloseHandle (hObject=0x318) returned 1
	[0183.062] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.062] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0183.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.062] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa770c382, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0183.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.063] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.064] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.064] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2800534 | out: lpFileInformation=0x2800534*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0183.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.064] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.064] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.064] GetFileType (hFile=0x318) returned 0x1
	[0183.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.064] GetFileType (hFile=0x318) returned 0x1
	[0183.064] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2cc
	[0183.065] ReadFile (in: hFile=0x318, lpBuffer=0x2800c9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2800c9c*, lpNumberOfBytesRead=0x55cf1fc*=0x2cc, lpOverlapped=0x0) returned 1
	[0183.066] CloseHandle (hObject=0x318) returned 1
	[0183.067] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.067] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.067] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2801d38, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0183.067] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.067] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.067] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0183.067] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.067] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2801df0*=0x1, dwFlags=0x0) returned 1
	[0183.067] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2801dbc, dwFlags=0x0) returned 1
	[0183.067] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2801e00*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2801e00*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0183.067] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28020dc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x28020dc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.067] CryptDestroyKey (hKey=0x82b480) returned 1
	[0183.067] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.067] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.067] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.067] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.068] GetFileType (hFile=0x318) returned 0x1
	[0183.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.068] GetFileType (hFile=0x318) returned 0x1
	[0183.069] WriteFile (in: hFile=0x318, lpBuffer=0x2802330*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2802330*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.069] CloseHandle (hObject=0x318) returned 1
	[0183.070] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.070] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0183.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.070] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa77325e3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.070] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.071] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.071] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2803938 | out: lpFileInformation=0x2803938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8)) returned 1
	[0183.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.071] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.071] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.072] GetFileType (hFile=0x318) returned 0x1
	[0183.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.072] GetFileType (hFile=0x318) returned 0x1
	[0183.072] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1d8
	[0183.072] ReadFile (in: hFile=0x318, lpBuffer=0x2803f3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2803f3c*, lpNumberOfBytesRead=0x55cf1fc*=0x1d8, lpOverlapped=0x0) returned 1
	[0183.073] CloseHandle (hObject=0x318) returned 1
	[0183.073] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.073] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.073] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2804fd8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0183.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.073] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0183.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.073] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2805090*=0x1, dwFlags=0x0) returned 1
	[0183.073] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x280505c, dwFlags=0x0) returned 1
	[0183.073] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28050a0*, pdwDataLen=0x55cf204*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x28050a0*, pdwDataLen=0x55cf204*=0x1e0) returned 1
	[0183.073] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x280528c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x280528c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.073] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0183.073] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.073] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.073] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.074] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.075] GetFileType (hFile=0x318) returned 0x1
	[0183.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.075] GetFileType (hFile=0x318) returned 0x1
	[0183.075] WriteFile (in: hFile=0x318, lpBuffer=0x28054a8*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x28054a8*, lpNumberOfBytesWritten=0x55cf1c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0183.076] CloseHandle (hObject=0x318) returned 1
	[0183.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0183.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.078] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa77325e3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0183.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.078] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.079] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0183.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.079] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2602d78 | out: lpFileInformation=0x2602d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29d)) returned 1
	[0183.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.079] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0183.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.080] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.080] GetFileType (hFile=0x318) returned 0x1
	[0183.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.080] GetFileType (hFile=0x318) returned 0x1
	[0183.080] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x29d
	[0183.080] ReadFile (in: hFile=0x318, lpBuffer=0x2603524, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2603524*, lpNumberOfBytesRead=0x55cf1fc*=0x29d, lpOverlapped=0x0) returned 1
	[0183.107] CloseHandle (hObject=0x318) returned 1
	[0183.107] CryptDestroyKey (hKey=0x82b280) returned 1
	[0183.107] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.107] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26045c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0183.107] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.107] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.107] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0183.107] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.107] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2604678*=0x1, dwFlags=0x0) returned 1
	[0183.107] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2604644, dwFlags=0x0) returned 1
	[0183.107] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2604688*, pdwDataLen=0x55cf204*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x2604688*, pdwDataLen=0x55cf204*=0x2a0) returned 1
	[0183.108] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2604934*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2604934*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.108] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0183.108] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.108] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.108] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0183.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.108] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.109] GetFileType (hFile=0x318) returned 0x1
	[0183.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.109] GetFileType (hFile=0x318) returned 0x1
	[0183.109] WriteFile (in: hFile=0x318, lpBuffer=0x2604bc0*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2604bc0*, lpNumberOfBytesWritten=0x55cf1c4*=0x2a0, lpOverlapped=0x0) returned 1
	[0183.110] CloseHandle (hObject=0x318) returned 1
	[0183.110] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0183.110] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xda
	[0183.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.110] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa777e9c5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0183.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.111] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.111] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0183.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.111] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2606244 | out: lpFileInformation=0x2606244*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x299)) returned 1
	[0183.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.112] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0183.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.112] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.113] GetFileType (hFile=0x318) returned 0x1
	[0183.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.113] GetFileType (hFile=0x318) returned 0x1
	[0183.113] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x299
	[0183.113] ReadFile (in: hFile=0x318, lpBuffer=0x26069ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26069ec*, lpNumberOfBytesRead=0x55cf1fc*=0x299, lpOverlapped=0x0) returned 1
	[0183.114] CloseHandle (hObject=0x318) returned 1
	[0183.115] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.115] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2607a88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b480) returned 1
	[0183.115] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.115] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.115] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0183.115] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.115] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2607b40*=0x1, dwFlags=0x0) returned 1
	[0183.115] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2607b0c, dwFlags=0x0) returned 1
	[0183.115] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2607b50*, pdwDataLen=0x55cf204*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x2607b50*, pdwDataLen=0x55cf204*=0x2a0) returned 1
	[0183.115] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2607dfc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2607dfc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.115] CryptDestroyKey (hKey=0x82b280) returned 1
	[0183.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.115] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0183.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.115] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.116] GetFileType (hFile=0x318) returned 0x1
	[0183.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.116] GetFileType (hFile=0x318) returned 0x1
	[0183.117] WriteFile (in: hFile=0x318, lpBuffer=0x2608088*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2608088*, lpNumberOfBytesWritten=0x55cf1c4*=0x2a0, lpOverlapped=0x0) returned 1
	[0183.117] CloseHandle (hObject=0x318) returned 1
	[0183.117] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0183.117] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xda
	[0183.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.118] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa77a4ce4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0183.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.118] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.119] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0183.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.119] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x260970c | out: lpFileInformation=0x260970c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294)) returned 1
	[0183.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.119] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0183.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.119] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.120] GetFileType (hFile=0x318) returned 0x1
	[0183.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.120] GetFileType (hFile=0x318) returned 0x1
	[0183.120] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x294
	[0183.120] ReadFile (in: hFile=0x318, lpBuffer=0x2609e8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2609e8c*, lpNumberOfBytesRead=0x55cf1fc*=0x294, lpOverlapped=0x0) returned 1
	[0183.132] CloseHandle (hObject=0x318) returned 1
	[0183.132] CryptDestroyKey (hKey=0x82b480) returned 1
	[0183.132] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.132] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260af28, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b040) returned 1
	[0183.132] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.132] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.132] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0183.132] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.132] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x260afe0*=0x1, dwFlags=0x0) returned 1
	[0183.132] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x260afac, dwFlags=0x0) returned 1
	[0183.132] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260aff0*, pdwDataLen=0x55cf204*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x260aff0*, pdwDataLen=0x55cf204*=0x2a0) returned 1
	[0183.133] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260b29c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x260b29c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.133] CryptDestroyKey (hKey=0x82b280) returned 1
	[0183.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.133] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0183.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.133] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.135] GetFileType (hFile=0x318) returned 0x1
	[0183.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.135] GetFileType (hFile=0x318) returned 0x1
	[0183.135] WriteFile (in: hFile=0x318, lpBuffer=0x260b518*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x260b518*, lpNumberOfBytesWritten=0x55cf1c4*=0x2a0, lpOverlapped=0x0) returned 1
	[0183.136] CloseHandle (hObject=0x318) returned 1
	[0183.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0183.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0183.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.137] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa77de03a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0183.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.137] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.138] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.138] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x260cb70 | out: lpFileInformation=0x260cb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282)) returned 1
	[0183.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.140] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.140] GetFileType (hFile=0x318) returned 0x1
	[0183.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.140] GetFileType (hFile=0x318) returned 0x1
	[0183.140] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x282
	[0183.140] ReadFile (in: hFile=0x318, lpBuffer=0x260d290, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x260d290*, lpNumberOfBytesRead=0x55cf1fc*=0x282, lpOverlapped=0x0) returned 1
	[0183.141] CloseHandle (hObject=0x318) returned 1
	[0183.141] CryptDestroyKey (hKey=0x82b040) returned 1
	[0183.142] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.142] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260e32c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0183.142] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.142] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.142] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0183.142] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.142] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x260e3e4*=0x1, dwFlags=0x0) returned 1
	[0183.142] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x260e3b0, dwFlags=0x0) returned 1
	[0183.142] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260e3f4*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x260e3f4*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0183.142] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260e690*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x260e690*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.142] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.142] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.142] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.142] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.142] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.144] GetFileType (hFile=0x318) returned 0x1
	[0183.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.144] GetFileType (hFile=0x318) returned 0x1
	[0183.144] WriteFile (in: hFile=0x318, lpBuffer=0x260e8e4*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x260e8e4*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0183.145] CloseHandle (hObject=0x318) returned 1
	[0183.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0183.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.145] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa77f3f98, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0183.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.145] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.146] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x260feec | out: lpFileInformation=0x260feec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0183.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.147] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.147] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.147] GetFileType (hFile=0x318) returned 0x1
	[0183.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.147] GetFileType (hFile=0x318) returned 0x1
	[0183.147] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2cf
	[0183.147] ReadFile (in: hFile=0x318, lpBuffer=0x2610658, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2610658*, lpNumberOfBytesRead=0x55cf1fc*=0x2cf, lpOverlapped=0x0) returned 1
	[0183.150] CloseHandle (hObject=0x318) returned 1
	[0183.150] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0183.150] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.150] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26116f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0183.150] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.150] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.150] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0183.150] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.150] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26117ac*=0x1, dwFlags=0x0) returned 1
	[0183.151] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2611778, dwFlags=0x0) returned 1
	[0183.151] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26117bc*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26117bc*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0183.151] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2611a98*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2611a98*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.151] CryptDestroyKey (hKey=0x82b300) returned 1
	[0183.151] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.151] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.151] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.151] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.152] GetFileType (hFile=0x318) returned 0x1
	[0183.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.152] GetFileType (hFile=0x318) returned 0x1
	[0183.152] WriteFile (in: hFile=0x318, lpBuffer=0x2611cec*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2611cec*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.153] CloseHandle (hObject=0x318) returned 1
	[0183.153] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.153] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0183.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.153] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7800390, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.153] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.154] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.154] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2613300 | out: lpFileInformation=0x2613300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1)) returned 1
	[0183.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.155] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.155] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.155] GetFileType (hFile=0x318) returned 0x1
	[0183.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.155] GetFileType (hFile=0x318) returned 0x1
	[0183.155] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d1
	[0183.155] ReadFile (in: hFile=0x318, lpBuffer=0x2613a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2613a70*, lpNumberOfBytesRead=0x55cf1fc*=0x2d1, lpOverlapped=0x0) returned 1
	[0183.156] CloseHandle (hObject=0x318) returned 1
	[0183.156] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0183.156] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.156] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2614b0c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0183.157] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.157] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.157] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0183.157] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.157] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2614bc4*=0x1, dwFlags=0x0) returned 1
	[0183.157] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2614b90, dwFlags=0x0) returned 1
	[0183.157] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2614bd4*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2614bd4*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.157] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2614ec0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2614ec0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.157] CryptDestroyKey (hKey=0x82b300) returned 1
	[0183.157] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.157] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.157] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.157] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.158] GetFileType (hFile=0x318) returned 0x1
	[0183.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.158] GetFileType (hFile=0x318) returned 0x1
	[0183.158] WriteFile (in: hFile=0x318, lpBuffer=0x2615114*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2615114*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.159] CloseHandle (hObject=0x318) returned 1
	[0183.159] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.159] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0183.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.159] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7800390, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.159] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.160] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.160] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2616728 | out: lpFileInformation=0x2616728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d7)) returned 1
	[0183.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.160] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.160] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.161] GetFileType (hFile=0x318) returned 0x1
	[0183.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.161] GetFileType (hFile=0x318) returned 0x1
	[0183.161] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1d7
	[0183.161] ReadFile (in: hFile=0x318, lpBuffer=0x2616d2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2616d2c*, lpNumberOfBytesRead=0x55cf1fc*=0x1d7, lpOverlapped=0x0) returned 1
	[0183.162] CloseHandle (hObject=0x318) returned 1
	[0183.162] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.162] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.162] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2617dc8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0183.162] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.162] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.162] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0183.162] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.162] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2617e80*=0x1, dwFlags=0x0) returned 1
	[0183.162] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2617e4c, dwFlags=0x0) returned 1
	[0183.162] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2617e90*, pdwDataLen=0x55cf204*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x2617e90*, pdwDataLen=0x55cf204*=0x1e0) returned 1
	[0183.162] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261807c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x261807c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.162] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0183.162] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.162] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.162] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.162] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.163] GetFileType (hFile=0x318) returned 0x1
	[0183.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.164] GetFileType (hFile=0x318) returned 0x1
	[0183.164] WriteFile (in: hFile=0x318, lpBuffer=0x2618298*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2618298*, lpNumberOfBytesWritten=0x55cf1c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0183.164] CloseHandle (hObject=0x318) returned 1
	[0183.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0183.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.165] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7800390, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0183.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.165] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.167] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x261983c | out: lpFileInformation=0x261983c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4)) returned 1
	[0183.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.167] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.168] GetFileType (hFile=0x318) returned 0x1
	[0183.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.168] GetFileType (hFile=0x318) returned 0x1
	[0183.168] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c4
	[0183.168] ReadFile (in: hFile=0x318, lpBuffer=0x2619fbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2619fbc*, lpNumberOfBytesRead=0x55cf1fc*=0x2c4, lpOverlapped=0x0) returned 1
	[0183.193] CloseHandle (hObject=0x318) returned 1
	[0183.193] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.193] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.194] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261b058, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0183.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.194] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0183.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.194] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x261b110*=0x1, dwFlags=0x0) returned 1
	[0183.194] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x261b0dc, dwFlags=0x0) returned 1
	[0183.194] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261b120*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x261b120*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0183.194] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261b3fc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x261b3fc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.194] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.194] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.194] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.194] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.194] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.196] GetFileType (hFile=0x318) returned 0x1
	[0183.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.196] GetFileType (hFile=0x318) returned 0x1
	[0183.196] WriteFile (in: hFile=0x318, lpBuffer=0x261b660*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x261b660*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.197] CloseHandle (hObject=0x318) returned 1
	[0183.197] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.197] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0183.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.197] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7873021, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.197] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.198] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.198] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x261cc88 | out: lpFileInformation=0x261cc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce)) returned 1
	[0183.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.199] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.199] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.199] GetFileType (hFile=0x318) returned 0x1
	[0183.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.199] GetFileType (hFile=0x318) returned 0x1
	[0183.199] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2ce
	[0183.199] ReadFile (in: hFile=0x318, lpBuffer=0x261d3e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x261d3e4*, lpNumberOfBytesRead=0x55cf1fc*=0x2ce, lpOverlapped=0x0) returned 1
	[0183.208] CloseHandle (hObject=0x318) returned 1
	[0183.208] CryptDestroyKey (hKey=0x82b400) returned 1
	[0183.208] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.208] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261e480, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0183.208] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.208] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.208] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b040) returned 1
	[0183.208] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.208] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x261e538*=0x1, dwFlags=0x0) returned 1
	[0183.208] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x261e504, dwFlags=0x0) returned 1
	[0183.208] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261e548*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x261e548*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0183.209] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261e824*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x261e824*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.209] CryptDestroyKey (hKey=0x82b040) returned 1
	[0183.209] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.209] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.209] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.210] GetFileType (hFile=0x318) returned 0x1
	[0183.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.210] GetFileType (hFile=0x318) returned 0x1
	[0183.210] WriteFile (in: hFile=0x318, lpBuffer=0x261ea70*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x261ea70*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.211] CloseHandle (hObject=0x318) returned 1
	[0183.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0183.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.211] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7873021, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.211] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.212] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.212] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2620074 | out: lpFileInformation=0x2620074*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6)) returned 1
	[0183.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.213] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.213] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.213] GetFileType (hFile=0x318) returned 0x1
	[0183.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.213] GetFileType (hFile=0x318) returned 0x1
	[0183.213] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c6
	[0183.213] ReadFile (in: hFile=0x318, lpBuffer=0x26207d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26207d8*, lpNumberOfBytesRead=0x55cf1fc*=0x2c6, lpOverlapped=0x0) returned 1
	[0183.215] CloseHandle (hObject=0x318) returned 1
	[0183.215] CryptDestroyKey (hKey=0x82b280) returned 1
	[0183.215] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.215] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2621874, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0183.215] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.215] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.215] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0183.215] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.215] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x262192c*=0x1, dwFlags=0x0) returned 1
	[0183.216] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26218f8, dwFlags=0x0) returned 1
	[0183.216] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262193c*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x262193c*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0183.216] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2621c18*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2621c18*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.216] CryptDestroyKey (hKey=0x82b300) returned 1
	[0183.216] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.216] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.216] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.216] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.217] GetFileType (hFile=0x318) returned 0x1
	[0183.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.217] GetFileType (hFile=0x318) returned 0x1
	[0183.217] WriteFile (in: hFile=0x318, lpBuffer=0x2621e6c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2621e6c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.218] CloseHandle (hObject=0x318) returned 1
	[0183.218] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.218] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0183.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.219] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7898fe4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.219] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.220] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.220] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2623474 | out: lpFileInformation=0x2623474*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e)) returned 1
	[0183.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.220] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.220] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.220] GetFileType (hFile=0x318) returned 0x1
	[0183.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.220] GetFileType (hFile=0x318) returned 0x1
	[0183.220] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x34e
	[0183.221] ReadFile (in: hFile=0x318, lpBuffer=0x2623c50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2623c50*, lpNumberOfBytesRead=0x55cf1fc*=0x34e, lpOverlapped=0x0) returned 1
	[0183.222] CloseHandle (hObject=0x318) returned 1
	[0183.222] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0183.222] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.222] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2624cec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b000) returned 1
	[0183.222] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.222] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.223] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0183.223] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.223] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2624da4*=0x1, dwFlags=0x0) returned 1
	[0183.223] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2624d70, dwFlags=0x0) returned 1
	[0183.223] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2624db4*, pdwDataLen=0x55cf204*=0x350, dwBufLen=0x350 | out: pbData=0x2624db4*, pdwDataLen=0x55cf204*=0x350) returned 1
	[0183.223] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2625110*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2625110*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.223] CryptDestroyKey (hKey=0x82b540) returned 1
	[0183.223] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.223] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.223] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.223] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.224] GetFileType (hFile=0x318) returned 0x1
	[0183.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.224] GetFileType (hFile=0x318) returned 0x1
	[0183.224] WriteFile (in: hFile=0x318, lpBuffer=0x262535c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x262535c*, lpNumberOfBytesWritten=0x55cf1c4*=0x350, lpOverlapped=0x0) returned 1
	[0183.225] CloseHandle (hObject=0x318) returned 1
	[0183.225] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.226] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0183.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.226] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7898fe4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0183.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.226] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.227] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.227] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2626960 | out: lpFileInformation=0x2626960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356)) returned 1
	[0183.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.228] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.229] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.229] GetFileType (hFile=0x318) returned 0x1
	[0183.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.229] GetFileType (hFile=0x318) returned 0x1
	[0183.229] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x356
	[0183.229] ReadFile (in: hFile=0x318, lpBuffer=0x2627144, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2627144*, lpNumberOfBytesRead=0x55cf1fc*=0x356, lpOverlapped=0x0) returned 1
	[0183.231] CloseHandle (hObject=0x318) returned 1
	[0183.231] CryptDestroyKey (hKey=0x82b000) returned 1
	[0183.231] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.231] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26281e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0183.231] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.231] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.231] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0183.231] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.231] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2628298*=0x1, dwFlags=0x0) returned 1
	[0183.231] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2628264, dwFlags=0x0) returned 1
	[0183.231] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26282a8*, pdwDataLen=0x55cf204*=0x360, dwBufLen=0x360 | out: pbData=0x26282a8*, pdwDataLen=0x55cf204*=0x360) returned 1
	[0183.231] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2628614*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2628614*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.231] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0183.231] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.231] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.231] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.231] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.233] GetFileType (hFile=0x318) returned 0x1
	[0183.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.233] GetFileType (hFile=0x318) returned 0x1
	[0183.233] WriteFile (in: hFile=0x318, lpBuffer=0x2628860*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2628860*, lpNumberOfBytesWritten=0x55cf1c4*=0x360, lpOverlapped=0x0) returned 1
	[0183.234] CloseHandle (hObject=0x318) returned 1
	[0183.234] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.234] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0183.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.234] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa78bf22c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0183.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.234] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.235] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.235] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2629e64 | out: lpFileInformation=0x2629e64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a)) returned 1
	[0183.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.236] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.236] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.236] GetFileType (hFile=0x318) returned 0x1
	[0183.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.236] GetFileType (hFile=0x318) returned 0x1
	[0183.236] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x34a
	[0183.236] ReadFile (in: hFile=0x318, lpBuffer=0x262a63c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x262a63c*, lpNumberOfBytesRead=0x55cf1fc*=0x34a, lpOverlapped=0x0) returned 1
	[0183.262] CloseHandle (hObject=0x318) returned 1
	[0183.262] CryptDestroyKey (hKey=0x82b540) returned 1
	[0183.262] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.262] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262b6d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0183.262] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.262] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.262] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0183.262] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.262] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x262b790*=0x1, dwFlags=0x0) returned 1
	[0183.262] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x262b75c, dwFlags=0x0) returned 1
	[0183.262] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262b7a0*, pdwDataLen=0x55cf204*=0x350, dwBufLen=0x350 | out: pbData=0x262b7a0*, pdwDataLen=0x55cf204*=0x350) returned 1
	[0183.262] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262bafc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x262bafc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.262] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0183.262] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.262] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.263] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.263] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.264] GetFileType (hFile=0x318) returned 0x1
	[0183.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.264] GetFileType (hFile=0x318) returned 0x1
	[0183.264] WriteFile (in: hFile=0x318, lpBuffer=0x262bd48*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x262bd48*, lpNumberOfBytesWritten=0x55cf1c4*=0x350, lpOverlapped=0x0) returned 1
	[0183.265] CloseHandle (hObject=0x318) returned 1
	[0183.265] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.265] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0183.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.265] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa790b745, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0183.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.265] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.266] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x262d34c | out: lpFileInformation=0x262d34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x346)) returned 1
	[0183.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.266] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.267] GetFileType (hFile=0x318) returned 0x1
	[0183.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.267] GetFileType (hFile=0x318) returned 0x1
	[0183.267] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x346
	[0183.267] ReadFile (in: hFile=0x318, lpBuffer=0x262db20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x262db20*, lpNumberOfBytesRead=0x55cf1fc*=0x346, lpOverlapped=0x0) returned 1
	[0183.268] CloseHandle (hObject=0x318) returned 1
	[0183.268] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0183.268] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.268] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262ebbc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0183.268] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.268] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.268] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0183.268] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.268] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x262ec74*=0x1, dwFlags=0x0) returned 1
	[0183.268] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x262ec40, dwFlags=0x0) returned 1
	[0183.268] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262ec84*, pdwDataLen=0x55cf204*=0x350, dwBufLen=0x350 | out: pbData=0x262ec84*, pdwDataLen=0x55cf204*=0x350) returned 1
	[0183.268] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262efe0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x262efe0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.269] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.269] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.269] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.269] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.269] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.270] GetFileType (hFile=0x318) returned 0x1
	[0183.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.270] GetFileType (hFile=0x318) returned 0x1
	[0183.270] WriteFile (in: hFile=0x318, lpBuffer=0x262f22c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x262f22c*, lpNumberOfBytesWritten=0x55cf1c4*=0x350, lpOverlapped=0x0) returned 1
	[0183.271] CloseHandle (hObject=0x318) returned 1
	[0183.271] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.271] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0183.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.271] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa790b745, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0183.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.271] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.272] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.272] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2630830 | out: lpFileInformation=0x2630830*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f)) returned 1
	[0183.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.272] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.272] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.272] GetFileType (hFile=0x318) returned 0x1
	[0183.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.273] GetFileType (hFile=0x318) returned 0x1
	[0183.273] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x34f
	[0183.273] ReadFile (in: hFile=0x318, lpBuffer=0x263100c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x263100c*, lpNumberOfBytesRead=0x55cf1fc*=0x34f, lpOverlapped=0x0) returned 1
	[0183.274] CloseHandle (hObject=0x318) returned 1
	[0183.274] CryptDestroyKey (hKey=0x82b300) returned 1
	[0183.274] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.274] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26320a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0183.274] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.274] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.274] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0183.274] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.274] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2632160*=0x1, dwFlags=0x0) returned 1
	[0183.275] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x263212c, dwFlags=0x0) returned 1
	[0183.275] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2632170*, pdwDataLen=0x55cf204*=0x350, dwBufLen=0x350 | out: pbData=0x2632170*, pdwDataLen=0x55cf204*=0x350) returned 1
	[0183.275] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26324cc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26324cc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.275] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0183.275] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.275] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.275] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.275] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.276] GetFileType (hFile=0x318) returned 0x1
	[0183.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.276] GetFileType (hFile=0x318) returned 0x1
	[0183.276] WriteFile (in: hFile=0x318, lpBuffer=0x2632718*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2632718*, lpNumberOfBytesWritten=0x55cf1c4*=0x350, lpOverlapped=0x0) returned 1
	[0183.277] CloseHandle (hObject=0x318) returned 1
	[0183.277] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.277] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0183.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.277] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa793197e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0183.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.277] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.278] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.278] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2633d1c | out: lpFileInformation=0x2633d1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a)) returned 1
	[0183.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.278] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.278] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.279] GetFileType (hFile=0x318) returned 0x1
	[0183.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.279] GetFileType (hFile=0x318) returned 0x1
	[0183.279] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x34a
	[0183.279] ReadFile (in: hFile=0x318, lpBuffer=0x26344f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26344f4*, lpNumberOfBytesRead=0x55cf1fc*=0x34a, lpOverlapped=0x0) returned 1
	[0183.280] CloseHandle (hObject=0x318) returned 1
	[0183.280] CryptDestroyKey (hKey=0x82b400) returned 1
	[0183.280] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.280] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2635590, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0183.280] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.280] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.280] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b400) returned 1
	[0183.280] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.280] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2635648*=0x1, dwFlags=0x0) returned 1
	[0183.280] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2635614, dwFlags=0x0) returned 1
	[0183.280] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2635658*, pdwDataLen=0x55cf204*=0x350, dwBufLen=0x350 | out: pbData=0x2635658*, pdwDataLen=0x55cf204*=0x350) returned 1
	[0183.281] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26359b4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26359b4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.281] CryptDestroyKey (hKey=0x82b400) returned 1
	[0183.281] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.281] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.281] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.281] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.282] GetFileType (hFile=0x318) returned 0x1
	[0183.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.282] GetFileType (hFile=0x318) returned 0x1
	[0183.282] WriteFile (in: hFile=0x318, lpBuffer=0x2635c00*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2635c00*, lpNumberOfBytesWritten=0x55cf1c4*=0x350, lpOverlapped=0x0) returned 1
	[0183.283] CloseHandle (hObject=0x318) returned 1
	[0183.283] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.283] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0183.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.283] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa793197e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0183.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.283] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.284] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.284] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2637204 | out: lpFileInformation=0x2637204*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2)) returned 1
	[0183.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.284] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.284] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.284] GetFileType (hFile=0x318) returned 0x1
	[0183.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.284] GetFileType (hFile=0x318) returned 0x1
	[0183.284] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c2
	[0183.284] ReadFile (in: hFile=0x318, lpBuffer=0x2637944, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2637944*, lpNumberOfBytesRead=0x55cf1fc*=0x2c2, lpOverlapped=0x0) returned 1
	[0183.286] CloseHandle (hObject=0x318) returned 1
	[0183.286] CryptDestroyKey (hKey=0x82b280) returned 1
	[0183.286] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.286] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26389e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0183.286] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.286] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.286] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0183.286] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.286] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2638a98*=0x1, dwFlags=0x0) returned 1
	[0183.286] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2638a64, dwFlags=0x0) returned 1
	[0183.286] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2638aa8*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2638aa8*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0183.286] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2638d84*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2638d84*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.286] CryptDestroyKey (hKey=0x82b080) returned 1
	[0183.286] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.286] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.287] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.287] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.288] GetFileType (hFile=0x318) returned 0x1
	[0183.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.288] GetFileType (hFile=0x318) returned 0x1
	[0183.288] WriteFile (in: hFile=0x318, lpBuffer=0x2638fc8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2638fc8*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.289] CloseHandle (hObject=0x318) returned 1
	[0183.289] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.289] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0183.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.289] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa793197e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.289] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.290] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.290] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x263a5b0 | out: lpFileInformation=0x263a5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0183.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.291] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.291] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.291] GetFileType (hFile=0x318) returned 0x1
	[0183.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.291] GetFileType (hFile=0x318) returned 0x1
	[0183.291] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c0
	[0183.291] ReadFile (in: hFile=0x318, lpBuffer=0x263acec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x263acec*, lpNumberOfBytesRead=0x55cf1fc*=0x2c0, lpOverlapped=0x0) returned 1
	[0183.293] CloseHandle (hObject=0x318) returned 1
	[0183.293] CryptDestroyKey (hKey=0x82b340) returned 1
	[0183.293] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.293] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263bd88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0183.293] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.293] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.293] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0183.294] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.294] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x263be40*=0x1, dwFlags=0x0) returned 1
	[0183.294] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x263be0c, dwFlags=0x0) returned 1
	[0183.294] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263be50*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x263be50*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0183.294] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263c12c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x263c12c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.294] CryptDestroyKey (hKey=0x82b080) returned 1
	[0183.294] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.294] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.294] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.294] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.295] GetFileType (hFile=0x318) returned 0x1
	[0183.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.296] GetFileType (hFile=0x318) returned 0x1
	[0183.296] WriteFile (in: hFile=0x318, lpBuffer=0x263c370*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x263c370*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.296] CloseHandle (hObject=0x318) returned 1
	[0183.297] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.297] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0183.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.297] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7957c06, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.297] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.302] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.302] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x263d958 | out: lpFileInformation=0x263d958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0183.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.302] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.302] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.302] GetFileType (hFile=0x318) returned 0x1
	[0183.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.302] GetFileType (hFile=0x318) returned 0x1
	[0183.302] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c3
	[0183.303] ReadFile (in: hFile=0x318, lpBuffer=0x263e098, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x263e098*, lpNumberOfBytesRead=0x55cf1fc*=0x2c3, lpOverlapped=0x0) returned 1
	[0183.323] CloseHandle (hObject=0x318) returned 1
	[0183.323] CryptDestroyKey (hKey=0x82b540) returned 1
	[0183.323] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.323] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263f134, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0183.323] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.323] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.323] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0183.323] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.324] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x263f1ec*=0x1, dwFlags=0x0) returned 1
	[0183.324] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x263f1b8, dwFlags=0x0) returned 1
	[0183.324] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263f1fc*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x263f1fc*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0183.324] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263f4d8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x263f4d8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.324] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.324] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.324] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.324] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.324] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.325] GetFileType (hFile=0x318) returned 0x1
	[0183.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.325] GetFileType (hFile=0x318) returned 0x1
	[0183.325] WriteFile (in: hFile=0x318, lpBuffer=0x263f71c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x263f71c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.326] CloseHandle (hObject=0x318) returned 1
	[0183.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0183.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.327] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa79a40d2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.327] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.328] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.328] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2640d04 | out: lpFileInformation=0x2640d04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0183.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.328] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.329] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.329] GetFileType (hFile=0x318) returned 0x1
	[0183.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.329] GetFileType (hFile=0x318) returned 0x1
	[0183.329] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2cf
	[0183.329] ReadFile (in: hFile=0x318, lpBuffer=0x2641450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2641450*, lpNumberOfBytesRead=0x55cf1fc*=0x2cf, lpOverlapped=0x0) returned 1
	[0183.331] CloseHandle (hObject=0x318) returned 1
	[0183.331] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0183.331] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.331] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26424ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0183.331] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.331] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.331] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0183.331] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.331] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26425a4*=0x1, dwFlags=0x0) returned 1
	[0183.331] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2642570, dwFlags=0x0) returned 1
	[0183.331] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26425b4*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26425b4*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0183.331] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2642890*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2642890*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.331] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.331] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.331] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.331] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.332] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.333] GetFileType (hFile=0x318) returned 0x1
	[0183.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.333] GetFileType (hFile=0x318) returned 0x1
	[0183.333] WriteFile (in: hFile=0x318, lpBuffer=0x2642ad4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2642ad4*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.334] CloseHandle (hObject=0x318) returned 1
	[0183.334] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0183.334] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0183.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.334] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa79a40d2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.334] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.335] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.335] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26440bc | out: lpFileInformation=0x26440bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0183.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.336] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.336] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.336] GetFileType (hFile=0x318) returned 0x1
	[0183.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.336] GetFileType (hFile=0x318) returned 0x1
	[0183.336] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2cb
	[0183.336] ReadFile (in: hFile=0x318, lpBuffer=0x2644824, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2644824*, lpNumberOfBytesRead=0x55cf1fc*=0x2cb, lpOverlapped=0x0) returned 1
	[0183.345] CloseHandle (hObject=0x318) returned 1
	[0183.345] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.345] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.345] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26458c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0183.345] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.345] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.345] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0183.345] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.345] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2645978*=0x1, dwFlags=0x0) returned 1
	[0183.345] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2645944, dwFlags=0x0) returned 1
	[0183.346] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2645988*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2645988*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0183.346] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2645c64*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2645c64*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.346] CryptDestroyKey (hKey=0x82b380) returned 1
	[0183.346] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.346] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.346] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.346] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.347] GetFileType (hFile=0x318) returned 0x1
	[0183.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.347] GetFileType (hFile=0x318) returned 0x1
	[0183.348] WriteFile (in: hFile=0x318, lpBuffer=0x2645eb8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2645eb8*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.349] CloseHandle (hObject=0x318) returned 1
	[0183.349] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.349] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0183.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.349] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa79ca329, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.349] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.350] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.350] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26474c0 | out: lpFileInformation=0x26474c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356)) returned 1
	[0183.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.351] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.351] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.351] GetFileType (hFile=0x318) returned 0x1
	[0183.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.351] GetFileType (hFile=0x318) returned 0x1
	[0183.351] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x356
	[0183.351] ReadFile (in: hFile=0x318, lpBuffer=0x2647cb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2647cb4*, lpNumberOfBytesRead=0x55cf1fc*=0x356, lpOverlapped=0x0) returned 1
	[0183.352] CloseHandle (hObject=0x318) returned 1
	[0183.352] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.352] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.352] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2648d50, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0183.353] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.353] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.353] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0183.353] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.353] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2648e08*=0x1, dwFlags=0x0) returned 1
	[0183.353] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2648dd4, dwFlags=0x0) returned 1
	[0183.353] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2648e18*, pdwDataLen=0x55cf204*=0x360, dwBufLen=0x360 | out: pbData=0x2648e18*, pdwDataLen=0x55cf204*=0x360) returned 1
	[0183.353] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2649184*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2649184*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.353] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.353] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.353] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.353] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.353] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.355] GetFileType (hFile=0x318) returned 0x1
	[0183.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.355] GetFileType (hFile=0x318) returned 0x1
	[0183.355] WriteFile (in: hFile=0x318, lpBuffer=0x26493d8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26493d8*, lpNumberOfBytesWritten=0x55cf1c4*=0x360, lpOverlapped=0x0) returned 1
	[0183.356] CloseHandle (hObject=0x318) returned 1
	[0183.356] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.356] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0183.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.356] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa79f056c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0183.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.357] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.358] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0183.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.358] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x264a9e0 | out: lpFileInformation=0x264a9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35f)) returned 1
	[0183.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.358] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0183.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.359] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.359] GetFileType (hFile=0x318) returned 0x1
	[0183.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.359] GetFileType (hFile=0x318) returned 0x1
	[0183.359] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x35f
	[0183.359] ReadFile (in: hFile=0x318, lpBuffer=0x264b22c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x264b22c*, lpNumberOfBytesRead=0x55cf1fc*=0x35f, lpOverlapped=0x0) returned 1
	[0183.360] CloseHandle (hObject=0x318) returned 1
	[0183.361] CryptDestroyKey (hKey=0x82b540) returned 1
	[0183.361] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.361] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264c2c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b480) returned 1
	[0183.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.361] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0183.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.361] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x264c380*=0x1, dwFlags=0x0) returned 1
	[0183.361] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x264c34c, dwFlags=0x0) returned 1
	[0183.361] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264c390*, pdwDataLen=0x55cf204*=0x360, dwBufLen=0x360 | out: pbData=0x264c390*, pdwDataLen=0x55cf204*=0x360) returned 1
	[0183.361] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264c6fc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x264c6fc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.361] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.361] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.361] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.361] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0183.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.362] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.363] GetFileType (hFile=0x318) returned 0x1
	[0183.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.363] GetFileType (hFile=0x318) returned 0x1
	[0183.363] WriteFile (in: hFile=0x318, lpBuffer=0x264c978*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x264c978*, lpNumberOfBytesWritten=0x55cf1c4*=0x360, lpOverlapped=0x0) returned 1
	[0183.364] CloseHandle (hObject=0x318) returned 1
	[0183.364] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0183.364] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0183.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.365] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa79f056c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0183.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.365] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.368] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.368] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x264dfd0 | out: lpFileInformation=0x264dfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4)) returned 1
	[0183.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.399] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.399] GetFileType (hFile=0x318) returned 0x1
	[0183.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.400] GetFileType (hFile=0x318) returned 0x1
	[0183.400] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d4
	[0183.400] ReadFile (in: hFile=0x318, lpBuffer=0x264e760, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x264e760*, lpNumberOfBytesRead=0x55cf1fc*=0x2d4, lpOverlapped=0x0) returned 1
	[0183.419] CloseHandle (hObject=0x318) returned 1
	[0183.419] CryptDestroyKey (hKey=0x82b480) returned 1
	[0183.419] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.419] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264f7fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b040) returned 1
	[0183.419] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.419] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.419] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0183.419] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.419] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x264f8b4*=0x1, dwFlags=0x0) returned 1
	[0183.419] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x264f880, dwFlags=0x0) returned 1
	[0183.419] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264f8c4*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x264f8c4*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.420] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264fbb0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x264fbb0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.420] CryptDestroyKey (hKey=0x82b000) returned 1
	[0183.420] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.420] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.420] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.421] GetFileType (hFile=0x318) returned 0x1
	[0183.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.421] GetFileType (hFile=0x318) returned 0x1
	[0183.421] WriteFile (in: hFile=0x318, lpBuffer=0x264fe14*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x264fe14*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.422] CloseHandle (hObject=0x318) returned 1
	[0183.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0183.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.423] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7a88e1d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.423] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.424] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.424] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2651448 | out: lpFileInformation=0x2651448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8)) returned 1
	[0183.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.425] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.425] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.425] GetFileType (hFile=0x318) returned 0x1
	[0183.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.425] GetFileType (hFile=0x318) returned 0x1
	[0183.425] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d8
	[0183.425] ReadFile (in: hFile=0x318, lpBuffer=0x2651bdc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2651bdc*, lpNumberOfBytesRead=0x55cf1fc*=0x2d8, lpOverlapped=0x0) returned 1
	[0183.427] CloseHandle (hObject=0x318) returned 1
	[0183.428] CryptDestroyKey (hKey=0x82b040) returned 1
	[0183.428] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.428] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2652c78, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0183.428] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.428] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.428] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b040) returned 1
	[0183.428] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.428] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2652d30*=0x1, dwFlags=0x0) returned 1
	[0183.428] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2652cfc, dwFlags=0x0) returned 1
	[0183.428] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2652d40*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2652d40*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.428] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265302c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x265302c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.428] CryptDestroyKey (hKey=0x82b040) returned 1
	[0183.428] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.428] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.428] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.428] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.430] GetFileType (hFile=0x318) returned 0x1
	[0183.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.430] GetFileType (hFile=0x318) returned 0x1
	[0183.430] WriteFile (in: hFile=0x318, lpBuffer=0x2653290*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2653290*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.431] CloseHandle (hObject=0x318) returned 1
	[0183.431] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.431] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0183.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.431] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7a88e1d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.431] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.433] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.433] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26548c4 | out: lpFileInformation=0x26548c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0183.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.433] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.433] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.433] GetFileType (hFile=0x318) returned 0x1
	[0183.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.433] GetFileType (hFile=0x318) returned 0x1
	[0183.434] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1e0
	[0183.434] ReadFile (in: hFile=0x318, lpBuffer=0x2654ed0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2654ed0*, lpNumberOfBytesRead=0x55cf1fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0183.435] CloseHandle (hObject=0x318) returned 1
	[0183.435] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0183.435] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.435] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2655f6c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b100) returned 1
	[0183.435] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.435] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.435] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0183.435] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.435] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2656024*=0x1, dwFlags=0x0) returned 1
	[0183.435] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2655ff0, dwFlags=0x0) returned 1
	[0183.435] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2656034*, pdwDataLen=0x55cf204*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x2656034*, pdwDataLen=0x55cf204*=0x1f0) returned 1
	[0183.435] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2656230*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2656230*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.435] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0183.435] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.435] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.436] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.436] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.437] GetFileType (hFile=0x318) returned 0x1
	[0183.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.437] GetFileType (hFile=0x318) returned 0x1
	[0183.437] WriteFile (in: hFile=0x318, lpBuffer=0x265644c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x265644c*, lpNumberOfBytesWritten=0x55cf1c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0183.438] CloseHandle (hObject=0x318) returned 1
	[0183.438] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.438] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0183.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.438] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7aaf124, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0183.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.438] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.446] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0183.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.446] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26579f0 | out: lpFileInformation=0x26579f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0183.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.446] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0183.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.446] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.447] GetFileType (hFile=0x318) returned 0x1
	[0183.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.447] GetFileType (hFile=0x318) returned 0x1
	[0183.447] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2cb
	[0183.447] ReadFile (in: hFile=0x318, lpBuffer=0x2658188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2658188*, lpNumberOfBytesRead=0x55cf1fc*=0x2cb, lpOverlapped=0x0) returned 1
	[0183.449] CloseHandle (hObject=0x318) returned 1
	[0183.449] CryptDestroyKey (hKey=0x82b100) returned 1
	[0183.449] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.449] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2659224, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0183.449] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.449] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.449] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0183.449] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.449] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26592dc*=0x1, dwFlags=0x0) returned 1
	[0183.449] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x26592a8, dwFlags=0x0) returned 1
	[0183.449] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26592ec*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26592ec*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0183.449] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26595c8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26595c8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.450] CryptDestroyKey (hKey=0x82b100) returned 1
	[0183.450] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.450] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.450] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0183.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.450] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.451] GetFileType (hFile=0x318) returned 0x1
	[0183.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.451] GetFileType (hFile=0x318) returned 0x1
	[0183.451] WriteFile (in: hFile=0x318, lpBuffer=0x2659834*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2659834*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.452] CloseHandle (hObject=0x318) returned 1
	[0183.452] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0183.452] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0183.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.452] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7ad52d4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.452] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.453] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.453] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x265ae6c | out: lpFileInformation=0x265ae6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0183.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.454] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.454] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.454] GetFileType (hFile=0x318) returned 0x1
	[0183.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.454] GetFileType (hFile=0x318) returned 0x1
	[0183.454] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1e0
	[0183.455] ReadFile (in: hFile=0x318, lpBuffer=0x265b478, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x265b478*, lpNumberOfBytesRead=0x55cf1fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0183.455] CloseHandle (hObject=0x318) returned 1
	[0183.456] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.456] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.456] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265c514, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0183.456] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.456] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.456] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b440) returned 1
	[0183.456] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.456] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x265c5cc*=0x1, dwFlags=0x0) returned 1
	[0183.456] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x265c598, dwFlags=0x0) returned 1
	[0183.456] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265c5dc*, pdwDataLen=0x55cf204*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x265c5dc*, pdwDataLen=0x55cf204*=0x1f0) returned 1
	[0183.456] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265c7d8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x265c7d8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.456] CryptDestroyKey (hKey=0x82b440) returned 1
	[0183.456] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.456] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.456] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.457] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.458] GetFileType (hFile=0x318) returned 0x1
	[0183.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.458] GetFileType (hFile=0x318) returned 0x1
	[0183.458] WriteFile (in: hFile=0x318, lpBuffer=0x265c9f4*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x265c9f4*, lpNumberOfBytesWritten=0x55cf1c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0183.459] CloseHandle (hObject=0x318) returned 1
	[0183.459] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.459] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0183.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.459] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7ad52d4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0183.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.459] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.463] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0183.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.463] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x265df98 | out: lpFileInformation=0x265df98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.463] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0183.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.463] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.464] GetFileType (hFile=0x318) returned 0x1
	[0183.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.464] GetFileType (hFile=0x318) returned 0x1
	[0183.464] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d0
	[0183.464] ReadFile (in: hFile=0x318, lpBuffer=0x265e734, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x265e734*, lpNumberOfBytesRead=0x55cf1fc*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.465] CloseHandle (hObject=0x318) returned 1
	[0183.465] CryptDestroyKey (hKey=0x82b300) returned 1
	[0183.465] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.465] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265f7d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0183.466] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.466] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.466] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0183.466] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.466] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x265f888*=0x1, dwFlags=0x0) returned 1
	[0183.466] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x265f854, dwFlags=0x0) returned 1
	[0183.466] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265f898*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x265f898*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.466] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265fb84*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x265fb84*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.466] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0183.466] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.466] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0183.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.466] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.467] GetFileType (hFile=0x318) returned 0x1
	[0183.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.468] GetFileType (hFile=0x318) returned 0x1
	[0183.468] WriteFile (in: hFile=0x318, lpBuffer=0x265fdf0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x265fdf0*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.469] CloseHandle (hObject=0x318) returned 1
	[0183.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0183.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd2
	[0183.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.469] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7afbb16, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.469] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.470] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0183.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.470] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2661434 | out: lpFileInformation=0x2661434*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284)) returned 1
	[0183.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.470] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0183.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.471] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.471] GetFileType (hFile=0x318) returned 0x1
	[0183.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.471] GetFileType (hFile=0x318) returned 0x1
	[0183.471] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x284
	[0183.471] ReadFile (in: hFile=0x318, lpBuffer=0x2661b64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2661b64*, lpNumberOfBytesRead=0x55cf1fc*=0x284, lpOverlapped=0x0) returned 1
	[0183.482] CloseHandle (hObject=0x318) returned 1
	[0183.483] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.483] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.483] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2662c00, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0183.483] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.483] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.483] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0183.483] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.483] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2662cb8*=0x1, dwFlags=0x0) returned 1
	[0183.483] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2662c84, dwFlags=0x0) returned 1
	[0183.483] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2662cc8*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x2662cc8*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0183.483] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2662f64*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2662f64*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.483] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.483] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.483] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0183.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.483] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.485] GetFileType (hFile=0x318) returned 0x1
	[0183.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.485] GetFileType (hFile=0x318) returned 0x1
	[0183.485] WriteFile (in: hFile=0x318, lpBuffer=0x26631c0*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26631c0*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0183.486] CloseHandle (hObject=0x318) returned 1
	[0183.486] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0183.486] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0183.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.486] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7b217f8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0183.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.486] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.487] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.487] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26647d8 | out: lpFileInformation=0x26647d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2)) returned 1
	[0183.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.488] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.488] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.488] GetFileType (hFile=0x318) returned 0x1
	[0183.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.488] GetFileType (hFile=0x318) returned 0x1
	[0183.488] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d2
	[0183.488] ReadFile (in: hFile=0x318, lpBuffer=0x2664f88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2664f88*, lpNumberOfBytesRead=0x55cf1fc*=0x2d2, lpOverlapped=0x0) returned 1
	[0183.490] CloseHandle (hObject=0x318) returned 1
	[0183.490] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0183.490] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.490] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2666024, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b040) returned 1
	[0183.490] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.490] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.490] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0183.490] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.490] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26660dc*=0x1, dwFlags=0x0) returned 1
	[0183.490] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26660a8, dwFlags=0x0) returned 1
	[0183.490] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26660ec*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26660ec*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.490] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26663d8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26663d8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.490] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0183.490] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.491] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.491] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.491] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.492] GetFileType (hFile=0x318) returned 0x1
	[0183.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.492] GetFileType (hFile=0x318) returned 0x1
	[0183.492] WriteFile (in: hFile=0x318, lpBuffer=0x266664c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x266664c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.493] CloseHandle (hObject=0x318) returned 1
	[0183.493] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.493] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0183.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.493] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7b217f8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.493] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.494] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.495] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2667c94 | out: lpFileInformation=0x2667c94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0183.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.495] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.495] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.495] GetFileType (hFile=0x318) returned 0x1
	[0183.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.495] GetFileType (hFile=0x318) returned 0x1
	[0183.495] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2cf
	[0183.496] ReadFile (in: hFile=0x318, lpBuffer=0x2668400, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2668400*, lpNumberOfBytesRead=0x55cf1fc*=0x2cf, lpOverlapped=0x0) returned 1
	[0183.497] CloseHandle (hObject=0x318) returned 1
	[0183.497] CryptDestroyKey (hKey=0x82b040) returned 1
	[0183.497] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.497] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266949c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b440) returned 1
	[0183.497] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.498] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.498] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0183.498] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.498] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2669554*=0x1, dwFlags=0x0) returned 1
	[0183.498] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2669520, dwFlags=0x0) returned 1
	[0183.498] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2669564*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2669564*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0183.498] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2669840*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2669840*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.498] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0183.498] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.498] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.498] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.499] GetFileType (hFile=0x318) returned 0x1
	[0183.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.499] GetFileType (hFile=0x318) returned 0x1
	[0183.500] WriteFile (in: hFile=0x318, lpBuffer=0x2669a94*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2669a94*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.500] CloseHandle (hObject=0x318) returned 1
	[0183.501] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.501] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0183.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.501] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7b47b3f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.501] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.502] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.502] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x266b09c | out: lpFileInformation=0x266b09c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.502] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.502] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.503] GetFileType (hFile=0x318) returned 0x1
	[0183.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.503] GetFileType (hFile=0x318) returned 0x1
	[0183.503] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d0
	[0183.503] ReadFile (in: hFile=0x318, lpBuffer=0x266b848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x266b848*, lpNumberOfBytesRead=0x55cf1fc*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.517] CloseHandle (hObject=0x318) returned 1
	[0183.517] CryptDestroyKey (hKey=0x82b440) returned 1
	[0183.517] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.517] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266c8e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0183.517] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.518] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.518] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0183.518] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.518] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x266c99c*=0x1, dwFlags=0x0) returned 1
	[0183.518] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x266c968, dwFlags=0x0) returned 1
	[0183.518] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266c9ac*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x266c9ac*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.518] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266cc98*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x266cc98*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.518] CryptDestroyKey (hKey=0x82b480) returned 1
	[0183.518] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.518] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.518] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.518] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.520] GetFileType (hFile=0x318) returned 0x1
	[0183.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.520] GetFileType (hFile=0x318) returned 0x1
	[0183.520] WriteFile (in: hFile=0x318, lpBuffer=0x266cf0c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x266cf0c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.521] CloseHandle (hObject=0x318) returned 1
	[0183.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0183.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.521] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7b6dcf7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.521] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.522] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.522] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x266e554 | out: lpFileInformation=0x266e554*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da)) returned 1
	[0183.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.778] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.778] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.778] GetFileType (hFile=0x318) returned 0x1
	[0183.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.778] GetFileType (hFile=0x318) returned 0x1
	[0183.778] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d3
	[0183.778] ReadFile (in: hFile=0x318, lpBuffer=0x26a2ac8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26a2ac8*, lpNumberOfBytesRead=0x55cf1fc*=0x2d3, lpOverlapped=0x0) returned 1
	[0183.779] CloseHandle (hObject=0x318) returned 1
	[0183.780] CryptDestroyKey (hKey=0x82b440) returned 1
	[0183.780] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.780] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a3b64, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0183.780] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.780] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.780] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0183.780] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.780] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26a3c1c*=0x1, dwFlags=0x0) returned 1
	[0183.780] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26a3be8, dwFlags=0x0) returned 1
	[0183.780] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a3c2c*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26a3c2c*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.780] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a3f18*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26a3f18*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.780] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.780] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.780] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.780] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.780] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.782] GetFileType (hFile=0x318) returned 0x1
	[0183.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.782] GetFileType (hFile=0x318) returned 0x1
	[0183.782] WriteFile (in: hFile=0x318, lpBuffer=0x26a416c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26a416c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.783] CloseHandle (hObject=0x318) returned 1
	[0183.783] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.783] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0183.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.783] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7df6543, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.783] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.784] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.785] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26a5780 | out: lpFileInformation=0x26a5780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1)) returned 1
	[0183.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.785] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.785] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.785] GetFileType (hFile=0x318) returned 0x1
	[0183.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.785] GetFileType (hFile=0x318) returned 0x1
	[0183.785] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d1
	[0183.785] ReadFile (in: hFile=0x318, lpBuffer=0x26a5ef0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26a5ef0*, lpNumberOfBytesRead=0x55cf1fc*=0x2d1, lpOverlapped=0x0) returned 1
	[0183.787] CloseHandle (hObject=0x318) returned 1
	[0183.787] CryptDestroyKey (hKey=0x82b540) returned 1
	[0183.787] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.788] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a6f8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0183.788] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.788] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.788] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0183.788] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.788] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26a7044*=0x1, dwFlags=0x0) returned 1
	[0183.788] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26a7010, dwFlags=0x0) returned 1
	[0183.788] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a7054*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26a7054*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.788] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a7340*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26a7340*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.788] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0183.788] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.788] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.788] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.788] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.790] GetFileType (hFile=0x318) returned 0x1
	[0183.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.790] GetFileType (hFile=0x318) returned 0x1
	[0183.790] WriteFile (in: hFile=0x318, lpBuffer=0x26a7594*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26a7594*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.791] CloseHandle (hObject=0x318) returned 1
	[0183.791] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.791] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0183.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.791] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7e1c6f9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.792] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.793] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.793] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26a8ba8 | out: lpFileInformation=0x26a8ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9)) returned 1
	[0183.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.793] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.793] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.793] GetFileType (hFile=0x318) returned 0x1
	[0183.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.794] GetFileType (hFile=0x318) returned 0x1
	[0183.794] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d9
	[0183.794] ReadFile (in: hFile=0x318, lpBuffer=0x26a9320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26a9320*, lpNumberOfBytesRead=0x55cf1fc*=0x2d9, lpOverlapped=0x0) returned 1
	[0183.797] CloseHandle (hObject=0x318) returned 1
	[0183.797] CryptDestroyKey (hKey=0x82b400) returned 1
	[0183.797] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.798] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26aa3bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0183.798] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.798] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.798] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0183.798] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.798] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26aa474*=0x1, dwFlags=0x0) returned 1
	[0183.799] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26aa440, dwFlags=0x0) returned 1
	[0183.799] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26aa484*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26aa484*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.799] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26aa770*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26aa770*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.799] CryptDestroyKey (hKey=0x82b340) returned 1
	[0183.799] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.799] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.800] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.800] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.803] GetFileType (hFile=0x318) returned 0x1
	[0183.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.803] GetFileType (hFile=0x318) returned 0x1
	[0183.803] WriteFile (in: hFile=0x318, lpBuffer=0x26aa9c4*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26aa9c4*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.804] CloseHandle (hObject=0x318) returned 1
	[0183.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0183.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.804] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7e1c6f9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.805] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.806] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.806] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26abfd8 | out: lpFileInformation=0x26abfd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4)) returned 1
	[0183.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.806] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.806] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.807] GetFileType (hFile=0x318) returned 0x1
	[0183.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.807] GetFileType (hFile=0x318) returned 0x1
	[0183.807] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d4
	[0183.807] ReadFile (in: hFile=0x318, lpBuffer=0x26ac748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26ac748*, lpNumberOfBytesRead=0x55cf1fc*=0x2d4, lpOverlapped=0x0) returned 1
	[0183.809] CloseHandle (hObject=0x318) returned 1
	[0183.809] CryptDestroyKey (hKey=0x82b380) returned 1
	[0183.809] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.809] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ad7e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0183.809] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.809] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.809] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0183.809] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.809] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x26ad89c*=0x1, dwFlags=0x0) returned 1
	[0183.809] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x26ad868, dwFlags=0x0) returned 1
	[0183.809] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ad8ac*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26ad8ac*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.809] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26adb98*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26adb98*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.810] CryptDestroyKey (hKey=0x82b080) returned 1
	[0183.810] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.810] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.810] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.810] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.811] GetFileType (hFile=0x318) returned 0x1
	[0183.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.811] GetFileType (hFile=0x318) returned 0x1
	[0183.811] WriteFile (in: hFile=0x318, lpBuffer=0x26addec*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26addec*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.812] CloseHandle (hObject=0x318) returned 1
	[0183.813] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.813] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0183.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.813] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7e429dd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.813] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.814] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.814] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26af400 | out: lpFileInformation=0x26af400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4)) returned 1
	[0183.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.815] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.815] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.815] GetFileType (hFile=0x318) returned 0x1
	[0183.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.815] GetFileType (hFile=0x318) returned 0x1
	[0183.815] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d4
	[0183.815] ReadFile (in: hFile=0x318, lpBuffer=0x26afb70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26afb70*, lpNumberOfBytesRead=0x55cf1fc*=0x2d4, lpOverlapped=0x0) returned 1
	[0183.879] CloseHandle (hObject=0x318) returned 1
	[0183.879] CryptDestroyKey (hKey=0x82b540) returned 1
	[0183.879] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.880] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b0c0c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b400) returned 1
	[0183.880] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.880] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.880] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0183.880] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.880] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26b0cc4*=0x1, dwFlags=0x0) returned 1
	[0183.880] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26b0c90, dwFlags=0x0) returned 1
	[0183.880] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b0cd4*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26b0cd4*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.880] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b0fc0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26b0fc0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.880] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.880] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.880] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.880] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.880] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.882] GetFileType (hFile=0x318) returned 0x1
	[0183.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.882] GetFileType (hFile=0x318) returned 0x1
	[0183.882] WriteFile (in: hFile=0x318, lpBuffer=0x26b1214*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26b1214*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.883] CloseHandle (hObject=0x318) returned 1
	[0183.883] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.883] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0183.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.883] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7edb31b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.883] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.885] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.885] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b281c | out: lpFileInformation=0x26b281c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc)) returned 1
	[0183.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.885] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.886] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.886] GetFileType (hFile=0x318) returned 0x1
	[0183.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.886] GetFileType (hFile=0x318) returned 0x1
	[0183.886] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2dc
	[0183.886] ReadFile (in: hFile=0x318, lpBuffer=0x26b2f94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26b2f94*, lpNumberOfBytesRead=0x55cf1fc*=0x2dc, lpOverlapped=0x0) returned 1
	[0183.887] CloseHandle (hObject=0x318) returned 1
	[0183.888] CryptDestroyKey (hKey=0x82b400) returned 1
	[0183.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.888] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b4030, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0183.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.888] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0183.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.888] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26b40e8*=0x1, dwFlags=0x0) returned 1
	[0183.888] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26b40b4, dwFlags=0x0) returned 1
	[0183.888] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b40f8*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26b40f8*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.888] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b43e4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26b43e4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.888] CryptDestroyKey (hKey=0x82b480) returned 1
	[0183.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.888] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.888] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.890] GetFileType (hFile=0x318) returned 0x1
	[0183.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.890] GetFileType (hFile=0x318) returned 0x1
	[0183.890] WriteFile (in: hFile=0x318, lpBuffer=0x26b4638*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26b4638*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.891] CloseHandle (hObject=0x318) returned 1
	[0183.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0183.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.891] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7f0210a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.891] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.893] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.893] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b5c4c | out: lpFileInformation=0x26b5c4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd)) returned 1
	[0183.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.894] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.894] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.894] GetFileType (hFile=0x318) returned 0x1
	[0183.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.894] GetFileType (hFile=0x318) returned 0x1
	[0183.894] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2bd
	[0183.894] ReadFile (in: hFile=0x318, lpBuffer=0x26b63c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26b63c8*, lpNumberOfBytesRead=0x55cf1fc*=0x2bd, lpOverlapped=0x0) returned 1
	[0183.895] CloseHandle (hObject=0x318) returned 1
	[0183.895] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.896] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.896] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b7464, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0183.896] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.896] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.896] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0183.896] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.896] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26b751c*=0x1, dwFlags=0x0) returned 1
	[0183.896] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26b74e8, dwFlags=0x0) returned 1
	[0183.896] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b752c*, pdwDataLen=0x55cf204*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x26b752c*, pdwDataLen=0x55cf204*=0x2c0) returned 1
	[0183.896] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b77f8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26b77f8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.896] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0183.896] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.896] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.896] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.896] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.898] GetFileType (hFile=0x318) returned 0x1
	[0183.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.898] GetFileType (hFile=0x318) returned 0x1
	[0183.898] WriteFile (in: hFile=0x318, lpBuffer=0x26b7a5c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26b7a5c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0183.899] CloseHandle (hObject=0x318) returned 1
	[0183.899] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.899] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0183.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.899] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7f0210a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0183.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.900] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.901] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.901] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b9084 | out: lpFileInformation=0x26b9084*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286)) returned 1
	[0183.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.901] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.901] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.902] GetFileType (hFile=0x318) returned 0x1
	[0183.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.902] GetFileType (hFile=0x318) returned 0x1
	[0183.902] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x286
	[0183.902] ReadFile (in: hFile=0x318, lpBuffer=0x26b97c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26b97c8*, lpNumberOfBytesRead=0x55cf1fc*=0x286, lpOverlapped=0x0) returned 1
	[0183.903] CloseHandle (hObject=0x318) returned 1
	[0183.903] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0183.903] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.903] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ba864, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b440) returned 1
	[0183.904] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.904] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.904] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0183.904] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.904] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26ba91c*=0x1, dwFlags=0x0) returned 1
	[0183.904] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26ba8e8, dwFlags=0x0) returned 1
	[0183.904] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ba92c*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x26ba92c*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0183.904] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26babc8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26babc8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.904] CryptDestroyKey (hKey=0x82b480) returned 1
	[0183.904] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.904] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.904] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.904] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.905] GetFileType (hFile=0x318) returned 0x1
	[0183.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.906] GetFileType (hFile=0x318) returned 0x1
	[0183.906] WriteFile (in: hFile=0x318, lpBuffer=0x26bae2c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26bae2c*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0183.907] CloseHandle (hObject=0x318) returned 1
	[0183.907] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.907] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0183.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.907] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7f277e2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0183.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.907] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.908] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.908] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26bc454 | out: lpFileInformation=0x26bc454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282)) returned 1
	[0183.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.909] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.909] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.909] GetFileType (hFile=0x318) returned 0x1
	[0183.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.909] GetFileType (hFile=0x318) returned 0x1
	[0183.909] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x282
	[0183.909] ReadFile (in: hFile=0x318, lpBuffer=0x26bcb94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26bcb94*, lpNumberOfBytesRead=0x55cf1fc*=0x282, lpOverlapped=0x0) returned 1
	[0183.911] CloseHandle (hObject=0x318) returned 1
	[0183.911] CryptDestroyKey (hKey=0x82b440) returned 1
	[0183.911] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.911] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bdc30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0183.911] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.911] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.911] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b040) returned 1
	[0183.911] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.911] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x26bdce8*=0x1, dwFlags=0x0) returned 1
	[0183.911] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x26bdcb4, dwFlags=0x0) returned 1
	[0183.911] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bdcf8*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x26bdcf8*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0183.911] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bdf94*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26bdf94*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.911] CryptDestroyKey (hKey=0x82b040) returned 1
	[0183.911] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.911] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.911] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.912] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.913] GetFileType (hFile=0x318) returned 0x1
	[0183.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.913] GetFileType (hFile=0x318) returned 0x1
	[0183.913] WriteFile (in: hFile=0x318, lpBuffer=0x26be1f8*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26be1f8*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0183.914] CloseHandle (hObject=0x318) returned 1
	[0183.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0183.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0183.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.914] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7f277e2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0183.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.915] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.948] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0183.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.948] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26bf820 | out: lpFileInformation=0x26bf820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db)) returned 1
	[0183.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.948] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0183.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.949] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.949] GetFileType (hFile=0x318) returned 0x1
	[0183.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.949] GetFileType (hFile=0x318) returned 0x1
	[0183.949] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2db
	[0183.949] ReadFile (in: hFile=0x318, lpBuffer=0x26c0018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26c0018*, lpNumberOfBytesRead=0x55cf1fc*=0x2db, lpOverlapped=0x0) returned 1
	[0183.951] CloseHandle (hObject=0x318) returned 1
	[0183.951] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.951] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.951] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c10b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0183.951] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.951] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.951] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b5c0) returned 1
	[0183.951] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.951] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26c116c*=0x1, dwFlags=0x0) returned 1
	[0183.951] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26c1138, dwFlags=0x0) returned 1
	[0183.951] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c117c*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26c117c*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.951] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c1468*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26c1468*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.951] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0183.951] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.951] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0183.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.952] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.953] GetFileType (hFile=0x318) returned 0x1
	[0183.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.953] GetFileType (hFile=0x318) returned 0x1
	[0183.953] WriteFile (in: hFile=0x318, lpBuffer=0x26c16fc*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26c16fc*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.954] CloseHandle (hObject=0x318) returned 1
	[0183.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0183.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdc
	[0183.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.954] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7f99ebf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.954] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.955] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0183.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.955] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26c2d90 | out: lpFileInformation=0x26c2d90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286)) returned 1
	[0183.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.956] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0183.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.956] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.956] GetFileType (hFile=0x318) returned 0x1
	[0183.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.956] GetFileType (hFile=0x318) returned 0x1
	[0183.956] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x286
	[0183.956] ReadFile (in: hFile=0x318, lpBuffer=0x26c34f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26c34f4*, lpNumberOfBytesRead=0x55cf1fc*=0x286, lpOverlapped=0x0) returned 1
	[0183.958] CloseHandle (hObject=0x318) returned 1
	[0183.958] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.958] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.958] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c4590, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b100) returned 1
	[0183.958] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.958] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.958] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0183.958] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.958] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26c4648*=0x1, dwFlags=0x0) returned 1
	[0183.958] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26c4614, dwFlags=0x0) returned 1
	[0183.958] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c4658*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x26c4658*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0183.958] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c48f4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26c48f4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.958] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0183.958] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.958] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.959] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0183.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.959] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.960] GetFileType (hFile=0x318) returned 0x1
	[0183.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.960] GetFileType (hFile=0x318) returned 0x1
	[0183.960] WriteFile (in: hFile=0x318, lpBuffer=0x26c4b68*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26c4b68*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0183.961] CloseHandle (hObject=0x318) returned 1
	[0183.961] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0183.961] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0183.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.961] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7f99ebf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0183.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.961] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.962] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.963] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26c61bc | out: lpFileInformation=0x26c61bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7)) returned 1
	[0183.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.963] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.963] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.963] GetFileType (hFile=0x318) returned 0x1
	[0183.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.963] GetFileType (hFile=0x318) returned 0x1
	[0183.963] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d7
	[0183.964] ReadFile (in: hFile=0x318, lpBuffer=0x26c6970, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26c6970*, lpNumberOfBytesRead=0x55cf1fc*=0x2d7, lpOverlapped=0x0) returned 1
	[0183.965] CloseHandle (hObject=0x318) returned 1
	[0183.965] CryptDestroyKey (hKey=0x82b100) returned 1
	[0183.965] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.965] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c7a0c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0183.965] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.965] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.965] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0183.965] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.965] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26c7ac4*=0x1, dwFlags=0x0) returned 1
	[0183.965] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26c7a90, dwFlags=0x0) returned 1
	[0183.965] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c7ad4*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26c7ad4*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.966] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c7dc0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26c7dc0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.966] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.966] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.966] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.966] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.966] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.967] GetFileType (hFile=0x318) returned 0x1
	[0183.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.967] GetFileType (hFile=0x318) returned 0x1
	[0183.967] WriteFile (in: hFile=0x318, lpBuffer=0x26c8034*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26c8034*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.968] CloseHandle (hObject=0x318) returned 1
	[0183.968] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.968] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0183.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.968] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7fc0160, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.968] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.969] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.970] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26c967c | out: lpFileInformation=0x26c967c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db)) returned 1
	[0183.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.970] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.970] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.970] GetFileType (hFile=0x318) returned 0x1
	[0183.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.970] GetFileType (hFile=0x318) returned 0x1
	[0183.970] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2db
	[0183.970] ReadFile (in: hFile=0x318, lpBuffer=0x26c9e14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26c9e14*, lpNumberOfBytesRead=0x55cf1fc*=0x2db, lpOverlapped=0x0) returned 1
	[0183.972] CloseHandle (hObject=0x318) returned 1
	[0183.972] CryptDestroyKey (hKey=0x82b540) returned 1
	[0183.972] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.972] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26caeb0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b200) returned 1
	[0183.972] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.972] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.972] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0183.972] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.972] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26caf68*=0x1, dwFlags=0x0) returned 1
	[0183.972] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26caf34, dwFlags=0x0) returned 1
	[0183.972] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26caf78*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26caf78*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0183.973] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26cb264*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26cb264*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.973] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.973] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.973] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.973] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.974] GetFileType (hFile=0x318) returned 0x1
	[0183.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.974] GetFileType (hFile=0x318) returned 0x1
	[0183.974] WriteFile (in: hFile=0x318, lpBuffer=0x26cb4c8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26cb4c8*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.975] CloseHandle (hObject=0x318) returned 1
	[0183.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0183.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.975] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7fc0160, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.976] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.977] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.977] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26ccafc | out: lpFileInformation=0x26ccafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e3)) returned 1
	[0183.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.977] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.977] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.977] GetFileType (hFile=0x318) returned 0x1
	[0183.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.978] GetFileType (hFile=0x318) returned 0x1
	[0183.978] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2e3
	[0183.978] ReadFile (in: hFile=0x318, lpBuffer=0x26cd29c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26cd29c*, lpNumberOfBytesRead=0x55cf1fc*=0x2e3, lpOverlapped=0x0) returned 1
	[0183.979] CloseHandle (hObject=0x318) returned 1
	[0183.979] CryptDestroyKey (hKey=0x82b200) returned 1
	[0183.979] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.979] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ce338, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0183.979] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.980] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.980] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0183.980] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.980] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26ce3f0*=0x1, dwFlags=0x0) returned 1
	[0183.980] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26ce3bc, dwFlags=0x0) returned 1
	[0183.980] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ce400*, pdwDataLen=0x55cf204*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x26ce400*, pdwDataLen=0x55cf204*=0x2f0) returned 1
	[0183.980] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ce6fc*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26ce6fc*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0183.980] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.980] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.980] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.980] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0183.980] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.981] GetFileType (hFile=0x318) returned 0x1
	[0183.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0183.981] GetFileType (hFile=0x318) returned 0x1
	[0183.981] WriteFile (in: hFile=0x318, lpBuffer=0x26ce960*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26ce960*, lpNumberOfBytesWritten=0x55cf1c4*=0x2f0, lpOverlapped=0x0) returned 1
	[0183.982] CloseHandle (hObject=0x318) returned 1
	[0183.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0183.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0183.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0183.982] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7fe633d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0183.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0183.983] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.983] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0183.983] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26cff94 | out: lpFileInformation=0x26cff94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0183.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0183.984] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0183.984] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.984] GetFileType (hFile=0x318) returned 0x1
	[0183.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0183.984] GetFileType (hFile=0x318) returned 0x1
	[0183.984] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1e0
	[0183.984] ReadFile (in: hFile=0x318, lpBuffer=0x26d05a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26d05a0*, lpNumberOfBytesRead=0x55cf1fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0184.004] CloseHandle (hObject=0x318) returned 1
	[0184.004] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0184.004] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.004] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d163c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0184.004] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.004] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.004] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0184.004] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.004] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26d16f4*=0x1, dwFlags=0x0) returned 1
	[0184.004] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26d16c0, dwFlags=0x0) returned 1
	[0184.005] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d1704*, pdwDataLen=0x55cf204*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x26d1704*, pdwDataLen=0x55cf204*=0x1f0) returned 1
	[0184.005] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d1900*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26d1900*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.005] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0184.005] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.005] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.005] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.005] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.006] GetFileType (hFile=0x318) returned 0x1
	[0184.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.006] GetFileType (hFile=0x318) returned 0x1
	[0184.006] WriteFile (in: hFile=0x318, lpBuffer=0x26d1b1c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26d1b1c*, lpNumberOfBytesWritten=0x55cf1c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0184.007] CloseHandle (hObject=0x318) returned 1
	[0184.007] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.007] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0184.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.007] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa800c610, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0184.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.007] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.009] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0184.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.009] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26d30c0 | out: lpFileInformation=0x26d30c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0184.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.010] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0184.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.010] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.010] GetFileType (hFile=0x318) returned 0x1
	[0184.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.010] GetFileType (hFile=0x318) returned 0x1
	[0184.010] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1d0
	[0184.010] ReadFile (in: hFile=0x318, lpBuffer=0x26d372c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26d372c*, lpNumberOfBytesRead=0x55cf1fc*=0x1d0, lpOverlapped=0x0) returned 1
	[0184.011] CloseHandle (hObject=0x318) returned 1
	[0184.011] CryptDestroyKey (hKey=0x82b340) returned 1
	[0184.011] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.011] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d47c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b100) returned 1
	[0184.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.011] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0184.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.011] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26d4880*=0x1, dwFlags=0x0) returned 1
	[0184.011] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26d484c, dwFlags=0x0) returned 1
	[0184.011] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d4890*, pdwDataLen=0x55cf204*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x26d4890*, pdwDataLen=0x55cf204*=0x1e0) returned 1
	[0184.011] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d4a7c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26d4a7c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.012] CryptDestroyKey (hKey=0x82b280) returned 1
	[0184.012] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.012] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.012] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0184.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.012] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.013] GetFileType (hFile=0x318) returned 0x1
	[0184.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.013] GetFileType (hFile=0x318) returned 0x1
	[0184.013] WriteFile (in: hFile=0x318, lpBuffer=0x26d4cd0*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26d4cd0*, lpNumberOfBytesWritten=0x55cf1c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0184.014] CloseHandle (hObject=0x318) returned 1
	[0184.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0184.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0184.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.014] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa80327cd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0184.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.014] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.016] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26d62e4 | out: lpFileInformation=0x26d62e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285)) returned 1
	[0184.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.016] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.017] GetFileType (hFile=0x318) returned 0x1
	[0184.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.017] GetFileType (hFile=0x318) returned 0x1
	[0184.017] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x285
	[0184.017] ReadFile (in: hFile=0x318, lpBuffer=0x26d6a18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26d6a18*, lpNumberOfBytesRead=0x55cf1fc*=0x285, lpOverlapped=0x0) returned 1
	[0184.019] CloseHandle (hObject=0x318) returned 1
	[0184.019] CryptDestroyKey (hKey=0x82b100) returned 1
	[0184.019] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.019] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d7ab4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b0c0) returned 1
	[0184.019] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.019] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.019] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0184.019] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.019] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26d7b6c*=0x1, dwFlags=0x0) returned 1
	[0184.019] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26d7b38, dwFlags=0x0) returned 1
	[0184.019] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d7b7c*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x26d7b7c*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0184.019] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d7e18*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26d7e18*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.019] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.019] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.019] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.019] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.020] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.021] GetFileType (hFile=0x318) returned 0x1
	[0184.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.021] GetFileType (hFile=0x318) returned 0x1
	[0184.021] WriteFile (in: hFile=0x318, lpBuffer=0x26d8074*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26d8074*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0184.022] CloseHandle (hObject=0x318) returned 1
	[0184.022] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.022] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0184.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.022] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa80327cd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0184.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.023] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.024] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0184.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.024] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26d9698 | out: lpFileInformation=0x26d9698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6)) returned 1
	[0184.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.024] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0184.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.024] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.024] GetFileType (hFile=0x318) returned 0x1
	[0184.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.024] GetFileType (hFile=0x318) returned 0x1
	[0184.024] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d6
	[0184.025] ReadFile (in: hFile=0x318, lpBuffer=0x26d9e5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26d9e5c*, lpNumberOfBytesRead=0x55cf1fc*=0x2d6, lpOverlapped=0x0) returned 1
	[0184.026] CloseHandle (hObject=0x318) returned 1
	[0184.026] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0184.026] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.027] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26daef8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b4c0) returned 1
	[0184.027] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.027] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.027] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0184.027] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.027] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x26dafb0*=0x1, dwFlags=0x0) returned 1
	[0184.027] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x26daf7c, dwFlags=0x0) returned 1
	[0184.027] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26dafc0*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26dafc0*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0184.027] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26db2ac*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26db2ac*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.027] CryptDestroyKey (hKey=0x82b000) returned 1
	[0184.027] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.027] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.027] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0184.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.027] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.029] GetFileType (hFile=0x318) returned 0x1
	[0184.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.029] GetFileType (hFile=0x318) returned 0x1
	[0184.029] WriteFile (in: hFile=0x318, lpBuffer=0x26db528*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26db528*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0184.030] CloseHandle (hObject=0x318) returned 1
	[0184.030] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0184.030] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0184.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.030] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8058a61, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0184.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.030] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.031] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26dcb80 | out: lpFileInformation=0x26dcb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0184.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.032] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.032] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.032] GetFileType (hFile=0x318) returned 0x1
	[0184.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.032] GetFileType (hFile=0x318) returned 0x1
	[0184.033] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1e0
	[0184.033] ReadFile (in: hFile=0x318, lpBuffer=0x26dd18c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26dd18c*, lpNumberOfBytesRead=0x55cf1fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0184.034] CloseHandle (hObject=0x318) returned 1
	[0184.034] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0184.034] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.034] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26de228, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0184.034] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.034] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.034] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b0c0) returned 1
	[0184.034] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.034] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26de2e0*=0x1, dwFlags=0x0) returned 1
	[0184.034] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x26de2ac, dwFlags=0x0) returned 1
	[0184.034] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26de2f0*, pdwDataLen=0x55cf204*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x26de2f0*, pdwDataLen=0x55cf204*=0x1f0) returned 1
	[0184.034] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26de4ec*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26de4ec*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.034] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0184.034] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.034] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.034] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.034] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.035] GetFileType (hFile=0x318) returned 0x1
	[0184.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.035] GetFileType (hFile=0x318) returned 0x1
	[0184.035] WriteFile (in: hFile=0x318, lpBuffer=0x26de708*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26de708*, lpNumberOfBytesWritten=0x55cf1c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0184.036] CloseHandle (hObject=0x318) returned 1
	[0184.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0184.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.036] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8058a61, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0184.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.037] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.038] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.038] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26dfcac | out: lpFileInformation=0x26dfcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0184.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.038] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.039] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.039] GetFileType (hFile=0x318) returned 0x1
	[0184.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.039] GetFileType (hFile=0x318) returned 0x1
	[0184.039] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c3
	[0184.039] ReadFile (in: hFile=0x318, lpBuffer=0x26e03fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26e03fc*, lpNumberOfBytesRead=0x55cf1fc*=0x2c3, lpOverlapped=0x0) returned 1
	[0184.057] CloseHandle (hObject=0x318) returned 1
	[0184.057] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0184.057] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.057] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e1498, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0184.058] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.058] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.058] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b400) returned 1
	[0184.058] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.058] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x26e1550*=0x1, dwFlags=0x0) returned 1
	[0184.058] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26e151c, dwFlags=0x0) returned 1
	[0184.058] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e1560*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26e1560*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0184.058] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e183c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26e183c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.058] CryptDestroyKey (hKey=0x82b400) returned 1
	[0184.058] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.058] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.058] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.058] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.060] GetFileType (hFile=0x318) returned 0x1
	[0184.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.060] GetFileType (hFile=0x318) returned 0x1
	[0184.060] WriteFile (in: hFile=0x318, lpBuffer=0x26e1a88*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26e1a88*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.061] CloseHandle (hObject=0x318) returned 1
	[0184.061] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.061] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0184.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.061] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa80a4f4d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.061] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.066] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26e3080 | out: lpFileInformation=0x26e3080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0184.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.067] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.067] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.067] GetFileType (hFile=0x318) returned 0x1
	[0184.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.067] GetFileType (hFile=0x318) returned 0x1
	[0184.067] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2cc
	[0184.067] ReadFile (in: hFile=0x318, lpBuffer=0x26e37d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26e37d8*, lpNumberOfBytesRead=0x55cf1fc*=0x2cc, lpOverlapped=0x0) returned 1
	[0184.068] CloseHandle (hObject=0x318) returned 1
	[0184.069] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0184.069] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.069] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e4874, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0184.069] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.069] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.069] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0184.069] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.069] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26e492c*=0x1, dwFlags=0x0) returned 1
	[0184.069] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26e48f8, dwFlags=0x0) returned 1
	[0184.069] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e493c*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26e493c*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0184.069] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e4c18*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26e4c18*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.069] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0184.069] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.069] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.069] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.070] GetFileType (hFile=0x318) returned 0x1
	[0184.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.070] GetFileType (hFile=0x318) returned 0x1
	[0184.071] WriteFile (in: hFile=0x318, lpBuffer=0x26e4e64*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26e4e64*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.071] CloseHandle (hObject=0x318) returned 1
	[0184.072] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.072] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0184.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.072] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa80a4f4d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.072] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.073] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.073] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26e645c | out: lpFileInformation=0x26e645c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286)) returned 1
	[0184.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.074] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.074] GetFileType (hFile=0x318) returned 0x1
	[0184.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.074] GetFileType (hFile=0x318) returned 0x1
	[0184.074] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x286
	[0184.074] ReadFile (in: hFile=0x318, lpBuffer=0x26e6b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26e6b90*, lpNumberOfBytesRead=0x55cf1fc*=0x286, lpOverlapped=0x0) returned 1
	[0184.088] CloseHandle (hObject=0x318) returned 1
	[0184.088] CryptDestroyKey (hKey=0x82b280) returned 1
	[0184.088] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.088] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e7c2c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0184.088] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.088] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.088] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b340) returned 1
	[0184.088] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.088] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26e7ce4*=0x1, dwFlags=0x0) returned 1
	[0184.088] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26e7cb0, dwFlags=0x0) returned 1
	[0184.088] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e7cf4*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x26e7cf4*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0184.088] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e7f90*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26e7f90*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.088] CryptDestroyKey (hKey=0x82b340) returned 1
	[0184.088] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.088] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.088] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.088] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.090] GetFileType (hFile=0x318) returned 0x1
	[0184.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.090] GetFileType (hFile=0x318) returned 0x1
	[0184.090] WriteFile (in: hFile=0x318, lpBuffer=0x26e81ec*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26e81ec*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0184.091] CloseHandle (hObject=0x318) returned 1
	[0184.091] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.091] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0184.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.091] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa80f12b1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0184.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.091] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.092] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.093] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26e9810 | out: lpFileInformation=0x26e9810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286)) returned 1
	[0184.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.093] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.093] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.093] GetFileType (hFile=0x318) returned 0x1
	[0184.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.093] GetFileType (hFile=0x318) returned 0x1
	[0184.093] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x286
	[0184.094] ReadFile (in: hFile=0x318, lpBuffer=0x26e9f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26e9f44*, lpNumberOfBytesRead=0x55cf1fc*=0x286, lpOverlapped=0x0) returned 1
	[0184.095] CloseHandle (hObject=0x318) returned 1
	[0184.095] CryptDestroyKey (hKey=0x82b300) returned 1
	[0184.095] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.095] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26eafe0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b040) returned 1
	[0184.095] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.095] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.095] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0184.095] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.096] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26eb098*=0x1, dwFlags=0x0) returned 1
	[0184.096] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26eb064, dwFlags=0x0) returned 1
	[0184.096] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26eb0a8*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x26eb0a8*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0184.096] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26eb344*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26eb344*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.096] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.096] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.096] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.096] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.096] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.097] GetFileType (hFile=0x318) returned 0x1
	[0184.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.097] GetFileType (hFile=0x318) returned 0x1
	[0184.098] WriteFile (in: hFile=0x318, lpBuffer=0x26eb5a0*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26eb5a0*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0184.099] CloseHandle (hObject=0x318) returned 1
	[0184.099] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.099] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0184.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.099] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa80f12b1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0184.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.099] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.100] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0184.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.100] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26ecbc4 | out: lpFileInformation=0x26ecbc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1)) returned 1
	[0184.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.100] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0184.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.101] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.101] GetFileType (hFile=0x318) returned 0x1
	[0184.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.101] GetFileType (hFile=0x318) returned 0x1
	[0184.101] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d1
	[0184.101] ReadFile (in: hFile=0x318, lpBuffer=0x26ed354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26ed354*, lpNumberOfBytesRead=0x55cf1fc*=0x2d1, lpOverlapped=0x0) returned 1
	[0184.123] CloseHandle (hObject=0x318) returned 1
	[0184.123] CryptDestroyKey (hKey=0x82b040) returned 1
	[0184.123] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.123] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ee3f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0184.123] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.123] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.123] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0184.123] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.123] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26ee4a8*=0x1, dwFlags=0x0) returned 1
	[0184.124] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x26ee474, dwFlags=0x0) returned 1
	[0184.124] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ee4b8*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26ee4b8*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0184.124] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ee7a4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26ee7a4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.124] CryptDestroyKey (hKey=0x82b380) returned 1
	[0184.124] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.124] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.124] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0184.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.124] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.125] GetFileType (hFile=0x318) returned 0x1
	[0184.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.125] GetFileType (hFile=0x318) returned 0x1
	[0184.125] WriteFile (in: hFile=0x318, lpBuffer=0x26eea08*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26eea08*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0184.126] CloseHandle (hObject=0x318) returned 1
	[0184.126] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0184.126] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0184.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.126] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa813d91f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0184.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.126] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0184.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.127] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f003c | out: lpFileInformation=0x26f003c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0184.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.128] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0184.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.128] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.128] GetFileType (hFile=0x318) returned 0x1
	[0184.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.128] GetFileType (hFile=0x318) returned 0x1
	[0184.128] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2cd
	[0184.128] ReadFile (in: hFile=0x318, lpBuffer=0x26f07c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26f07c8*, lpNumberOfBytesRead=0x55cf1fc*=0x2cd, lpOverlapped=0x0) returned 1
	[0184.130] CloseHandle (hObject=0x318) returned 1
	[0184.130] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.130] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.130] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f1864, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0184.130] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.130] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.130] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0184.130] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.130] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26f191c*=0x1, dwFlags=0x0) returned 1
	[0184.130] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x26f18e8, dwFlags=0x0) returned 1
	[0184.130] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f192c*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26f192c*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0184.130] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f1c08*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26f1c08*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.130] CryptDestroyKey (hKey=0x82b380) returned 1
	[0184.130] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.130] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.130] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0184.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.130] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.131] GetFileType (hFile=0x318) returned 0x1
	[0184.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.131] GetFileType (hFile=0x318) returned 0x1
	[0184.132] WriteFile (in: hFile=0x318, lpBuffer=0x26f1e6c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26f1e6c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.132] CloseHandle (hObject=0x318) returned 1
	[0184.132] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0184.133] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0184.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.133] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa813d91f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.133] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.134] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0184.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.134] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f34a0 | out: lpFileInformation=0x26f34a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0184.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.134] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0184.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.135] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.135] GetFileType (hFile=0x318) returned 0x1
	[0184.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.135] GetFileType (hFile=0x318) returned 0x1
	[0184.135] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2cc
	[0184.135] ReadFile (in: hFile=0x318, lpBuffer=0x26f3c28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26f3c28*, lpNumberOfBytesRead=0x55cf1fc*=0x2cc, lpOverlapped=0x0) returned 1
	[0184.137] CloseHandle (hObject=0x318) returned 1
	[0184.137] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.137] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.137] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f4cc4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b4c0) returned 1
	[0184.137] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.137] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.137] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0184.137] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.137] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26f4d7c*=0x1, dwFlags=0x0) returned 1
	[0184.137] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26f4d48, dwFlags=0x0) returned 1
	[0184.137] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f4d8c*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26f4d8c*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0184.137] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f5068*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26f5068*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.137] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.137] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.137] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0184.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.137] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.138] GetFileType (hFile=0x318) returned 0x1
	[0184.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.138] GetFileType (hFile=0x318) returned 0x1
	[0184.139] WriteFile (in: hFile=0x318, lpBuffer=0x26f52cc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26f52cc*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.139] CloseHandle (hObject=0x318) returned 1
	[0184.139] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0184.139] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0184.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.140] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8163ac4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.140] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.141] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0184.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.141] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f68f4 | out: lpFileInformation=0x26f68f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e2)) returned 1
	[0184.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.141] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0184.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.142] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.142] GetFileType (hFile=0x318) returned 0x1
	[0184.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.142] GetFileType (hFile=0x318) returned 0x1
	[0184.142] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1e2
	[0184.142] ReadFile (in: hFile=0x318, lpBuffer=0x26f6f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26f6f04*, lpNumberOfBytesRead=0x55cf1fc*=0x1e2, lpOverlapped=0x0) returned 1
	[0184.143] CloseHandle (hObject=0x318) returned 1
	[0184.143] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0184.143] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.143] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f7fa0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0184.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.143] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0184.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.143] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26f8058*=0x1, dwFlags=0x0) returned 1
	[0184.143] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26f8024, dwFlags=0x0) returned 1
	[0184.143] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f8068*, pdwDataLen=0x55cf204*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x26f8068*, pdwDataLen=0x55cf204*=0x1f0) returned 1
	[0184.143] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f8264*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26f8264*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.143] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.143] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.143] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0184.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.143] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.144] GetFileType (hFile=0x318) returned 0x1
	[0184.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.144] GetFileType (hFile=0x318) returned 0x1
	[0184.145] WriteFile (in: hFile=0x318, lpBuffer=0x26f8480*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26f8480*, lpNumberOfBytesWritten=0x55cf1c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0184.145] CloseHandle (hObject=0x318) returned 1
	[0184.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0184.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbd
	[0184.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.146] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8163ac4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0184.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.146] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.147] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0184.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.147] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f9a18 | out: lpFileInformation=0x26f9a18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6)) returned 1
	[0184.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0184.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.148] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.148] GetFileType (hFile=0x318) returned 0x1
	[0184.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.148] GetFileType (hFile=0x318) returned 0x1
	[0184.148] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d6
	[0184.148] ReadFile (in: hFile=0x318, lpBuffer=0x26fa1cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26fa1cc*, lpNumberOfBytesRead=0x55cf1fc*=0x2d6, lpOverlapped=0x0) returned 1
	[0184.184] CloseHandle (hObject=0x318) returned 1
	[0184.185] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0184.185] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.185] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fb268, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0184.185] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.185] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.185] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0184.185] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.185] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x26fb320*=0x1, dwFlags=0x0) returned 1
	[0184.185] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x26fb2ec, dwFlags=0x0) returned 1
	[0184.185] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fb330*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26fb330*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0184.185] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fb61c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26fb61c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.185] CryptDestroyKey (hKey=0x82b080) returned 1
	[0184.185] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.185] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.185] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0184.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.185] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.186] GetFileType (hFile=0x318) returned 0x1
	[0184.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.186] GetFileType (hFile=0x318) returned 0x1
	[0184.186] WriteFile (in: hFile=0x318, lpBuffer=0x26fb890*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26fb890*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0184.187] CloseHandle (hObject=0x318) returned 1
	[0184.187] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0184.187] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0184.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.188] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa81d61ff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0184.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.188] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.189] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.189] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26fced8 | out: lpFileInformation=0x26fced8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e1)) returned 1
	[0184.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.189] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.189] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.190] GetFileType (hFile=0x318) returned 0x1
	[0184.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.190] GetFileType (hFile=0x318) returned 0x1
	[0184.190] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1e1
	[0184.190] ReadFile (in: hFile=0x318, lpBuffer=0x26fd548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x26fd548*, lpNumberOfBytesRead=0x55cf1fc*=0x1e1, lpOverlapped=0x0) returned 1
	[0184.191] CloseHandle (hObject=0x318) returned 1
	[0184.191] CryptDestroyKey (hKey=0x82b300) returned 1
	[0184.191] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.191] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fe5e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b440) returned 1
	[0184.191] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.191] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.191] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0184.191] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.191] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26fe69c*=0x1, dwFlags=0x0) returned 1
	[0184.191] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26fe668, dwFlags=0x0) returned 1
	[0184.191] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fe6ac*, pdwDataLen=0x55cf204*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x26fe6ac*, pdwDataLen=0x55cf204*=0x1f0) returned 1
	[0184.191] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fe8a8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x26fe8a8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.191] CryptDestroyKey (hKey=0x82b480) returned 1
	[0184.191] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.191] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.191] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.191] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.192] GetFileType (hFile=0x318) returned 0x1
	[0184.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.192] GetFileType (hFile=0x318) returned 0x1
	[0184.192] WriteFile (in: hFile=0x318, lpBuffer=0x26feaf4*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x26feaf4*, lpNumberOfBytesWritten=0x55cf1c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0184.193] CloseHandle (hObject=0x318) returned 1
	[0184.193] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.193] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0184.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.193] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa81d61ff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0184.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.194] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.195] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.195] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27000f8 | out: lpFileInformation=0x27000f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x308)) returned 1
	[0184.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.195] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.195] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.196] GetFileType (hFile=0x318) returned 0x1
	[0184.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.196] GetFileType (hFile=0x318) returned 0x1
	[0184.196] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x308
	[0184.196] ReadFile (in: hFile=0x318, lpBuffer=0x27008ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27008ac*, lpNumberOfBytesRead=0x55cf1fc*=0x308, lpOverlapped=0x0) returned 1
	[0184.197] CloseHandle (hObject=0x318) returned 1
	[0184.197] CryptDestroyKey (hKey=0x82b440) returned 1
	[0184.197] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.197] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2701948, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0184.197] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.197] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.197] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0184.197] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.197] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2701a00*=0x1, dwFlags=0x0) returned 1
	[0184.198] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27019cc, dwFlags=0x0) returned 1
	[0184.198] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2701a10*, pdwDataLen=0x55cf204*=0x310, dwBufLen=0x310 | out: pbData=0x2701a10*, pdwDataLen=0x55cf204*=0x310) returned 1
	[0184.198] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2701d2c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2701d2c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.198] CryptDestroyKey (hKey=0x82b540) returned 1
	[0184.198] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.198] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.198] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.198] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.199] GetFileType (hFile=0x318) returned 0x1
	[0184.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.199] GetFileType (hFile=0x318) returned 0x1
	[0184.199] WriteFile (in: hFile=0x318, lpBuffer=0x2701f88*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2701f88*, lpNumberOfBytesWritten=0x55cf1c4*=0x310, lpOverlapped=0x0) returned 1
	[0184.200] CloseHandle (hObject=0x318) returned 1
	[0184.200] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.200] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0184.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.200] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa81fc29e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0184.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.201] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.202] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0184.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.202] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27035ac | out: lpFileInformation=0x27035ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1dd)) returned 1
	[0184.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.202] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0184.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.202] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.202] GetFileType (hFile=0x318) returned 0x1
	[0184.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.202] GetFileType (hFile=0x318) returned 0x1
	[0184.203] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1dd
	[0184.203] ReadFile (in: hFile=0x318, lpBuffer=0x2703bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2703bf8*, lpNumberOfBytesRead=0x55cf1fc*=0x1dd, lpOverlapped=0x0) returned 1
	[0184.204] CloseHandle (hObject=0x318) returned 1
	[0184.204] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0184.204] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.204] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2704c94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0184.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.204] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b200) returned 1
	[0184.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.204] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2704d4c*=0x1, dwFlags=0x0) returned 1
	[0184.204] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2704d18, dwFlags=0x0) returned 1
	[0184.204] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2704d5c*, pdwDataLen=0x55cf204*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x2704d5c*, pdwDataLen=0x55cf204*=0x1e0) returned 1
	[0184.204] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2704f48*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2704f48*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.204] CryptDestroyKey (hKey=0x82b200) returned 1
	[0184.204] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.204] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.204] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0184.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.204] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.206] GetFileType (hFile=0x318) returned 0x1
	[0184.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.206] GetFileType (hFile=0x318) returned 0x1
	[0184.206] WriteFile (in: hFile=0x318, lpBuffer=0x2705184*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2705184*, lpNumberOfBytesWritten=0x55cf1c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0184.207] CloseHandle (hObject=0x318) returned 1
	[0184.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0184.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc6
	[0184.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.207] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa81fc29e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0184.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.207] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0184.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.209] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2706768 | out: lpFileInformation=0x2706768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be)) returned 1
	[0184.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0184.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.209] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.209] GetFileType (hFile=0x318) returned 0x1
	[0184.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.209] GetFileType (hFile=0x318) returned 0x1
	[0184.210] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2be
	[0184.210] ReadFile (in: hFile=0x318, lpBuffer=0x2706e94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2706e94*, lpNumberOfBytesRead=0x55cf1fc*=0x2be, lpOverlapped=0x0) returned 1
	[0184.211] CloseHandle (hObject=0x318) returned 1
	[0184.211] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.211] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.211] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2707f30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b480) returned 1
	[0184.211] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.211] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.211] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0184.211] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.211] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2707fe8*=0x1, dwFlags=0x0) returned 1
	[0184.212] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2707fb4, dwFlags=0x0) returned 1
	[0184.212] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2707ff8*, pdwDataLen=0x55cf204*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x2707ff8*, pdwDataLen=0x55cf204*=0x2c0) returned 1
	[0184.212] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27082c4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27082c4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.212] CryptDestroyKey (hKey=0x82b080) returned 1
	[0184.212] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.212] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.212] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0184.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.212] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.213] GetFileType (hFile=0x318) returned 0x1
	[0184.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.213] GetFileType (hFile=0x318) returned 0x1
	[0184.213] WriteFile (in: hFile=0x318, lpBuffer=0x2708500*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2708500*, lpNumberOfBytesWritten=0x55cf1c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0184.214] CloseHandle (hObject=0x318) returned 1
	[0184.215] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0184.215] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc6
	[0184.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.215] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa82225a0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0184.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.215] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.216] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0184.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.216] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2709ae4 | out: lpFileInformation=0x2709ae4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc)) returned 1
	[0184.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.216] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0184.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.216] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.217] GetFileType (hFile=0x318) returned 0x1
	[0184.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.217] GetFileType (hFile=0x318) returned 0x1
	[0184.217] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1cc
	[0184.217] ReadFile (in: hFile=0x318, lpBuffer=0x270a15c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x270a15c*, lpNumberOfBytesRead=0x55cf1fc*=0x1cc, lpOverlapped=0x0) returned 1
	[0184.242] CloseHandle (hObject=0x318) returned 1
	[0184.242] CryptDestroyKey (hKey=0x82b480) returned 1
	[0184.242] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.242] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270b1f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0184.242] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.242] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.242] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0184.242] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.242] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x270b2b0*=0x1, dwFlags=0x0) returned 1
	[0184.242] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x270b27c, dwFlags=0x0) returned 1
	[0184.243] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270b2c0*, pdwDataLen=0x55cf204*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x270b2c0*, pdwDataLen=0x55cf204*=0x1d0) returned 1
	[0184.243] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270b49c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x270b49c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.243] CryptDestroyKey (hKey=0x82b280) returned 1
	[0184.243] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.243] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.243] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0184.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.243] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.244] GetFileType (hFile=0x318) returned 0x1
	[0184.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.244] GetFileType (hFile=0x318) returned 0x1
	[0184.244] WriteFile (in: hFile=0x318, lpBuffer=0x270b6f8*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x270b6f8*, lpNumberOfBytesWritten=0x55cf1c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0184.245] CloseHandle (hObject=0x318) returned 1
	[0184.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0184.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0184.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.245] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa826eba7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0184.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.246] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.247] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.247] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x270cd10 | out: lpFileInformation=0x270cd10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283)) returned 1
	[0184.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.248] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.248] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.248] GetFileType (hFile=0x318) returned 0x1
	[0184.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.248] GetFileType (hFile=0x318) returned 0x1
	[0184.248] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x283
	[0184.248] ReadFile (in: hFile=0x318, lpBuffer=0x270d410, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x270d410*, lpNumberOfBytesRead=0x55cf1fc*=0x283, lpOverlapped=0x0) returned 1
	[0184.249] CloseHandle (hObject=0x318) returned 1
	[0184.250] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.250] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.250] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270e4ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0184.250] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.250] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.250] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0184.250] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.250] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x270e564*=0x1, dwFlags=0x0) returned 1
	[0184.250] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x270e530, dwFlags=0x0) returned 1
	[0184.250] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270e574*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x270e574*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0184.250] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270e810*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x270e810*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.250] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0184.250] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.250] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.250] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.250] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.251] GetFileType (hFile=0x318) returned 0x1
	[0184.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.252] GetFileType (hFile=0x318) returned 0x1
	[0184.252] WriteFile (in: hFile=0x318, lpBuffer=0x270ea54*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x270ea54*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0184.252] CloseHandle (hObject=0x318) returned 1
	[0184.253] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.253] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0184.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.253] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa826eba7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0184.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.253] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.254] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0184.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.254] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x271003c | out: lpFileInformation=0x271003c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35f)) returned 1
	[0184.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.255] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0184.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.255] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.255] GetFileType (hFile=0x318) returned 0x1
	[0184.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.255] GetFileType (hFile=0x318) returned 0x1
	[0184.255] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x35f
	[0184.255] ReadFile (in: hFile=0x318, lpBuffer=0x2710888, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2710888*, lpNumberOfBytesRead=0x55cf1fc*=0x35f, lpOverlapped=0x0) returned 1
	[0184.256] CloseHandle (hObject=0x318) returned 1
	[0184.257] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.257] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.257] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2711924, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0184.257] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.257] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.257] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b200) returned 1
	[0184.257] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.257] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x27119dc*=0x1, dwFlags=0x0) returned 1
	[0184.257] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x27119a8, dwFlags=0x0) returned 1
	[0184.257] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27119ec*, pdwDataLen=0x55cf204*=0x360, dwBufLen=0x360 | out: pbData=0x27119ec*, pdwDataLen=0x55cf204*=0x360) returned 1
	[0184.257] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2711d58*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2711d58*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.257] CryptDestroyKey (hKey=0x82b200) returned 1
	[0184.257] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.257] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.257] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0184.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.257] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.258] GetFileType (hFile=0x318) returned 0x1
	[0184.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.259] GetFileType (hFile=0x318) returned 0x1
	[0184.259] WriteFile (in: hFile=0x318, lpBuffer=0x2711fd4*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2711fd4*, lpNumberOfBytesWritten=0x55cf1c4*=0x360, lpOverlapped=0x0) returned 1
	[0184.260] CloseHandle (hObject=0x318) returned 1
	[0184.260] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0184.260] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0184.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.260] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8294d82, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0184.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.260] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.261] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x271362c | out: lpFileInformation=0x271362c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0184.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.262] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.262] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.262] GetFileType (hFile=0x318) returned 0x1
	[0184.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.262] GetFileType (hFile=0x318) returned 0x1
	[0184.262] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1e0
	[0184.262] ReadFile (in: hFile=0x318, lpBuffer=0x2713c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2713c38*, lpNumberOfBytesRead=0x55cf1fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0184.263] CloseHandle (hObject=0x318) returned 1
	[0184.263] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.263] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.263] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2714cd4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0184.263] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.263] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.263] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0184.263] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.263] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2714d8c*=0x1, dwFlags=0x0) returned 1
	[0184.263] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2714d58, dwFlags=0x0) returned 1
	[0184.264] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2714d9c*, pdwDataLen=0x55cf204*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x2714d9c*, pdwDataLen=0x55cf204*=0x1f0) returned 1
	[0184.264] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2714f98*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2714f98*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.264] CryptDestroyKey (hKey=0x82b100) returned 1
	[0184.264] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.264] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.264] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.265] GetFileType (hFile=0x318) returned 0x1
	[0184.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.265] GetFileType (hFile=0x318) returned 0x1
	[0184.265] WriteFile (in: hFile=0x318, lpBuffer=0x27151b4*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27151b4*, lpNumberOfBytesWritten=0x55cf1c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0184.266] CloseHandle (hObject=0x318) returned 1
	[0184.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0184.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.266] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8294d82, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0184.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.267] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.268] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0184.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.268] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2716758 | out: lpFileInformation=0x2716758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0184.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.269] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0184.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.269] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.269] GetFileType (hFile=0x318) returned 0x1
	[0184.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.269] GetFileType (hFile=0x318) returned 0x1
	[0184.269] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2ca
	[0184.269] ReadFile (in: hFile=0x318, lpBuffer=0x2716ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2716ec0*, lpNumberOfBytesRead=0x55cf1fc*=0x2ca, lpOverlapped=0x0) returned 1
	[0184.270] CloseHandle (hObject=0x318) returned 1
	[0184.270] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0184.270] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.270] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2717f5c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b5c0) returned 1
	[0184.271] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.271] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.271] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b440) returned 1
	[0184.271] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.271] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2718014*=0x1, dwFlags=0x0) returned 1
	[0184.271] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2717fe0, dwFlags=0x0) returned 1
	[0184.271] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2718024*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2718024*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0184.271] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2718300*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2718300*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.271] CryptDestroyKey (hKey=0x82b440) returned 1
	[0184.271] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.271] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.271] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0184.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.271] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.272] GetFileType (hFile=0x318) returned 0x1
	[0184.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.272] GetFileType (hFile=0x318) returned 0x1
	[0184.272] WriteFile (in: hFile=0x318, lpBuffer=0x2718554*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2718554*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.273] CloseHandle (hObject=0x318) returned 1
	[0184.273] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0184.273] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0184.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.273] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8294d82, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.274] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.275] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.275] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2719b5c | out: lpFileInformation=0x2719b5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0184.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.276] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.276] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.276] GetFileType (hFile=0x318) returned 0x1
	[0184.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.276] GetFileType (hFile=0x318) returned 0x1
	[0184.276] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c8
	[0184.276] ReadFile (in: hFile=0x318, lpBuffer=0x271a2b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x271a2b0*, lpNumberOfBytesRead=0x55cf1fc*=0x2c8, lpOverlapped=0x0) returned 1
	[0184.306] CloseHandle (hObject=0x318) returned 1
	[0184.306] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0184.306] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.306] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271b34c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0184.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.306] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0184.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.306] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x271b404*=0x1, dwFlags=0x0) returned 1
	[0184.306] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x271b3d0, dwFlags=0x0) returned 1
	[0184.307] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271b414*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x271b414*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0184.307] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271b6f0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x271b6f0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.307] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0184.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.307] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.307] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.308] GetFileType (hFile=0x318) returned 0x1
	[0184.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.308] GetFileType (hFile=0x318) returned 0x1
	[0184.308] WriteFile (in: hFile=0x318, lpBuffer=0x271b93c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x271b93c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.309] CloseHandle (hObject=0x318) returned 1
	[0184.309] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.309] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0184.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.309] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa83075c9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.309] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.310] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x271cf40 | out: lpFileInformation=0x271cf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e5)) returned 1
	[0184.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.311] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.311] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.312] GetFileType (hFile=0x318) returned 0x1
	[0184.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.312] GetFileType (hFile=0x318) returned 0x1
	[0184.312] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2e5
	[0184.312] ReadFile (in: hFile=0x318, lpBuffer=0x271d6d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x271d6d4*, lpNumberOfBytesRead=0x55cf1fc*=0x2e5, lpOverlapped=0x0) returned 1
	[0184.313] CloseHandle (hObject=0x318) returned 1
	[0184.313] CryptDestroyKey (hKey=0x82b340) returned 1
	[0184.313] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.313] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271e770, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0184.313] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.313] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.313] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b280) returned 1
	[0184.314] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.314] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x271e828*=0x1, dwFlags=0x0) returned 1
	[0184.314] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x271e7f4, dwFlags=0x0) returned 1
	[0184.314] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271e838*, pdwDataLen=0x55cf204*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x271e838*, pdwDataLen=0x55cf204*=0x2f0) returned 1
	[0184.314] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271eb34*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x271eb34*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.314] CryptDestroyKey (hKey=0x82b280) returned 1
	[0184.314] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.314] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.314] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.314] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.315] GetFileType (hFile=0x318) returned 0x1
	[0184.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.315] GetFileType (hFile=0x318) returned 0x1
	[0184.315] WriteFile (in: hFile=0x318, lpBuffer=0x271ed90*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x271ed90*, lpNumberOfBytesWritten=0x55cf1c4*=0x2f0, lpOverlapped=0x0) returned 1
	[0184.316] CloseHandle (hObject=0x318) returned 1
	[0184.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0184.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.316] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa83075c9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0184.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.317] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.318] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.318] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27203a8 | out: lpFileInformation=0x27203a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354)) returned 1
	[0184.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.318] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.318] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.318] GetFileType (hFile=0x318) returned 0x1
	[0184.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.318] GetFileType (hFile=0x318) returned 0x1
	[0184.318] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x354
	[0184.318] ReadFile (in: hFile=0x318, lpBuffer=0x2720ba8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2720ba8*, lpNumberOfBytesRead=0x55cf1fc*=0x354, lpOverlapped=0x0) returned 1
	[0184.320] CloseHandle (hObject=0x318) returned 1
	[0184.320] CryptDestroyKey (hKey=0x82b380) returned 1
	[0184.320] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.320] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2721c44, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0184.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.320] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0184.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.320] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2721cfc*=0x1, dwFlags=0x0) returned 1
	[0184.320] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2721cc8, dwFlags=0x0) returned 1
	[0184.320] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2721d0c*, pdwDataLen=0x55cf204*=0x360, dwBufLen=0x360 | out: pbData=0x2721d0c*, pdwDataLen=0x55cf204*=0x360) returned 1
	[0184.320] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2722078*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2722078*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.321] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0184.321] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.321] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.321] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.321] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.322] GetFileType (hFile=0x318) returned 0x1
	[0184.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.322] GetFileType (hFile=0x318) returned 0x1
	[0184.322] WriteFile (in: hFile=0x318, lpBuffer=0x27222d4*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27222d4*, lpNumberOfBytesWritten=0x55cf1c4*=0x360, lpOverlapped=0x0) returned 1
	[0184.323] CloseHandle (hObject=0x318) returned 1
	[0184.323] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.323] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0184.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.323] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa832dcbd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0184.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.323] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.325] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0184.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.325] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27238ec | out: lpFileInformation=0x27238ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ce)) returned 1
	[0184.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.325] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0184.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.325] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.325] GetFileType (hFile=0x318) returned 0x1
	[0184.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.325] GetFileType (hFile=0x318) returned 0x1
	[0184.325] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1ce
	[0184.326] ReadFile (in: hFile=0x318, lpBuffer=0x2723f68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2723f68*, lpNumberOfBytesRead=0x55cf1fc*=0x1ce, lpOverlapped=0x0) returned 1
	[0184.326] CloseHandle (hObject=0x318) returned 1
	[0184.327] CryptDestroyKey (hKey=0x82b380) returned 1
	[0184.327] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.327] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2725004, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b0c0) returned 1
	[0184.327] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.327] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.327] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0184.327] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.327] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27250bc*=0x1, dwFlags=0x0) returned 1
	[0184.327] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2725088, dwFlags=0x0) returned 1
	[0184.327] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27250cc*, pdwDataLen=0x55cf204*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27250cc*, pdwDataLen=0x55cf204*=0x1d0) returned 1
	[0184.327] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27252a8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27252a8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.327] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0184.327] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.327] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.327] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0184.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.327] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.328] GetFileType (hFile=0x318) returned 0x1
	[0184.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.328] GetFileType (hFile=0x318) returned 0x1
	[0184.328] WriteFile (in: hFile=0x318, lpBuffer=0x2725504*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2725504*, lpNumberOfBytesWritten=0x55cf1c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0184.329] CloseHandle (hObject=0x318) returned 1
	[0184.329] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0184.330] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0184.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.330] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa832dcbd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0184.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.330] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.332] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0184.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.332] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2726b1c | out: lpFileInformation=0x2726b1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be)) returned 1
	[0184.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.332] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0184.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0184.332] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.332] GetFileType (hFile=0x318) returned 0x1
	[0184.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0184.333] GetFileType (hFile=0x318) returned 0x1
	[0184.333] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2be
	[0184.333] ReadFile (in: hFile=0x318, lpBuffer=0x2727248, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2727248*, lpNumberOfBytesRead=0x55cf1fc*=0x2be, lpOverlapped=0x0) returned 1
	[0184.334] CloseHandle (hObject=0x318) returned 1
	[0184.334] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0184.334] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.334] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27282e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0184.334] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.334] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.334] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0184.335] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.335] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x272839c*=0x1, dwFlags=0x0) returned 1
	[0184.335] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2728368, dwFlags=0x0) returned 1
	[0184.335] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27283ac*, pdwDataLen=0x55cf204*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x27283ac*, pdwDataLen=0x55cf204*=0x2c0) returned 1
	[0184.335] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2728678*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2728678*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0184.335] CryptDestroyKey (hKey=0x82b080) returned 1
	[0184.335] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.335] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.335] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0184.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0184.335] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.336] GetFileType (hFile=0x318) returned 0x1
	[0184.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0184.336] GetFileType (hFile=0x318) returned 0x1
	[0184.336] WriteFile (in: hFile=0x318, lpBuffer=0x27288b4*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27288b4*, lpNumberOfBytesWritten=0x55cf1c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0184.343] CloseHandle (hObject=0x318) returned 1
	[0184.343] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0184.343] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc6
	[0184.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0184.343] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa83539d6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0184.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0184.343] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.345] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0184.345] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2729e98 | out: lpFileInformation=0x2729e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc)) returned 1
	[0184.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0184.764] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.803] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.956] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.012] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.070] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.130] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.181] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.238] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.259] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.283] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.415] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.528] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.530] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.543] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.549] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.554] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.555] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.586] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.587] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.597] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.598] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.602] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.604] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.924] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.986] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.044] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.109] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.436] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.498] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.686] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.744] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.120] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.177] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.279] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.401] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.462] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.521] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0187.685] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.686] GetFileType (hFile=0x318) returned 0x1
	[0187.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0187.686] GetFileType (hFile=0x318) returned 0x1
	[0187.686] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x352
	[0187.686] ReadFile (in: hFile=0x318, lpBuffer=0x27f4b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27f4b80*, lpNumberOfBytesRead=0x55cf1fc*=0x352, lpOverlapped=0x0) returned 1
	[0187.687] CloseHandle (hObject=0x318) returned 1
	[0187.688] CryptDestroyKey (hKey=0x82b340) returned 1
	[0187.688] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.688] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f5c1c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0187.688] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.688] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.688] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b400) returned 1
	[0187.688] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.688] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x27f5cd4*=0x1, dwFlags=0x0) returned 1
	[0187.688] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x27f5ca0, dwFlags=0x0) returned 1
	[0187.688] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f5ce4*, pdwDataLen=0x55cf204*=0x360, dwBufLen=0x360 | out: pbData=0x27f5ce4*, pdwDataLen=0x55cf204*=0x360) returned 1
	[0187.688] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f6050*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27f6050*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0187.688] CryptDestroyKey (hKey=0x82b400) returned 1
	[0187.688] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.688] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.688] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0187.688] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.690] GetFileType (hFile=0x318) returned 0x1
	[0187.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0187.690] GetFileType (hFile=0x318) returned 0x1
	[0187.690] WriteFile (in: hFile=0x318, lpBuffer=0x27f62ac*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27f62ac*, lpNumberOfBytesWritten=0x55cf1c4*=0x360, lpOverlapped=0x0) returned 1
	[0187.691] CloseHandle (hObject=0x318) returned 1
	[0187.691] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.691] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0187.691] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa339cb2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0187.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0187.691] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.692] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0187.692] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f78d0 | out: lpFileInformation=0x27f78d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ef2cc3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0187.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0188.019] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.109] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.162] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.229] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.292] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.357] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.561] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.674] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.721] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.770] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.821] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.885] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.927] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.083] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb7
	[0189.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.083] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.084] GetFileType (hFile=0x318) returned 0x1
	[0189.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.084] GetFileType (hFile=0x318) returned 0x1
	[0189.084] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d8
	[0189.084] ReadFile (in: hFile=0x318, lpBuffer=0x272dcf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x272dcf8*, lpNumberOfBytesRead=0x55cf1fc*=0x2d8, lpOverlapped=0x0) returned 1
	[0189.085] CloseHandle (hObject=0x318) returned 1
	[0189.085] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.085] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.086] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272ed94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0189.086] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.086] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.086] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0189.086] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.086] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x272ee4c*=0x1, dwFlags=0x0) returned 1
	[0189.086] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x272ee18, dwFlags=0x0) returned 1
	[0189.086] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272ee5c*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x272ee5c*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0189.086] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272f148*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x272f148*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.086] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.086] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.086] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.086] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb7
	[0189.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.086] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.088] GetFileType (hFile=0x318) returned 0x1
	[0189.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.088] GetFileType (hFile=0x318) returned 0x1
	[0189.088] WriteFile (in: hFile=0x318, lpBuffer=0x272f404*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x272f404*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.089] CloseHandle (hObject=0x318) returned 1
	[0189.089] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb7
	[0189.089] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe6
	[0189.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.089] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab0a309c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.089] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.091] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.091] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2730ae8 | out: lpFileInformation=0x2730ae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911edd2d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd)) returned 1
	[0189.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.091] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.091] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.092] GetFileType (hFile=0x318) returned 0x1
	[0189.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.092] GetFileType (hFile=0x318) returned 0x1
	[0189.092] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2dd
	[0189.092] ReadFile (in: hFile=0x318, lpBuffer=0x2731304, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2731304*, lpNumberOfBytesRead=0x55cf1fc*=0x2dd, lpOverlapped=0x0) returned 1
	[0189.093] CloseHandle (hObject=0x318) returned 1
	[0189.093] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.094] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.094] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27323a0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0189.094] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.094] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.094] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0189.094] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.094] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2732458*=0x1, dwFlags=0x0) returned 1
	[0189.094] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2732424, dwFlags=0x0) returned 1
	[0189.094] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2732468*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2732468*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0189.094] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2732754*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2732754*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.094] CryptDestroyKey (hKey=0x82b000) returned 1
	[0189.094] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.094] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.094] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.094] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.096] GetFileType (hFile=0x318) returned 0x1
	[0189.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.096] GetFileType (hFile=0x318) returned 0x1
	[0189.096] WriteFile (in: hFile=0x318, lpBuffer=0x27329f8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27329f8*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.097] CloseHandle (hObject=0x318) returned 1
	[0189.097] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.097] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe0
	[0189.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.097] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab0a309c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.098] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.099] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0189.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.099] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27340ac | out: lpFileInformation=0x27340ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8)) returned 1
	[0189.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.099] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0189.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.099] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.099] GetFileType (hFile=0x318) returned 0x1
	[0189.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.099] GetFileType (hFile=0x318) returned 0x1
	[0189.099] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1d8
	[0189.100] ReadFile (in: hFile=0x318, lpBuffer=0x27346b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27346b0*, lpNumberOfBytesRead=0x55cf1fc*=0x1d8, lpOverlapped=0x0) returned 1
	[0189.101] CloseHandle (hObject=0x318) returned 1
	[0189.101] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.101] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.101] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273574c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0189.101] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.101] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.101] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0189.101] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.101] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2735804*=0x1, dwFlags=0x0) returned 1
	[0189.101] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27357d0, dwFlags=0x0) returned 1
	[0189.101] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2735814*, pdwDataLen=0x55cf204*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x2735814*, pdwDataLen=0x55cf204*=0x1e0) returned 1
	[0189.101] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2735a00*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2735a00*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.101] CryptDestroyKey (hKey=0x82b380) returned 1
	[0189.101] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.101] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.101] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0189.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.102] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.103] GetFileType (hFile=0x318) returned 0x1
	[0189.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.103] GetFileType (hFile=0x318) returned 0x1
	[0189.103] WriteFile (in: hFile=0x318, lpBuffer=0x2735c1c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2735c1c*, lpNumberOfBytesWritten=0x55cf1c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0189.104] CloseHandle (hObject=0x318) returned 1
	[0189.104] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0189.104] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbd
	[0189.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.104] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab0c936f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0189.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.105] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.107] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.107] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27371b4 | out: lpFileInformation=0x27371b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900f0949, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307)) returned 1
	[0189.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.107] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.107] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.107] GetFileType (hFile=0x318) returned 0x1
	[0189.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.108] GetFileType (hFile=0x318) returned 0x1
	[0189.108] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x307
	[0189.108] ReadFile (in: hFile=0x318, lpBuffer=0x2737948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2737948*, lpNumberOfBytesRead=0x55cf1fc*=0x307, lpOverlapped=0x0) returned 1
	[0189.109] CloseHandle (hObject=0x318) returned 1
	[0189.109] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.109] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.109] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27389e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0189.109] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.109] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.110] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0189.110] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.110] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2738a9c*=0x1, dwFlags=0x0) returned 1
	[0189.110] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2738a68, dwFlags=0x0) returned 1
	[0189.110] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2738aac*, pdwDataLen=0x55cf204*=0x310, dwBufLen=0x310 | out: pbData=0x2738aac*, pdwDataLen=0x55cf204*=0x310) returned 1
	[0189.110] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2738dc8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2738dc8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.110] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.110] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.110] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.110] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.110] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.111] GetFileType (hFile=0x318) returned 0x1
	[0189.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.112] GetFileType (hFile=0x318) returned 0x1
	[0189.112] WriteFile (in: hFile=0x318, lpBuffer=0x2739014*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2739014*, lpNumberOfBytesWritten=0x55cf1c4*=0x310, lpOverlapped=0x0) returned 1
	[0189.113] CloseHandle (hObject=0x318) returned 1
	[0189.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.114] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0189.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.114] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab0c936f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0189.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.114] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.115] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb7
	[0189.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.115] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x273a618 | out: lpFileInformation=0x273a618*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911edd2d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4)) returned 1
	[0189.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.115] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb7
	[0189.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.116] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.116] GetFileType (hFile=0x318) returned 0x1
	[0189.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.116] GetFileType (hFile=0x318) returned 0x1
	[0189.116] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d4
	[0189.116] ReadFile (in: hFile=0x318, lpBuffer=0x273ae58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x273ae58*, lpNumberOfBytesRead=0x55cf1fc*=0x2d4, lpOverlapped=0x0) returned 1
	[0189.145] CloseHandle (hObject=0x318) returned 1
	[0189.145] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.145] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.145] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273bef4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0189.145] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.145] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.145] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0189.145] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.145] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x273bfac*=0x1, dwFlags=0x0) returned 1
	[0189.145] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x273bf78, dwFlags=0x0) returned 1
	[0189.145] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273bfbc*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x273bfbc*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0189.146] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273c2a8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x273c2a8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.146] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.146] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.146] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb7
	[0189.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.146] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.147] GetFileType (hFile=0x318) returned 0x1
	[0189.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.147] GetFileType (hFile=0x318) returned 0x1
	[0189.147] WriteFile (in: hFile=0x318, lpBuffer=0x273c564*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x273c564*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.148] CloseHandle (hObject=0x318) returned 1
	[0189.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb7
	[0189.149] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe6
	[0189.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.149] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab115804, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.149] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.150] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0189.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.150] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x273dc48 | out: lpFileInformation=0x273dc48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911edd2d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db)) returned 1
	[0189.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.151] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0189.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.151] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.151] GetFileType (hFile=0x318) returned 0x1
	[0189.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.151] GetFileType (hFile=0x318) returned 0x1
	[0189.151] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2db
	[0189.151] ReadFile (in: hFile=0x318, lpBuffer=0x273e470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x273e470*, lpNumberOfBytesRead=0x55cf1fc*=0x2db, lpOverlapped=0x0) returned 1
	[0189.153] CloseHandle (hObject=0x318) returned 1
	[0189.153] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.153] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.153] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273f50c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b440) returned 1
	[0189.153] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.153] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.153] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0189.153] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.153] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x273f5c4*=0x1, dwFlags=0x0) returned 1
	[0189.153] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x273f590, dwFlags=0x0) returned 1
	[0189.153] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273f5d4*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x273f5d4*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0189.154] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273f8c0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x273f8c0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.154] CryptDestroyKey (hKey=0x82b480) returned 1
	[0189.154] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.154] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.154] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0189.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.154] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.155] GetFileType (hFile=0x318) returned 0x1
	[0189.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.155] GetFileType (hFile=0x318) returned 0x1
	[0189.155] WriteFile (in: hFile=0x318, lpBuffer=0x273fb6c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x273fb6c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.156] CloseHandle (hObject=0x318) returned 1
	[0189.157] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0189.157] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe1
	[0189.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.157] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab13bad8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.157] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.158] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.158] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2741224 | out: lpFileInformation=0x2741224*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91213f95, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91213f95, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91213f95, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0189.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.159] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.159] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.159] GetFileType (hFile=0x318) returned 0x1
	[0189.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.159] GetFileType (hFile=0x318) returned 0x1
	[0189.159] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d3
	[0189.159] ReadFile (in: hFile=0x318, lpBuffer=0x2741a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2741a34*, lpNumberOfBytesRead=0x55cf1fc*=0x2d3, lpOverlapped=0x0) returned 1
	[0189.161] CloseHandle (hObject=0x318) returned 1
	[0189.161] CryptDestroyKey (hKey=0x82b440) returned 1
	[0189.161] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.161] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2742ad0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b040) returned 1
	[0189.161] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.162] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.162] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0189.162] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.162] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2742b88*=0x1, dwFlags=0x0) returned 1
	[0189.162] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2742b54, dwFlags=0x0) returned 1
	[0189.162] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2742b98*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2742b98*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0189.162] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2742e84*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2742e84*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.162] CryptDestroyKey (hKey=0x82b000) returned 1
	[0189.162] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.162] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.162] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.162] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.164] GetFileType (hFile=0x318) returned 0x1
	[0189.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.164] GetFileType (hFile=0x318) returned 0x1
	[0189.164] WriteFile (in: hFile=0x318, lpBuffer=0x2743128*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2743128*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.165] CloseHandle (hObject=0x318) returned 1
	[0189.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe0
	[0189.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.165] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91213f95, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91213f95, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab13bad8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.165] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0189.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.167] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27447dc | out: lpFileInformation=0x27447dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91213f95, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91213f95, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91213f95, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce)) returned 1
	[0189.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0189.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.167] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.167] GetFileType (hFile=0x318) returned 0x1
	[0189.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.168] GetFileType (hFile=0x318) returned 0x1
	[0189.168] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2ce
	[0189.168] ReadFile (in: hFile=0x318, lpBuffer=0x2744fe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2744fe8*, lpNumberOfBytesRead=0x55cf1fc*=0x2ce, lpOverlapped=0x0) returned 1
	[0189.169] CloseHandle (hObject=0x318) returned 1
	[0189.169] CryptDestroyKey (hKey=0x82b040) returned 1
	[0189.170] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.170] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2746084, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0189.170] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.170] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.170] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b440) returned 1
	[0189.170] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.170] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x274613c*=0x1, dwFlags=0x0) returned 1
	[0189.170] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2746108, dwFlags=0x0) returned 1
	[0189.170] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274614c*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x274614c*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0189.170] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2746428*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2746428*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.170] CryptDestroyKey (hKey=0x82b440) returned 1
	[0189.170] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.170] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0189.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.170] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.172] GetFileType (hFile=0x318) returned 0x1
	[0189.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.172] GetFileType (hFile=0x318) returned 0x1
	[0189.172] WriteFile (in: hFile=0x318, lpBuffer=0x27466cc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27466cc*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0189.173] CloseHandle (hObject=0x318) returned 1
	[0189.173] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0189.173] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdf
	[0189.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.173] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91213f95, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91213f95, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab161e31, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0189.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.173] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.178] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2747d74 | out: lpFileInformation=0x2747d74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4)) returned 1
	[0189.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.179] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.179] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.179] GetFileType (hFile=0x318) returned 0x1
	[0189.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.179] GetFileType (hFile=0x318) returned 0x1
	[0189.179] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d4
	[0189.179] ReadFile (in: hFile=0x318, lpBuffer=0x2748584, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2748584*, lpNumberOfBytesRead=0x55cf1fc*=0x2d4, lpOverlapped=0x0) returned 1
	[0189.203] CloseHandle (hObject=0x318) returned 1
	[0189.203] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.203] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.203] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2749620, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0189.203] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.204] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b300) returned 1
	[0189.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.204] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27496d8*=0x1, dwFlags=0x0) returned 1
	[0189.204] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27496a4, dwFlags=0x0) returned 1
	[0189.204] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27496e8*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27496e8*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0189.204] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27499d4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27499d4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.204] CryptDestroyKey (hKey=0x82b300) returned 1
	[0189.204] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.204] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.204] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.204] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.206] GetFileType (hFile=0x318) returned 0x1
	[0189.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.206] GetFileType (hFile=0x318) returned 0x1
	[0189.206] WriteFile (in: hFile=0x318, lpBuffer=0x2749c78*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2749c78*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.207] CloseHandle (hObject=0x318) returned 1
	[0189.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe0
	[0189.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.207] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab1ae198, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.208] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0189.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.209] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x274b32c | out: lpFileInformation=0x274b32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da)) returned 1
	[0189.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.210] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0189.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.210] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.210] GetFileType (hFile=0x318) returned 0x1
	[0189.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.210] GetFileType (hFile=0x318) returned 0x1
	[0189.211] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2da
	[0189.211] ReadFile (in: hFile=0x318, lpBuffer=0x274bb04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x274bb04*, lpNumberOfBytesRead=0x55cf1fc*=0x2da, lpOverlapped=0x0) returned 1
	[0189.212] CloseHandle (hObject=0x318) returned 1
	[0189.212] CryptDestroyKey (hKey=0x82b340) returned 1
	[0189.212] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.212] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274cba0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0189.212] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.212] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.213] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0189.213] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.213] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x274cc58*=0x1, dwFlags=0x0) returned 1
	[0189.213] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x274cc24, dwFlags=0x0) returned 1
	[0189.213] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274cc68*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x274cc68*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0189.213] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274cf54*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x274cf54*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.213] CryptDestroyKey (hKey=0x82b000) returned 1
	[0189.213] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.213] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.213] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0189.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.213] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.215] GetFileType (hFile=0x318) returned 0x1
	[0189.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.215] GetFileType (hFile=0x318) returned 0x1
	[0189.215] WriteFile (in: hFile=0x318, lpBuffer=0x274d1d8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x274d1d8*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.216] CloseHandle (hObject=0x318) returned 1
	[0189.216] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0189.216] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd8
	[0189.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.216] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab1d42fd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.216] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.218] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0189.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.218] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x274e84c | out: lpFileInformation=0x274e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b)) returned 1
	[0189.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.218] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0189.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.218] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.219] GetFileType (hFile=0x318) returned 0x1
	[0189.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.219] GetFileType (hFile=0x318) returned 0x1
	[0189.219] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x28b
	[0189.219] ReadFile (in: hFile=0x318, lpBuffer=0x274efc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x274efc4*, lpNumberOfBytesRead=0x55cf1fc*=0x28b, lpOverlapped=0x0) returned 1
	[0189.220] CloseHandle (hObject=0x318) returned 1
	[0189.221] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.221] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.221] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2750060, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0189.221] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.221] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.221] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0189.221] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.221] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2750118*=0x1, dwFlags=0x0) returned 1
	[0189.221] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27500e4, dwFlags=0x0) returned 1
	[0189.221] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2750128*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x2750128*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0189.221] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27503c4*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27503c4*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.221] CryptDestroyKey (hKey=0x82b540) returned 1
	[0189.221] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.221] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.221] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0189.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.221] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.223] GetFileType (hFile=0x318) returned 0x1
	[0189.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.223] GetFileType (hFile=0x318) returned 0x1
	[0189.223] WriteFile (in: hFile=0x318, lpBuffer=0x2750640*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2750640*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0189.224] CloseHandle (hObject=0x318) returned 1
	[0189.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0189.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0189.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.224] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab1d42fd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0189.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.225] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.226] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0189.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.226] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2751ca4 | out: lpFileInformation=0x2751ca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b)) returned 1
	[0189.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.226] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0189.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.227] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.227] GetFileType (hFile=0x318) returned 0x1
	[0189.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.227] GetFileType (hFile=0x318) returned 0x1
	[0189.227] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x28b
	[0189.227] ReadFile (in: hFile=0x318, lpBuffer=0x275241c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x275241c*, lpNumberOfBytesRead=0x55cf1fc*=0x28b, lpOverlapped=0x0) returned 1
	[0189.228] CloseHandle (hObject=0x318) returned 1
	[0189.229] CryptDestroyKey (hKey=0x82b280) returned 1
	[0189.229] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.229] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27534b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0189.229] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.229] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.229] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0189.229] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.229] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2753570*=0x1, dwFlags=0x0) returned 1
	[0189.229] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x275353c, dwFlags=0x0) returned 1
	[0189.229] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2753580*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x2753580*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0189.229] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275381c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x275381c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.229] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.229] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.229] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.229] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0189.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.230] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.231] GetFileType (hFile=0x318) returned 0x1
	[0189.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.231] GetFileType (hFile=0x318) returned 0x1
	[0189.231] WriteFile (in: hFile=0x318, lpBuffer=0x2753a98*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2753a98*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0189.232] CloseHandle (hObject=0x318) returned 1
	[0189.232] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0189.233] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0189.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.233] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab1fa64c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0189.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.233] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.234] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0189.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.234] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27550fc | out: lpFileInformation=0x27550fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x295)) returned 1
	[0189.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.235] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0189.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.235] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.235] GetFileType (hFile=0x318) returned 0x1
	[0189.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.235] GetFileType (hFile=0x318) returned 0x1
	[0189.235] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x295
	[0189.235] ReadFile (in: hFile=0x318, lpBuffer=0x27558b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27558b0*, lpNumberOfBytesRead=0x55cf1fc*=0x295, lpOverlapped=0x0) returned 1
	[0189.236] CloseHandle (hObject=0x318) returned 1
	[0189.237] CryptDestroyKey (hKey=0x82b280) returned 1
	[0189.237] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.237] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275694c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0189.237] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.237] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.237] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0189.237] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.237] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2756a04*=0x1, dwFlags=0x0) returned 1
	[0189.237] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27569d0, dwFlags=0x0) returned 1
	[0189.237] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2756a14*, pdwDataLen=0x55cf204*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x2756a14*, pdwDataLen=0x55cf204*=0x2a0) returned 1
	[0189.237] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2756cc0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2756cc0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.237] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.237] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.237] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.237] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0189.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.237] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.239] GetFileType (hFile=0x318) returned 0x1
	[0189.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.239] GetFileType (hFile=0x318) returned 0x1
	[0189.239] WriteFile (in: hFile=0x318, lpBuffer=0x2756f54*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2756f54*, lpNumberOfBytesWritten=0x55cf1c4*=0x2a0, lpOverlapped=0x0) returned 1
	[0189.240] CloseHandle (hObject=0x318) returned 1
	[0189.240] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0189.240] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdb
	[0189.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.240] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab1fa64c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0189.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.240] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.241] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.241] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27585dc | out: lpFileInformation=0x27585dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1db)) returned 1
	[0189.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.242] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.242] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.242] GetFileType (hFile=0x318) returned 0x1
	[0189.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.242] GetFileType (hFile=0x318) returned 0x1
	[0189.242] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1db
	[0189.242] ReadFile (in: hFile=0x318, lpBuffer=0x2758be4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2758be4*, lpNumberOfBytesRead=0x55cf1fc*=0x1db, lpOverlapped=0x0) returned 1
	[0189.275] CloseHandle (hObject=0x318) returned 1
	[0189.275] CryptDestroyKey (hKey=0x82b280) returned 1
	[0189.275] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.276] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2759c80, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0189.276] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.276] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.276] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b540) returned 1
	[0189.276] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.276] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2759d38*=0x1, dwFlags=0x0) returned 1
	[0189.276] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2759d04, dwFlags=0x0) returned 1
	[0189.276] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2759d48*, pdwDataLen=0x55cf204*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x2759d48*, pdwDataLen=0x55cf204*=0x1e0) returned 1
	[0189.276] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2759f34*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2759f34*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.276] CryptDestroyKey (hKey=0x82b540) returned 1
	[0189.276] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.276] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.276] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.277] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.278] GetFileType (hFile=0x318) returned 0x1
	[0189.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.278] GetFileType (hFile=0x318) returned 0x1
	[0189.278] WriteFile (in: hFile=0x318, lpBuffer=0x275a150*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x275a150*, lpNumberOfBytesWritten=0x55cf1c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0189.279] CloseHandle (hObject=0x318) returned 1
	[0189.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0189.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.280] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab26cdaa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0189.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.280] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.282] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb5
	[0189.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.282] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x275b6f4 | out: lpFileInformation=0x275b6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e4)) returned 1
	[0189.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.282] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb5
	[0189.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.283] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.283] GetFileType (hFile=0x318) returned 0x1
	[0189.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.283] GetFileType (hFile=0x318) returned 0x1
	[0189.283] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2e4
	[0189.283] ReadFile (in: hFile=0x318, lpBuffer=0x275bf34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x275bf34*, lpNumberOfBytesRead=0x55cf1fc*=0x2e4, lpOverlapped=0x0) returned 1
	[0189.284] CloseHandle (hObject=0x318) returned 1
	[0189.285] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.285] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.285] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275cfd0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0189.285] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.285] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.285] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0189.285] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.285] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x275d088*=0x1, dwFlags=0x0) returned 1
	[0189.285] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x275d054, dwFlags=0x0) returned 1
	[0189.285] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275d098*, pdwDataLen=0x55cf204*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x275d098*, pdwDataLen=0x55cf204*=0x2f0) returned 1
	[0189.285] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275d394*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x275d394*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.285] CryptDestroyKey (hKey=0x82b100) returned 1
	[0189.285] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.285] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.285] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb5
	[0189.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.285] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.287] GetFileType (hFile=0x318) returned 0x1
	[0189.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.287] GetFileType (hFile=0x318) returned 0x1
	[0189.287] WriteFile (in: hFile=0x318, lpBuffer=0x275d648*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x275d648*, lpNumberOfBytesWritten=0x55cf1c4*=0x2f0, lpOverlapped=0x0) returned 1
	[0189.288] CloseHandle (hObject=0x318) returned 1
	[0189.288] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb5
	[0189.288] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe4
	[0189.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.288] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab26cdaa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0189.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.288] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.290] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpFilePart=0x0) returned 0x9a
	[0189.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.290] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml"), fInfoLevelId=0x0, lpFileInformation=0x275ed1c | out: lpFileInformation=0x275ed1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c7)) returned 1
	[0189.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.290] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpFilePart=0x0) returned 0x9a
	[0189.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.290] ReadFile (in: hFile=0x318, lpBuffer=0x275f370, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x275f370*, lpNumberOfBytesRead=0x55cf1fc*=0x1c7, lpOverlapped=0x0) returned 1
	[0189.292] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.292] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.292] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276040c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b2c0) returned 1
	[0189.292] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.292] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.292] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b480) returned 1
	[0189.292] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.292] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27604c4*=0x1, dwFlags=0x0) returned 1
	[0189.292] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2760490, dwFlags=0x0) returned 1
	[0189.292] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27604d4*, pdwDataLen=0x55cf204*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27604d4*, pdwDataLen=0x55cf204*=0x1d0) returned 1
	[0189.292] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27606b0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27606b0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.292] CryptDestroyKey (hKey=0x82b480) returned 1
	[0189.292] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.292] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.292] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpFilePart=0x0) returned 0x9a
	[0189.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.292] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.294] GetFileType (hFile=0x318) returned 0x1
	[0189.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.294] GetFileType (hFile=0x318) returned 0x1
	[0189.294] WriteFile (in: hFile=0x318, lpBuffer=0x27608fc*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27608fc*, lpNumberOfBytesWritten=0x55cf1c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0189.295] CloseHandle (hObject=0x318) returned 1
	[0189.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpFilePart=0x0) returned 0x9a
	[0189.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0189.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.295] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab292f9b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0189.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.295] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.297] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpFilePart=0x0) returned 0x96
	[0189.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.298] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2761ef4 | out: lpFileInformation=0x2761ef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c3)) returned 1
	[0189.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.298] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpFilePart=0x0) returned 0x96
	[0189.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.298] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.298] GetFileType (hFile=0x318) returned 0x1
	[0189.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.298] GetFileType (hFile=0x318) returned 0x1
	[0189.298] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1c3
	[0189.298] ReadFile (in: hFile=0x318, lpBuffer=0x2762524, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2762524*, lpNumberOfBytesRead=0x55cf1fc*=0x1c3, lpOverlapped=0x0) returned 1
	[0189.299] CloseHandle (hObject=0x318) returned 1
	[0189.300] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0189.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.300] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27635c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b4c0) returned 1
	[0189.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.300] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0189.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.300] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2763678*=0x1, dwFlags=0x0) returned 1
	[0189.300] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2763644, dwFlags=0x0) returned 1
	[0189.300] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2763688*, pdwDataLen=0x55cf204*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x2763688*, pdwDataLen=0x55cf204*=0x1d0) returned 1
	[0189.300] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2763864*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2763864*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.300] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0189.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.300] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpFilePart=0x0) returned 0x96
	[0189.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.300] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.302] GetFileType (hFile=0x318) returned 0x1
	[0189.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.302] GetFileType (hFile=0x318) returned 0x1
	[0189.302] WriteFile (in: hFile=0x318, lpBuffer=0x2763aa0*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2763aa0*, lpNumberOfBytesWritten=0x55cf1c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0189.303] CloseHandle (hObject=0x318) returned 1
	[0189.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpFilePart=0x0) returned 0x96
	[0189.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc5
	[0189.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.303] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab292f9b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0189.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.303] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.305] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.305] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2765078 | out: lpFileInformation=0x2765078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9126046c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283)) returned 1
	[0189.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.305] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.305] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.305] GetFileType (hFile=0x318) returned 0x1
	[0189.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.305] GetFileType (hFile=0x318) returned 0x1
	[0189.306] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x283
	[0189.306] ReadFile (in: hFile=0x318, lpBuffer=0x2765788, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2765788*, lpNumberOfBytesRead=0x55cf1fc*=0x283, lpOverlapped=0x0) returned 1
	[0189.307] CloseHandle (hObject=0x318) returned 1
	[0189.307] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0189.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.307] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2766824, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0189.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.307] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0189.307] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.307] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27668dc*=0x1, dwFlags=0x0) returned 1
	[0189.308] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27668a8, dwFlags=0x0) returned 1
	[0189.308] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27668ec*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x27668ec*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0189.308] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2766b88*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2766b88*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.308] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0189.308] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.308] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.308] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.308] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.309] GetFileType (hFile=0x318) returned 0x1
	[0189.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.309] GetFileType (hFile=0x318) returned 0x1
	[0189.309] WriteFile (in: hFile=0x318, lpBuffer=0x2766dd4*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2766dd4*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0189.310] CloseHandle (hObject=0x318) returned 1
	[0189.311] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.311] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0189.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.311] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab2b9122, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0189.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.311] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.312] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.312] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27683d8 | out: lpFileInformation=0x27683d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9126046c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd)) returned 1
	[0189.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.313] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.313] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.313] GetFileType (hFile=0x318) returned 0x1
	[0189.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.313] GetFileType (hFile=0x318) returned 0x1
	[0189.313] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2bd
	[0189.313] ReadFile (in: hFile=0x318, lpBuffer=0x2768b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2768b24*, lpNumberOfBytesRead=0x55cf1fc*=0x2bd, lpOverlapped=0x0) returned 1
	[0189.366] CloseHandle (hObject=0x318) returned 1
	[0189.366] CryptDestroyKey (hKey=0x82b540) returned 1
	[0189.366] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.367] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2769bc0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0189.367] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.367] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.367] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b4c0) returned 1
	[0189.367] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.367] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2769c78*=0x1, dwFlags=0x0) returned 1
	[0189.367] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2769c44, dwFlags=0x0) returned 1
	[0189.367] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2769c88*, pdwDataLen=0x55cf204*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x2769c88*, pdwDataLen=0x55cf204*=0x2c0) returned 1
	[0189.367] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2769f54*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2769f54*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.367] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0189.367] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.367] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.367] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.367] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.369] GetFileType (hFile=0x318) returned 0x1
	[0189.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.369] GetFileType (hFile=0x318) returned 0x1
	[0189.369] WriteFile (in: hFile=0x318, lpBuffer=0x276a1a0*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x276a1a0*, lpNumberOfBytesWritten=0x55cf1c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0189.370] CloseHandle (hObject=0x318) returned 1
	[0189.370] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.371] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0189.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.371] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab351b39, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0189.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.371] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.372] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0189.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.372] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x276b7a4 | out: lpFileInformation=0x276b7a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9126046c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7)) returned 1
	[0189.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0189.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.373] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.373] GetFileType (hFile=0x318) returned 0x1
	[0189.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.373] GetFileType (hFile=0x318) returned 0x1
	[0189.373] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d7
	[0189.373] ReadFile (in: hFile=0x318, lpBuffer=0x276bf38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x276bf38*, lpNumberOfBytesRead=0x55cf1fc*=0x2d7, lpOverlapped=0x0) returned 1
	[0189.375] CloseHandle (hObject=0x318) returned 1
	[0189.375] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.375] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.375] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276cfd4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b380) returned 1
	[0189.375] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.375] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.375] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0189.375] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.375] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x276d08c*=0x1, dwFlags=0x0) returned 1
	[0189.375] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x276d058, dwFlags=0x0) returned 1
	[0189.375] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276d09c*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x276d09c*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0189.376] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276d388*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x276d388*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.376] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0189.376] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.376] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.376] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0189.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.376] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.377] GetFileType (hFile=0x318) returned 0x1
	[0189.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.377] GetFileType (hFile=0x318) returned 0x1
	[0189.377] WriteFile (in: hFile=0x318, lpBuffer=0x276d5ec*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x276d5ec*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.379] CloseHandle (hObject=0x318) returned 1
	[0189.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0189.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0189.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.379] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab351b39, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.379] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.380] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x276ec14 | out: lpFileInformation=0x276ec14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9126046c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d7)) returned 1
	[0189.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.381] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.381] GetFileType (hFile=0x318) returned 0x1
	[0189.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.381] GetFileType (hFile=0x318) returned 0x1
	[0189.381] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1d7
	[0189.381] ReadFile (in: hFile=0x318, lpBuffer=0x276f218, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x276f218*, lpNumberOfBytesRead=0x55cf1fc*=0x1d7, lpOverlapped=0x0) returned 1
	[0189.382] CloseHandle (hObject=0x318) returned 1
	[0189.382] CryptDestroyKey (hKey=0x82b380) returned 1
	[0189.383] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.383] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27702b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0189.383] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.383] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.383] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b1c0) returned 1
	[0189.383] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.383] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x277036c*=0x1, dwFlags=0x0) returned 1
	[0189.383] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2770338, dwFlags=0x0) returned 1
	[0189.383] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277037c*, pdwDataLen=0x55cf204*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x277037c*, pdwDataLen=0x55cf204*=0x1e0) returned 1
	[0189.383] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2770568*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2770568*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.383] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.383] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.383] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.383] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.383] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.385] GetFileType (hFile=0x318) returned 0x1
	[0189.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.385] GetFileType (hFile=0x318) returned 0x1
	[0189.385] WriteFile (in: hFile=0x318, lpBuffer=0x2770784*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2770784*, lpNumberOfBytesWritten=0x55cf1c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0189.386] CloseHandle (hObject=0x318) returned 1
	[0189.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0189.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.387] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab377da8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0189.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.387] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0189.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.389] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2771d28 | out: lpFileInformation=0x2771d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912866d8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0189.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.390] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0189.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.390] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.390] GetFileType (hFile=0x318) returned 0x1
	[0189.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.390] GetFileType (hFile=0x318) returned 0x1
	[0189.390] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2cb
	[0189.391] ReadFile (in: hFile=0x318, lpBuffer=0x27724d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27724d0*, lpNumberOfBytesRead=0x55cf1fc*=0x2cb, lpOverlapped=0x0) returned 1
	[0189.405] CloseHandle (hObject=0x318) returned 1
	[0189.405] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.405] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.406] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277356c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b340) returned 1
	[0189.406] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.406] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.406] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b380) returned 1
	[0189.406] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.406] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2773624*=0x1, dwFlags=0x0) returned 1
	[0189.406] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27735f0, dwFlags=0x0) returned 1
	[0189.406] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2773634*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2773634*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0189.406] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2773910*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2773910*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.406] CryptDestroyKey (hKey=0x82b380) returned 1
	[0189.406] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.406] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0189.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.406] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.408] GetFileType (hFile=0x318) returned 0x1
	[0189.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.408] GetFileType (hFile=0x318) returned 0x1
	[0189.408] WriteFile (in: hFile=0x318, lpBuffer=0x2773b84*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2773b84*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0189.409] CloseHandle (hObject=0x318) returned 1
	[0189.409] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0189.409] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0189.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.409] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab39e0e0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0189.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.409] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.411] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.411] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27751cc | out: lpFileInformation=0x27751cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912866d8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294)) returned 1
	[0189.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.411] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.411] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.411] GetFileType (hFile=0x318) returned 0x1
	[0189.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.411] GetFileType (hFile=0x318) returned 0x1
	[0189.412] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x294
	[0189.412] ReadFile (in: hFile=0x318, lpBuffer=0x277592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x277592c*, lpNumberOfBytesRead=0x55cf1fc*=0x294, lpOverlapped=0x0) returned 1
	[0189.435] CloseHandle (hObject=0x318) returned 1
	[0189.435] CryptDestroyKey (hKey=0x82b340) returned 1
	[0189.435] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.435] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27769c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0189.435] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.435] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.435] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b400) returned 1
	[0189.435] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.436] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2776a80*=0x1, dwFlags=0x0) returned 1
	[0189.436] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2776a4c, dwFlags=0x0) returned 1
	[0189.436] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2776a90*, pdwDataLen=0x55cf204*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x2776a90*, pdwDataLen=0x55cf204*=0x2a0) returned 1
	[0189.436] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2776d3c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2776d3c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.436] CryptDestroyKey (hKey=0x82b400) returned 1
	[0189.436] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.436] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.436] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.436] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.437] GetFileType (hFile=0x318) returned 0x1
	[0189.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.437] GetFileType (hFile=0x318) returned 0x1
	[0189.437] WriteFile (in: hFile=0x318, lpBuffer=0x2776fa8*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2776fa8*, lpNumberOfBytesWritten=0x55cf1c4*=0x2a0, lpOverlapped=0x0) returned 1
	[0189.438] CloseHandle (hObject=0x318) returned 1
	[0189.438] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.439] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0189.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.439] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab3ea48d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0189.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.439] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.440] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0189.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.440] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27785e0 | out: lpFileInformation=0x27785e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912866d8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285)) returned 1
	[0189.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.441] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0189.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.441] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.441] GetFileType (hFile=0x318) returned 0x1
	[0189.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.441] GetFileType (hFile=0x318) returned 0x1
	[0189.441] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x285
	[0189.441] ReadFile (in: hFile=0x318, lpBuffer=0x2778d04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2778d04*, lpNumberOfBytesRead=0x55cf1fc*=0x285, lpOverlapped=0x0) returned 1
	[0189.452] CloseHandle (hObject=0x318) returned 1
	[0189.452] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.452] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.453] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2779da0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0189.453] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.453] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.453] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0189.453] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.453] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2779e58*=0x1, dwFlags=0x0) returned 1
	[0189.453] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2779e24, dwFlags=0x0) returned 1
	[0189.453] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2779e68*, pdwDataLen=0x55cf204*=0x290, dwBufLen=0x290 | out: pbData=0x2779e68*, pdwDataLen=0x55cf204*=0x290) returned 1
	[0189.453] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277a104*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x277a104*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.453] CryptDestroyKey (hKey=0x82b000) returned 1
	[0189.453] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.453] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.453] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0189.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.453] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.455] GetFileType (hFile=0x318) returned 0x1
	[0189.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.455] GetFileType (hFile=0x318) returned 0x1
	[0189.455] WriteFile (in: hFile=0x318, lpBuffer=0x277a358*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x277a358*, lpNumberOfBytesWritten=0x55cf1c4*=0x290, lpOverlapped=0x0) returned 1
	[0189.456] CloseHandle (hObject=0x318) returned 1
	[0189.456] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0189.456] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0189.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.456] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab41072c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0189.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.456] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0189.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.458] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x277b96c | out: lpFileInformation=0x277b96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912866d8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0189.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0189.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.458] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.458] GetFileType (hFile=0x318) returned 0x1
	[0189.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.458] GetFileType (hFile=0x318) returned 0x1
	[0189.458] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c3
	[0189.458] ReadFile (in: hFile=0x318, lpBuffer=0x277c0dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x277c0dc*, lpNumberOfBytesRead=0x55cf1fc*=0x2c3, lpOverlapped=0x0) returned 1
	[0189.460] CloseHandle (hObject=0x318) returned 1
	[0189.460] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.460] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.460] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277d178, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0189.460] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.460] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.460] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0189.460] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.460] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x277d230*=0x1, dwFlags=0x0) returned 1
	[0189.461] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x277d1fc, dwFlags=0x0) returned 1
	[0189.461] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277d240*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x277d240*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0189.461] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277d51c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x277d51c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.461] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.461] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.461] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.461] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0189.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.461] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.462] GetFileType (hFile=0x318) returned 0x1
	[0189.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.462] GetFileType (hFile=0x318) returned 0x1
	[0189.462] WriteFile (in: hFile=0x318, lpBuffer=0x277d778*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x277d778*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0189.463] CloseHandle (hObject=0x318) returned 1
	[0189.464] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0189.464] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0189.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.464] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab436945, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0189.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.464] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.465] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x277ed9c | out: lpFileInformation=0x277ed9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902943e8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902943e8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902943e8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e1)) returned 1
	[0189.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.466] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.466] GetFileType (hFile=0x318) returned 0x1
	[0189.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.466] GetFileType (hFile=0x318) returned 0x1
	[0189.466] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2e1
	[0189.466] ReadFile (in: hFile=0x318, lpBuffer=0x277f5bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x277f5bc*, lpNumberOfBytesRead=0x55cf1fc*=0x2e1, lpOverlapped=0x0) returned 1
	[0189.470] CloseHandle (hObject=0x318) returned 1
	[0189.470] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.470] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.470] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2780658, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b4c0) returned 1
	[0189.470] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.470] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.470] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0189.470] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.470] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2780710*=0x1, dwFlags=0x0) returned 1
	[0189.470] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27806dc, dwFlags=0x0) returned 1
	[0189.470] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2780720*, pdwDataLen=0x55cf204*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x2780720*, pdwDataLen=0x55cf204*=0x2f0) returned 1
	[0189.470] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2780a1c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2780a1c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.471] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.471] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.471] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.471] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.472] GetFileType (hFile=0x318) returned 0x1
	[0189.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.473] GetFileType (hFile=0x318) returned 0x1
	[0189.473] WriteFile (in: hFile=0x318, lpBuffer=0x2780cc0*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2780cc0*, lpNumberOfBytesWritten=0x55cf1c4*=0x2f0, lpOverlapped=0x0) returned 1
	[0189.473] CloseHandle (hObject=0x318) returned 1
	[0189.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb1
	[0189.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe0
	[0189.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.474] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902943e8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902943e8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab436945, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0189.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.474] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.475] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.475] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2782374 | out: lpFileInformation=0x2782374*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0189.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.475] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.475] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.476] GetFileType (hFile=0x318) returned 0x1
	[0189.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.476] GetFileType (hFile=0x318) returned 0x1
	[0189.476] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c3
	[0189.476] ReadFile (in: hFile=0x318, lpBuffer=0x2782b04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2782b04*, lpNumberOfBytesRead=0x55cf1fc*=0x2c3, lpOverlapped=0x0) returned 1
	[0189.477] CloseHandle (hObject=0x318) returned 1
	[0189.477] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0189.477] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.477] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2783ba0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0189.477] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.477] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.477] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b2c0) returned 1
	[0189.477] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.477] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2783c58*=0x1, dwFlags=0x0) returned 1
	[0189.477] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2783c24, dwFlags=0x0) returned 1
	[0189.478] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2783c68*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2783c68*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0189.478] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2783f44*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2783f44*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.478] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0189.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.478] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.478] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.501] GetFileType (hFile=0x318) returned 0x1
	[0189.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.501] GetFileType (hFile=0x318) returned 0x1
	[0189.501] WriteFile (in: hFile=0x318, lpBuffer=0x27841b0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27841b0*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0189.502] CloseHandle (hObject=0x318) returned 1
	[0189.503] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.503] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0189.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.503] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab482ed5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0189.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.503] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0189.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.504] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27857e8 | out: lpFileInformation=0x27857e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4)) returned 1
	[0189.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0189.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.505] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.505] GetFileType (hFile=0x318) returned 0x1
	[0189.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.505] GetFileType (hFile=0x318) returned 0x1
	[0189.505] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2d4
	[0189.505] ReadFile (in: hFile=0x318, lpBuffer=0x2785f78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2785f78*, lpNumberOfBytesRead=0x55cf1fc*=0x2d4, lpOverlapped=0x0) returned 1
	[0189.507] CloseHandle (hObject=0x318) returned 1
	[0189.507] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.507] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.507] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2787014, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b300) returned 1
	[0189.507] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.507] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.507] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0189.507] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.507] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27870cc*=0x1, dwFlags=0x0) returned 1
	[0189.507] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2787098, dwFlags=0x0) returned 1
	[0189.507] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27870dc*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27870dc*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0189.508] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27873c8*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27873c8*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.508] CryptDestroyKey (hKey=0x82b080) returned 1
	[0189.508] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.508] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.508] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0189.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.508] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.509] GetFileType (hFile=0x318) returned 0x1
	[0189.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.509] GetFileType (hFile=0x318) returned 0x1
	[0189.509] WriteFile (in: hFile=0x318, lpBuffer=0x278762c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x278762c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.510] CloseHandle (hObject=0x318) returned 1
	[0189.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0189.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0189.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.511] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab4a9191, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.511] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.512] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0189.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.512] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2788c54 | out: lpFileInformation=0x2788c54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cd)) returned 1
	[0189.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.513] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0189.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.513] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.513] GetFileType (hFile=0x318) returned 0x1
	[0189.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.513] GetFileType (hFile=0x318) returned 0x1
	[0189.513] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1cd
	[0189.513] ReadFile (in: hFile=0x318, lpBuffer=0x27892d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x27892d0*, lpNumberOfBytesRead=0x55cf1fc*=0x1cd, lpOverlapped=0x0) returned 1
	[0189.514] CloseHandle (hObject=0x318) returned 1
	[0189.514] CryptDestroyKey (hKey=0x82b300) returned 1
	[0189.514] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.514] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278a36c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b280) returned 1
	[0189.514] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.514] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.515] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b000) returned 1
	[0189.515] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.515] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x278a424*=0x1, dwFlags=0x0) returned 1
	[0189.515] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x278a3f0, dwFlags=0x0) returned 1
	[0189.515] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278a434*, pdwDataLen=0x55cf204*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x278a434*, pdwDataLen=0x55cf204*=0x1d0) returned 1
	[0189.515] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278a610*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x278a610*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.515] CryptDestroyKey (hKey=0x82b000) returned 1
	[0189.515] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.515] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0189.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.515] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.516] GetFileType (hFile=0x318) returned 0x1
	[0189.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.516] GetFileType (hFile=0x318) returned 0x1
	[0189.516] WriteFile (in: hFile=0x318, lpBuffer=0x278a86c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x278a86c*, lpNumberOfBytesWritten=0x55cf1c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0189.517] CloseHandle (hObject=0x318) returned 1
	[0189.517] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0189.517] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0189.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.517] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab4a9191, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0189.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.518] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.519] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.519] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278be84 | out: lpFileInformation=0x278be84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0189.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.520] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.521] ReadFile (in: hFile=0x318, lpBuffer=0x278c490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x278c490*, lpNumberOfBytesRead=0x55cf1fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0189.522] CryptDestroyKey (hKey=0x82b280) returned 1
	[0189.522] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.522] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278d52c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b540) returned 1
	[0189.522] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.522] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.522] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82afc0) returned 1
	[0189.522] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.522] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x278d5e4*=0x1, dwFlags=0x0) returned 1
	[0189.522] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x278d5b0, dwFlags=0x0) returned 1
	[0189.522] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278d5f4*, pdwDataLen=0x55cf204*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x278d5f4*, pdwDataLen=0x55cf204*=0x1f0) returned 1
	[0189.522] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278d7f0*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x278d7f0*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.522] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.522] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.522] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.522] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.522] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.524] GetFileType (hFile=0x318) returned 0x1
	[0189.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.524] GetFileType (hFile=0x318) returned 0x1
	[0189.524] WriteFile (in: hFile=0x318, lpBuffer=0x278da0c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x278da0c*, lpNumberOfBytesWritten=0x55cf1c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0189.525] CloseHandle (hObject=0x318) returned 1
	[0189.525] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.525] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0189.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.525] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab4a9191, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0189.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.525] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.527] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.527] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278efb0 | out: lpFileInformation=0x278efb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4)) returned 1
	[0189.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.528] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.528] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.528] GetFileType (hFile=0x318) returned 0x1
	[0189.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.528] GetFileType (hFile=0x318) returned 0x1
	[0189.528] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c4
	[0189.528] ReadFile (in: hFile=0x318, lpBuffer=0x278f700, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x278f700*, lpNumberOfBytesRead=0x55cf1fc*=0x2c4, lpOverlapped=0x0) returned 1
	[0189.530] CloseHandle (hObject=0x318) returned 1
	[0189.530] CryptDestroyKey (hKey=0x82b540) returned 1
	[0189.530] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.530] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279079c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0189.530] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.530] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.530] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b200) returned 1
	[0189.530] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.530] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2790854*=0x1, dwFlags=0x0) returned 1
	[0189.530] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2790820, dwFlags=0x0) returned 1
	[0189.530] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2790864*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2790864*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0189.530] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2790b40*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2790b40*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.530] CryptDestroyKey (hKey=0x82b200) returned 1
	[0189.530] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.530] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.530] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.531] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.532] GetFileType (hFile=0x318) returned 0x1
	[0189.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.532] GetFileType (hFile=0x318) returned 0x1
	[0189.532] WriteFile (in: hFile=0x318, lpBuffer=0x2790d8c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2790d8c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0189.533] CloseHandle (hObject=0x318) returned 1
	[0189.533] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.533] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0189.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.533] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab4cf1a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0189.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.533] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.535] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0189.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.535] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2792390 | out: lpFileInformation=0x2792390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2)) returned 1
	[0189.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.535] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0189.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.535] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.536] GetFileType (hFile=0x318) returned 0x1
	[0189.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.536] GetFileType (hFile=0x318) returned 0x1
	[0189.536] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c2
	[0189.536] ReadFile (in: hFile=0x318, lpBuffer=0x2792ad0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2792ad0*, lpNumberOfBytesRead=0x55cf1fc*=0x2c2, lpOverlapped=0x0) returned 1
	[0189.565] CloseHandle (hObject=0x318) returned 1
	[0189.566] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.566] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.566] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2793b6c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b480) returned 1
	[0189.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.566] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b080) returned 1
	[0189.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.566] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2793c24*=0x1, dwFlags=0x0) returned 1
	[0189.566] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2793bf0, dwFlags=0x0) returned 1
	[0189.566] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2793c34*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2793c34*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0189.566] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2793f10*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2793f10*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.566] CryptDestroyKey (hKey=0x82b080) returned 1
	[0189.566] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.566] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.566] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0189.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.566] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.568] GetFileType (hFile=0x318) returned 0x1
	[0189.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.568] GetFileType (hFile=0x318) returned 0x1
	[0189.568] WriteFile (in: hFile=0x318, lpBuffer=0x2794154*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x2794154*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0189.569] CloseHandle (hObject=0x318) returned 1
	[0189.569] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0189.569] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0189.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.569] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab51b8a1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0189.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.570] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.571] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0189.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.571] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x279573c | out: lpFileInformation=0x279573c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912d2bb2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27d)) returned 1
	[0189.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.571] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0189.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.572] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.572] GetFileType (hFile=0x318) returned 0x1
	[0189.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.572] GetFileType (hFile=0x318) returned 0x1
	[0189.572] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x27d
	[0189.572] ReadFile (in: hFile=0x318, lpBuffer=0x2795e38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x2795e38*, lpNumberOfBytesRead=0x55cf1fc*=0x27d, lpOverlapped=0x0) returned 1
	[0189.573] CloseHandle (hObject=0x318) returned 1
	[0189.573] CryptDestroyKey (hKey=0x82b480) returned 1
	[0189.573] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.574] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2796ed4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0189.574] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.574] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.574] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0189.574] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.574] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2796f8c*=0x1, dwFlags=0x0) returned 1
	[0189.574] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2796f58, dwFlags=0x0) returned 1
	[0189.574] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2796f9c*, pdwDataLen=0x55cf204*=0x280, dwBufLen=0x280 | out: pbData=0x2796f9c*, pdwDataLen=0x55cf204*=0x280) returned 1
	[0189.574] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2797228*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x2797228*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.574] CryptDestroyKey (hKey=0x82b100) returned 1
	[0189.574] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.574] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.574] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0189.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.574] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.575] GetFileType (hFile=0x318) returned 0x1
	[0189.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.576] GetFileType (hFile=0x318) returned 0x1
	[0189.576] WriteFile (in: hFile=0x318, lpBuffer=0x279746c*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x279746c*, lpNumberOfBytesWritten=0x55cf1c4*=0x280, lpOverlapped=0x0) returned 1
	[0189.576] CloseHandle (hObject=0x318) returned 1
	[0189.577] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0189.577] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0189.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.577] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab54193e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0189.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.577] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.581] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0189.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.581] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2798a54 | out: lpFileInformation=0x2798a54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912d2bb2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc)) returned 1
	[0189.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.582] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0189.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.582] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.582] GetFileType (hFile=0x318) returned 0x1
	[0189.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.582] GetFileType (hFile=0x318) returned 0x1
	[0189.582] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2dc
	[0189.582] ReadFile (in: hFile=0x318, lpBuffer=0x279923c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x279923c*, lpNumberOfBytesRead=0x55cf1fc*=0x2dc, lpOverlapped=0x0) returned 1
	[0189.583] CloseHandle (hObject=0x318) returned 1
	[0189.584] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.584] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.584] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279a2d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82afc0) returned 1
	[0189.584] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.584] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.584] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b6c0) returned 1
	[0189.584] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.584] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x279a390*=0x1, dwFlags=0x0) returned 1
	[0189.584] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x279a35c, dwFlags=0x0) returned 1
	[0189.584] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279a3a0*, pdwDataLen=0x55cf204*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x279a3a0*, pdwDataLen=0x55cf204*=0x2e0) returned 1
	[0189.584] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279a68c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x279a68c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.584] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.584] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.584] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.584] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0189.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.584] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.586] GetFileType (hFile=0x318) returned 0x1
	[0189.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.586] GetFileType (hFile=0x318) returned 0x1
	[0189.586] WriteFile (in: hFile=0x318, lpBuffer=0x279a918*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x279a918*, lpNumberOfBytesWritten=0x55cf1c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.587] CloseHandle (hObject=0x318) returned 1
	[0189.587] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0189.587] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd9
	[0189.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.587] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab54193e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.587] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0189.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.589] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x279bf90 | out: lpFileInformation=0x279bf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912d2bb2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2)) returned 1
	[0189.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.589] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0189.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.589] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.589] GetFileType (hFile=0x318) returned 0x1
	[0189.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.589] GetFileType (hFile=0x318) returned 0x1
	[0189.589] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x2c2
	[0189.590] ReadFile (in: hFile=0x318, lpBuffer=0x279c700, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x279c700*, lpNumberOfBytesRead=0x55cf1fc*=0x2c2, lpOverlapped=0x0) returned 1
	[0189.591] CloseHandle (hObject=0x318) returned 1
	[0189.591] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.591] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.591] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279d79c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b1c0) returned 1
	[0189.591] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.591] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.591] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b200) returned 1
	[0189.591] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.591] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x279d854*=0x1, dwFlags=0x0) returned 1
	[0189.591] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x279d820, dwFlags=0x0) returned 1
	[0189.591] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279d864*, pdwDataLen=0x55cf204*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x279d864*, pdwDataLen=0x55cf204*=0x2d0) returned 1
	[0189.592] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279db40*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x279db40*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.592] CryptDestroyKey (hKey=0x82b200) returned 1
	[0189.592] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.592] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.592] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0189.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.592] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.593] GetFileType (hFile=0x318) returned 0x1
	[0189.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.593] GetFileType (hFile=0x318) returned 0x1
	[0189.593] WriteFile (in: hFile=0x318, lpBuffer=0x279dd9c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x279dd9c*, lpNumberOfBytesWritten=0x55cf1c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0189.594] CloseHandle (hObject=0x318) returned 1
	[0189.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0189.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0189.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.594] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab567c61, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0189.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.595] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.596] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x279f3c0 | out: lpFileInformation=0x279f3c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912d2bb2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0189.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cec10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf154) returned 1
	[0189.596] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.596] GetFileType (hFile=0x318) returned 0x1
	[0189.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf150) returned 1
	[0189.596] GetFileType (hFile=0x318) returned 0x1
	[0189.596] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x55cf250 | out: lpFileSizeHigh=0x55cf250*=0x0) returned 0x1e0
	[0189.597] ReadFile (in: hFile=0x318, lpBuffer=0x279f9cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55cf1fc, lpOverlapped=0x0 | out: lpBuffer=0x279f9cc*, lpNumberOfBytesRead=0x55cf1fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0189.598] CloseHandle (hObject=0x318) returned 1
	[0189.598] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.598] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.598] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a0a68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x55cf1a8 | out: phKey=0x55cf1a8*=0x82b6c0) returned 1
	[0189.598] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.598] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.598] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x55cf198 | out: phKey=0x55cf198*=0x82b100) returned 1
	[0189.598] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.598] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27a0b20*=0x1, dwFlags=0x0) returned 1
	[0189.598] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27a0aec, dwFlags=0x0) returned 1
	[0189.598] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a0b30*, pdwDataLen=0x55cf204*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x27a0b30*, pdwDataLen=0x55cf204*=0x1f0) returned 1
	[0189.598] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a0d2c*, pdwDataLen=0x55cf20c*=0x0, dwBufLen=0x10 | out: pbData=0x27a0d2c*, pdwDataLen=0x55cf20c*=0x10) returned 1
	[0189.598] CryptDestroyKey (hKey=0x82b100) returned 1
	[0189.598] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.598] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.598] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55cebfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf140) returned 1
	[0189.599] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.600] GetFileType (hFile=0x318) returned 0x1
	[0189.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf13c) returned 1
	[0189.600] GetFileType (hFile=0x318) returned 0x1
	[0189.600] WriteFile (in: hFile=0x318, lpBuffer=0x27a0f48*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x55cf1c4, lpOverlapped=0x0 | out: lpBuffer=0x27a0f48*, lpNumberOfBytesWritten=0x55cf1c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0189.601] CloseHandle (hObject=0x318) returned 1
	[0189.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0189.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x55ced20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0189.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf1d4) returned 1
	[0189.601] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x55cf250 | out: lpFileInformation=0x55cf250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab567c61, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0189.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf1d0) returned 1
	[0189.601] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.621] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x55cebf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa9
	[0189.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55cf0f0) returned 1
	[0189.621] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a24ec | out: lpFileInformation=0x27a24ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902943e8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902943e8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902943e8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x291)) returned 1
	[0189.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cf0ec) returned 1
	[0189.741] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.797] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.901] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.954] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0190.010] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0190.058] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0190.118] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0

Thread:
	id = 16
	os_tid = 0xc70

	[0116.784] SleepEx (dwMilliseconds=0x1, bAlertable=0) returned 0x0
	[0138.098] CoGetContextToken (in: pToken=0x577f95c | out: pToken=0x577f95c) returned 0x0
	[0138.098] CObjectContext::QueryInterface () returned 0x0
	[0138.098] CObjectContext::GetCurrentThreadType () returned 0x0
	[0138.098] Release () returned 0x0

Thread:
	id = 17
	os_tid = 0x174


Thread:
	id = 18
	os_tid = 0xb6c


Thread:
	id = 19
	os_tid = 0xf48


Thread:
	id = 20
	os_tid = 0xee8

	[0107.711] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0107.711] CoGetContextToken (in: pToken=0x593f7e4 | out: pToken=0x593f7e4) returned 0x0
	[0107.711] CObjectContext::QueryInterface () returned 0x0
	[0107.711] CObjectContext::GetCurrentThreadType () returned 0x0
	[0107.711] Release () returned 0x0
	[0107.711] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1
	[0107.711] CoUninitialize () 
	[0107.711] RoInitialize () returned 0x1
	[0107.711] RoUninitialize () returned 0x0
	[0107.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.870] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.885] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.885] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.929] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0107.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.240] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.296] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.296] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.336] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.381] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.385] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.385] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.385] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.385] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.387] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.396] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.488] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.640] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.640] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.641] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.654] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.657] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.664] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.732] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.734] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.734] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.734] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.864] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.865] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.865] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.865] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.865] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.865] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.866] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.881] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0108.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.423] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.428] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.431] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.463] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.467] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.467] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.473] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.474] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.499] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.499] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.500] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.551] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.551] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.575] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.606] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.607] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.623] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.627] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.638] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.670] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.700] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.716] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.731] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.928] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.929] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.930] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.950] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.966] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.968] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.997] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0109.998] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.019] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.025] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.190] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.195] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.216] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.243] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.244] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.343] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.343] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.343] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.343] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.356] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.388] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.403] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.434] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.450] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0110.590] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpFilePart=0x0) returned 0x3d
	[0110.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0110.590] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.591] GetFileType (hFile=0x2ec) returned 0x1
	[0110.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0110.591] GetFileType (hFile=0x2ec) returned 0x1
	[0110.591] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0110.591] ReadFile (in: hFile=0x2ec, lpBuffer=0x26fde68, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26fde68*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0110.625] CloseHandle (hObject=0x2ec) returned 1
	[0110.625] CryptDestroyKey (hKey=0x82b100) returned 1
	[0110.625] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.625] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271313c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b480) returned 1
	[0110.625] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.625] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.626] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0110.626] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.626] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27131f4*=0x1, dwFlags=0x0) returned 1
	[0110.626] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27131c0, dwFlags=0x0) returned 1
	[0110.626] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2713204*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2713204*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0110.626] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2724220*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2724220*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0110.626] CryptDestroyKey (hKey=0x82b540) returned 1
	[0110.626] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.626] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.626] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpFilePart=0x0) returned 0x3d
	[0110.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0110.627] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.628] GetFileType (hFile=0x2ec) returned 0x1
	[0110.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0110.629] GetFileType (hFile=0x2ec) returned 0x1
	[0110.629] WriteFile (in: hFile=0x2ec, lpBuffer=0x2713204*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2713204*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0110.631] CloseHandle (hObject=0x2ec) returned 1
	[0110.631] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpFilePart=0x0) returned 0x3d
	[0110.631] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6c
	[0110.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0110.631] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7c451938, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0110.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0110.632] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0110.633] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpFilePart=0x0) returned 0x3b
	[0110.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0110.633] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x27246a0 | out: lpFileInformation=0x27246a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0110.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0110.633] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpFilePart=0x0) returned 0x3b
	[0110.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0110.634] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.634] GetFileType (hFile=0x2ec) returned 0x1
	[0110.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0110.634] GetFileType (hFile=0x2ec) returned 0x1
	[0110.634] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0110.634] ReadFile (in: hFile=0x2ec, lpBuffer=0x2724968, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2724968*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0110.895] CloseHandle (hObject=0x2ec) returned 1
	[0110.895] CryptDestroyKey (hKey=0x82b480) returned 1
	[0110.895] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.895] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2739a80, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0110.895] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.895] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.895] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b000) returned 1
	[0110.895] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0110.895] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2739b38*=0x1, dwFlags=0x0) returned 1
	[0110.895] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2739b04, dwFlags=0x0) returned 1
	[0110.895] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2739b48*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2739b48*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0110.895] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274ab64*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x274ab64*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0110.895] CryptDestroyKey (hKey=0x82b000) returned 1
	[0110.896] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.896] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0110.896] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpFilePart=0x0) returned 0x3b
	[0110.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0110.896] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0110.897] GetFileType (hFile=0x2ec) returned 0x1
	[0110.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0110.897] GetFileType (hFile=0x2ec) returned 0x1
	[0110.897] WriteFile (in: hFile=0x2ec, lpBuffer=0x2739b48*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2739b48*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0110.899] CloseHandle (hObject=0x2ec) returned 1
	[0110.899] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpFilePart=0x0) returned 0x3b
	[0110.899] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6a
	[0110.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0110.899] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7c6da0f2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0110.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0110.899] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0110.900] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpFilePart=0x0) returned 0x32
	[0110.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0110.900] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), fInfoLevelId=0x0, lpFileInformation=0x274afcc | out: lpFileInformation=0x274afcc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0111.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0111.038] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpFilePart=0x0) returned 0x32
	[0111.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0111.038] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0111.038] GetFileType (hFile=0x2ec) returned 0x1
	[0111.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0111.038] GetFileType (hFile=0x2ec) returned 0x1
	[0111.038] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0111.039] ReadFile (in: hFile=0x2ec, lpBuffer=0x274b254, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x274b254*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0111.040] CloseHandle (hObject=0x2ec) returned 1
	[0111.040] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0111.040] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0111.041] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275c2f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0111.041] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0111.041] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0111.041] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b4c0) returned 1
	[0111.041] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0111.041] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x275c3a8*=0x1, dwFlags=0x0) returned 1
	[0111.041] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x275c374, dwFlags=0x0) returned 1
	[0111.041] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275c3b8*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x275c3b8*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0111.041] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276d3d4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x276d3d4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0111.041] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0111.041] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0111.041] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0111.041] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpFilePart=0x0) returned 0x32
	[0111.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0111.041] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0111.043] GetFileType (hFile=0x2ec) returned 0x1
	[0111.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0111.043] GetFileType (hFile=0x2ec) returned 0x1
	[0111.043] WriteFile (in: hFile=0x2ec, lpBuffer=0x275c3b8*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x275c3b8*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0111.155] CloseHandle (hObject=0x2ec) returned 1
	[0111.155] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpFilePart=0x0) returned 0x32
	[0111.155] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0111.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0111.155] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7c9628ba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0111.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0111.155] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0111.156] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0111.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0111.156] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x276d7d0 | out: lpFileInformation=0x276d7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0111.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0111.157] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0111.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0111.157] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0111.158] GetFileType (hFile=0x2ec) returned 0x1
	[0111.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0111.158] GetFileType (hFile=0x2ec) returned 0x1
	[0111.158] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0111.158] ReadFile (in: hFile=0x2ec, lpBuffer=0x2774750, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2774750*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0111.808] CloseHandle (hObject=0x2ec) returned 1
	[0111.808] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0111.808] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0111.808] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27898b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0111.808] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0111.808] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0111.809] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0111.809] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0111.809] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2789968*=0x1, dwFlags=0x0) returned 1
	[0111.809] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2789934, dwFlags=0x0) returned 1
	[0111.809] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2789978*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2789978*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0111.809] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279a994*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x279a994*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0111.809] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0111.809] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0111.809] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0111.809] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0111.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0111.810] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.124] GetFileType (hFile=0x2ec) returned 0x1
	[0112.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.124] GetFileType (hFile=0x2ec) returned 0x1
	[0112.124] WriteFile (in: hFile=0x2ec, lpBuffer=0x2789978*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2789978*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.126] CloseHandle (hObject=0x2ec) returned 1
	[0112.126] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0112.126] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0112.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.126] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d29f92c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.127] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.127] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", lpFilePart=0x0) returned 0x38
	[0112.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.127] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), fInfoLevelId=0x0, lpFileInformation=0x279adcc | out: lpFileInformation=0x279adcc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.128] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", lpFilePart=0x0) returned 0x38
	[0112.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.128] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.129] GetFileType (hFile=0x2ec) returned 0x1
	[0112.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.129] GetFileType (hFile=0x2ec) returned 0x1
	[0112.129] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.129] ReadFile (in: hFile=0x2ec, lpBuffer=0x279b084, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x279b084*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.213] CloseHandle (hObject=0x2ec) returned 1
	[0112.213] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0112.213] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.213] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b8640, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0112.214] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.214] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.214] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0112.214] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.214] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27b86f8*=0x1, dwFlags=0x0) returned 1
	[0112.214] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27b86c4, dwFlags=0x0) returned 1
	[0112.214] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b8708*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x27b8708*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.214] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9724*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27c9724*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.214] CryptDestroyKey (hKey=0x82b380) returned 1
	[0112.214] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.214] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.214] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", lpFilePart=0x0) returned 0x38
	[0112.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.215] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.217] GetFileType (hFile=0x2ec) returned 0x1
	[0112.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.217] GetFileType (hFile=0x2ec) returned 0x1
	[0112.217] WriteFile (in: hFile=0x2ec, lpBuffer=0x27b8708*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27b8708*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.219] CloseHandle (hObject=0x2ec) returned 1
	[0112.219] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", lpFilePart=0x0) returned 0x38
	[0112.219] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0112.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.220] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d3848bd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.220] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.221] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", lpFilePart=0x0) returned 0x32
	[0112.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.221] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x27c9b68 | out: lpFileInformation=0x27c9b68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.221] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", lpFilePart=0x0) returned 0x32
	[0112.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.222] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.222] GetFileType (hFile=0x2ec) returned 0x1
	[0112.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.222] GetFileType (hFile=0x2ec) returned 0x1
	[0112.222] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.222] ReadFile (in: hFile=0x2ec, lpBuffer=0x27c9df0, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9df0*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.342] CloseHandle (hObject=0x2ec) returned 1
	[0112.343] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0112.343] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.343] CryptImportKey (in: hProv=0x7f93c0, pbData=0x25e2f08, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b2c0) returned 1
	[0112.343] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.343] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.343] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0112.343] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.343] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x25e2fc0*=0x1, dwFlags=0x0) returned 1
	[0112.344] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x25e2f8c, dwFlags=0x0) returned 1
	[0112.344] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x25e2fd0*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x25e2fd0*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.344] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25f3fec*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x25f3fec*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.344] CryptDestroyKey (hKey=0x82b540) returned 1
	[0112.344] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.344] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.344] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", lpFilePart=0x0) returned 0x32
	[0112.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.344] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.346] GetFileType (hFile=0x2ec) returned 0x1
	[0112.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.346] GetFileType (hFile=0x2ec) returned 0x1
	[0112.346] WriteFile (in: hFile=0x2ec, lpBuffer=0x25e2fd0*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x25e2fd0*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.348] CloseHandle (hObject=0x2ec) returned 1
	[0112.348] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", lpFilePart=0x0) returned 0x32
	[0112.348] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0112.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.349] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d4b5ce0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.349] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.350] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", lpFilePart=0x0) returned 0x29
	[0112.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.350] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x25f43e8 | out: lpFileInformation=0x25f43e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.350] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", lpFilePart=0x0) returned 0x29
	[0112.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.351] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.351] GetFileType (hFile=0x2ec) returned 0x1
	[0112.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.351] GetFileType (hFile=0x2ec) returned 0x1
	[0112.351] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.351] ReadFile (in: hFile=0x2ec, lpBuffer=0x25f4620, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x25f4620*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.364] CloseHandle (hObject=0x2ec) returned 1
	[0112.364] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0112.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.365] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26056bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b040) returned 1
	[0112.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.365] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b100) returned 1
	[0112.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.365] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2605774*=0x1, dwFlags=0x0) returned 1
	[0112.365] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2605740, dwFlags=0x0) returned 1
	[0112.365] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2605784*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2605784*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.365] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26167a0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26167a0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.365] CryptDestroyKey (hKey=0x82b100) returned 1
	[0112.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.365] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", lpFilePart=0x0) returned 0x29
	[0112.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.365] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.366] GetFileType (hFile=0x2ec) returned 0x1
	[0112.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.366] GetFileType (hFile=0x2ec) returned 0x1
	[0112.366] WriteFile (in: hFile=0x2ec, lpBuffer=0x2605784*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2605784*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.368] CloseHandle (hObject=0x2ec) returned 1
	[0112.368] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", lpFilePart=0x0) returned 0x29
	[0112.368] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x58
	[0112.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.368] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d4dbded, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.368] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.369] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", lpFilePart=0x0) returned 0x2f
	[0112.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.369] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2616b30 | out: lpFileInformation=0x2616b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.369] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", lpFilePart=0x0) returned 0x2f
	[0112.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.369] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.369] GetFileType (hFile=0x2ec) returned 0x1
	[0112.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.370] GetFileType (hFile=0x2ec) returned 0x1
	[0112.370] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.370] ReadFile (in: hFile=0x2ec, lpBuffer=0x2616d98, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2616d98*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.389] CloseHandle (hObject=0x2ec) returned 1
	[0112.389] CryptDestroyKey (hKey=0x82b040) returned 1
	[0112.389] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.389] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262c0bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0112.389] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.389] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.389] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b480) returned 1
	[0112.389] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.389] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x262c174*=0x1, dwFlags=0x0) returned 1
	[0112.389] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x262c140, dwFlags=0x0) returned 1
	[0112.389] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262c184*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x262c184*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.389] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263d1a0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x263d1a0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.390] CryptDestroyKey (hKey=0x82b480) returned 1
	[0112.390] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.390] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.390] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", lpFilePart=0x0) returned 0x2f
	[0112.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.390] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.391] GetFileType (hFile=0x2ec) returned 0x1
	[0112.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.391] GetFileType (hFile=0x2ec) returned 0x1
	[0112.391] WriteFile (in: hFile=0x2ec, lpBuffer=0x262c184*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x262c184*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.393] CloseHandle (hObject=0x2ec) returned 1
	[0112.393] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", lpFilePart=0x0) returned 0x2f
	[0112.393] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0112.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.393] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d52819c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.393] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.394] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", lpFilePart=0x0) returned 0x30
	[0112.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.394] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x263d578 | out: lpFileInformation=0x263d578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.394] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", lpFilePart=0x0) returned 0x30
	[0112.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.394] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.394] GetFileType (hFile=0x2ec) returned 0x1
	[0112.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.394] GetFileType (hFile=0x2ec) returned 0x1
	[0112.394] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.395] ReadFile (in: hFile=0x2ec, lpBuffer=0x263d7f0, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x263d7f0*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.423] CloseHandle (hObject=0x2ec) returned 1
	[0112.424] CryptDestroyKey (hKey=0x82b540) returned 1
	[0112.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.424] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264e88c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0112.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.424] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0112.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.424] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x264e944*=0x1, dwFlags=0x0) returned 1
	[0112.424] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x264e910, dwFlags=0x0) returned 1
	[0112.424] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264e954*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x264e954*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.424] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265f970*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x265f970*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.424] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0112.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.424] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", lpFilePart=0x0) returned 0x30
	[0112.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.425] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.426] GetFileType (hFile=0x2ec) returned 0x1
	[0112.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.426] GetFileType (hFile=0x2ec) returned 0x1
	[0112.426] WriteFile (in: hFile=0x2ec, lpBuffer=0x264e954*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x264e954*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.428] CloseHandle (hObject=0x2ec) returned 1
	[0112.429] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", lpFilePart=0x0) returned 0x30
	[0112.429] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0112.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.429] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d5747c9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.429] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.430] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", lpFilePart=0x0) returned 0x3a
	[0112.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.430] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x265fd54 | out: lpFileInformation=0x265fd54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.430] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", lpFilePart=0x0) returned 0x3a
	[0112.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.430] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.431] GetFileType (hFile=0x2ec) returned 0x1
	[0112.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.431] GetFileType (hFile=0x2ec) returned 0x1
	[0112.431] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.431] ReadFile (in: hFile=0x2ec, lpBuffer=0x266001c, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x266001c*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.440] CloseHandle (hObject=0x2ec) returned 1
	[0112.440] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0112.440] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.440] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2679688, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0112.440] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.440] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.440] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b300) returned 1
	[0112.440] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.441] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2679740*=0x1, dwFlags=0x0) returned 1
	[0112.441] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x267970c, dwFlags=0x0) returned 1
	[0112.441] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2679750*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2679750*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.441] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268a76c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x268a76c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.441] CryptDestroyKey (hKey=0x82b300) returned 1
	[0112.441] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.441] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.441] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", lpFilePart=0x0) returned 0x3a
	[0112.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.441] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.443] GetFileType (hFile=0x2ec) returned 0x1
	[0112.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.443] GetFileType (hFile=0x2ec) returned 0x1
	[0112.443] WriteFile (in: hFile=0x2ec, lpBuffer=0x2679750*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2679750*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.445] CloseHandle (hObject=0x2ec) returned 1
	[0112.445] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", lpFilePart=0x0) returned 0x3a
	[0112.445] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0112.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.445] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d59a8ec, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.446] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.446] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", lpFilePart=0x0) returned 0x30
	[0112.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.446] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x268abc8 | out: lpFileInformation=0x268abc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.447] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", lpFilePart=0x0) returned 0x30
	[0112.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.448] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.448] GetFileType (hFile=0x2ec) returned 0x1
	[0112.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.448] GetFileType (hFile=0x2ec) returned 0x1
	[0112.448] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.448] ReadFile (in: hFile=0x2ec, lpBuffer=0x268ae40, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x268ae40*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.469] CloseHandle (hObject=0x2ec) returned 1
	[0112.469] CryptDestroyKey (hKey=0x82b540) returned 1
	[0112.469] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.469] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269bedc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0112.469] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.470] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.470] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0112.470] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.470] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x269bf94*=0x1, dwFlags=0x0) returned 1
	[0112.470] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x269bf60, dwFlags=0x0) returned 1
	[0112.470] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269bfa4*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x269bfa4*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.470] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26acfc0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26acfc0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.470] CryptDestroyKey (hKey=0x82b540) returned 1
	[0112.470] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.470] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.470] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", lpFilePart=0x0) returned 0x30
	[0112.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.471] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.472] GetFileType (hFile=0x2ec) returned 0x1
	[0112.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.472] GetFileType (hFile=0x2ec) returned 0x1
	[0112.472] WriteFile (in: hFile=0x2ec, lpBuffer=0x269bfa4*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x269bfa4*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.474] CloseHandle (hObject=0x2ec) returned 1
	[0112.474] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", lpFilePart=0x0) returned 0x30
	[0112.474] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0112.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.474] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d5e6de8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.474] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.475] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", lpFilePart=0x0) returned 0x28
	[0112.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.475] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26ad3a4 | out: lpFileInformation=0x26ad3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.475] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", lpFilePart=0x0) returned 0x28
	[0112.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.475] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.475] GetFileType (hFile=0x2ec) returned 0x1
	[0112.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.475] GetFileType (hFile=0x2ec) returned 0x1
	[0112.475] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.475] ReadFile (in: hFile=0x2ec, lpBuffer=0x26ad5dc, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26ad5dc*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.493] CloseHandle (hObject=0x2ec) returned 1
	[0112.493] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0112.493] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.493] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d3690, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b4c0) returned 1
	[0112.493] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.493] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.493] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0112.493] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.493] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26d3748*=0x1, dwFlags=0x0) returned 1
	[0112.493] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26d3714, dwFlags=0x0) returned 1
	[0112.494] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d3758*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x26d3758*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.494] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e4774*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26e4774*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.494] CryptDestroyKey (hKey=0x82b540) returned 1
	[0112.494] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.494] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.494] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", lpFilePart=0x0) returned 0x28
	[0112.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.494] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.496] GetFileType (hFile=0x2ec) returned 0x1
	[0112.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.497] GetFileType (hFile=0x2ec) returned 0x1
	[0112.497] WriteFile (in: hFile=0x2ec, lpBuffer=0x26d3758*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26d3758*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.499] CloseHandle (hObject=0x2ec) returned 1
	[0112.503] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", lpFilePart=0x0) returned 0x28
	[0112.503] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0112.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.503] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d6332d5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.504] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.504] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpFilePart=0x0) returned 0x52
	[0112.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.505] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26e4af8 | out: lpFileInformation=0x26e4af8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.529] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpFilePart=0x0) returned 0x52
	[0112.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.529] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.529] GetFileType (hFile=0x2ec) returned 0x1
	[0112.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.529] GetFileType (hFile=0x2ec) returned 0x1
	[0112.529] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.529] ReadFile (in: hFile=0x2ec, lpBuffer=0x26e91b8, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26e91b8*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.544] CloseHandle (hObject=0x2ec) returned 1
	[0112.544] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0112.544] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.544] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fa254, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b4c0) returned 1
	[0112.544] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.544] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.544] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b300) returned 1
	[0112.545] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.545] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26fa30c*=0x1, dwFlags=0x0) returned 1
	[0112.545] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26fa2d8, dwFlags=0x0) returned 1
	[0112.545] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fa31c*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x26fa31c*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.545] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270b338*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x270b338*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.545] CryptDestroyKey (hKey=0x82b300) returned 1
	[0112.545] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.545] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.545] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpFilePart=0x0) returned 0x52
	[0112.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.545] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.548] GetFileType (hFile=0x2ec) returned 0x1
	[0112.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.548] GetFileType (hFile=0x2ec) returned 0x1
	[0112.548] WriteFile (in: hFile=0x2ec, lpBuffer=0x26fa31c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26fa31c*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.550] CloseHandle (hObject=0x2ec) returned 1
	[0112.550] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpFilePart=0x0) returned 0x52
	[0112.551] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x81
	[0112.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.551] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d6ab7b4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.551] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.552] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", lpFilePart=0x0) returned 0x36
	[0112.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.552] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x270b8b4 | out: lpFileInformation=0x270b8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.552] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", lpFilePart=0x0) returned 0x36
	[0112.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.552] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.553] GetFileType (hFile=0x2ec) returned 0x1
	[0112.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.553] GetFileType (hFile=0x2ec) returned 0x1
	[0112.553] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.553] ReadFile (in: hFile=0x2ec, lpBuffer=0x270bb5c, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x270bb5c*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.565] CloseHandle (hObject=0x2ec) returned 1
	[0112.565] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0112.565] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.565] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27295a0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0112.565] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.566] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0112.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.566] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2729658*=0x1, dwFlags=0x0) returned 1
	[0112.566] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2729624, dwFlags=0x0) returned 1
	[0112.566] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2729668*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2729668*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.566] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273a684*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x273a684*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.566] CryptDestroyKey (hKey=0x82b380) returned 1
	[0112.566] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.566] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.566] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", lpFilePart=0x0) returned 0x36
	[0112.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.567] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.568] GetFileType (hFile=0x2ec) returned 0x1
	[0112.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.568] GetFileType (hFile=0x2ec) returned 0x1
	[0112.568] WriteFile (in: hFile=0x2ec, lpBuffer=0x2729668*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2729668*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.572] CloseHandle (hObject=0x2ec) returned 1
	[0112.573] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", lpFilePart=0x0) returned 0x36
	[0112.573] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0112.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.573] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d6cbb30, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.573] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.574] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpFilePart=0x0) returned 0x48
	[0112.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.574] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x273aab0 | out: lpFileInformation=0x273aab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.575] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpFilePart=0x0) returned 0x48
	[0112.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.575] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.575] GetFileType (hFile=0x2ec) returned 0x1
	[0112.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.575] GetFileType (hFile=0x2ec) returned 0x1
	[0112.575] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.575] ReadFile (in: hFile=0x2ec, lpBuffer=0x273ade8, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x273ade8*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.592] CloseHandle (hObject=0x2ec) returned 1
	[0112.592] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0112.593] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.593] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274be84, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0112.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.593] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b2c0) returned 1
	[0112.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.593] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x274bf3c*=0x1, dwFlags=0x0) returned 1
	[0112.593] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x274bf08, dwFlags=0x0) returned 1
	[0112.593] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274bf4c*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x274bf4c*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.593] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275cf68*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x275cf68*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.594] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0112.594] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.594] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.594] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpFilePart=0x0) returned 0x48
	[0112.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.594] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.596] GetFileType (hFile=0x2ec) returned 0x1
	[0112.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.596] GetFileType (hFile=0x2ec) returned 0x1
	[0112.596] WriteFile (in: hFile=0x2ec, lpBuffer=0x274bf4c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x274bf4c*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.599] CloseHandle (hObject=0x2ec) returned 1
	[0112.599] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpFilePart=0x0) returned 0x48
	[0112.599] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x77
	[0112.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.599] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d71c6bc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.600] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.600] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", lpFilePart=0x0) returned 0x31
	[0112.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.600] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), fInfoLevelId=0x0, lpFileInformation=0x275d46c | out: lpFileInformation=0x275d46c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000)) returned 1
	[0112.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.606] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", lpFilePart=0x0) returned 0x31
	[0112.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.606] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.607] GetFileType (hFile=0x2ec) returned 0x1
	[0112.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.607] GetFileType (hFile=0x2ec) returned 0x1
	[0112.607] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x101000
	[0112.610] ReadFile (in: hFile=0x2ec, lpBuffer=0xddc50c8, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0xddc50c8*, lpNumberOfBytesRead=0x593f2cc*=0x101000, lpOverlapped=0x0) returned 1
	[0112.678] CloseHandle (hObject=0x2ec) returned 1
	[0112.678] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0112.678] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.678] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2828754, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0112.678] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.678] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.678] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0112.678] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.678] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x282880c*=0x1, dwFlags=0x0) returned 1
	[0112.678] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x28287d8, dwFlags=0x0) returned 1
	[0112.690] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xdec60e8*, pdwDataLen=0x593f2d4*=0x101010, dwBufLen=0x101010 | out: pbData=0xdec60e8*, pdwDataLen=0x593f2d4*=0x101010) returned 1
	[0112.691] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x282881c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x282881c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.691] CryptDestroyKey (hKey=0x82b340) returned 1
	[0112.692] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.699] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.699] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", lpFilePart=0x0) returned 0x31
	[0112.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.699] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.702] GetFileType (hFile=0x2ec) returned 0x1
	[0112.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.702] GetFileType (hFile=0x2ec) returned 0x1
	[0112.702] WriteFile (in: hFile=0x2ec, lpBuffer=0xdec60e8*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0xdec60e8*, lpNumberOfBytesWritten=0x593f2c0*=0x101010, lpOverlapped=0x0) returned 1
	[0112.724] CloseHandle (hObject=0x2ec) returned 1
	[0112.724] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", lpFilePart=0x0) returned 0x31
	[0112.724] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x60
	[0112.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.724] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d8495d0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x101010)) returned 1
	[0112.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.733] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.734] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0112.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.734] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2834f28 | out: lpFileInformation=0x2834f28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.735] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0112.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.735] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.735] GetFileType (hFile=0x2ec) returned 0x1
	[0112.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.735] GetFileType (hFile=0x2ec) returned 0x1
	[0112.735] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.736] ReadFile (in: hFile=0x2ec, lpBuffer=0x28351d0, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x28351d0*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.759] CloseHandle (hObject=0x2ec) returned 1
	[0112.760] CryptDestroyKey (hKey=0x82b280) returned 1
	[0112.760] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.760] CryptImportKey (in: hProv=0x7f93c0, pbData=0x284626c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b080) returned 1
	[0112.760] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.760] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.760] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0112.760] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.760] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2846324*=0x1, dwFlags=0x0) returned 1
	[0112.760] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x28462f0, dwFlags=0x0) returned 1
	[0112.760] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2846334*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2846334*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.760] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2857350*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2857350*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.761] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0112.761] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.761] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.761] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0112.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.761] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.763] GetFileType (hFile=0x2ec) returned 0x1
	[0112.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.763] GetFileType (hFile=0x2ec) returned 0x1
	[0112.763] WriteFile (in: hFile=0x2ec, lpBuffer=0x2846334*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2846334*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.765] CloseHandle (hObject=0x2ec) returned 1
	[0112.765] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", lpFilePart=0x0) returned 0x37
	[0112.765] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0112.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.766] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d8bbb41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.766] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.767] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpFilePart=0x0) returned 0x37
	[0112.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.767] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2857788 | out: lpFileInformation=0x2857788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.768] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpFilePart=0x0) returned 0x37
	[0112.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.768] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.768] GetFileType (hFile=0x2ec) returned 0x1
	[0112.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.768] GetFileType (hFile=0x2ec) returned 0x1
	[0112.768] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.768] ReadFile (in: hFile=0x2ec, lpBuffer=0x2857a30, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2857a30*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.792] CloseHandle (hObject=0x2ec) returned 1
	[0112.792] CryptDestroyKey (hKey=0x82b080) returned 1
	[0112.792] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.792] CryptImportKey (in: hProv=0x7f93c0, pbData=0x286de18, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b040) returned 1
	[0112.792] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.792] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.792] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b400) returned 1
	[0112.792] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.793] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x286ded0*=0x1, dwFlags=0x0) returned 1
	[0112.793] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x286de9c, dwFlags=0x0) returned 1
	[0112.793] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x286dee0*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x286dee0*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.793] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x287eefc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x287eefc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.793] CryptDestroyKey (hKey=0x82b400) returned 1
	[0112.793] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.793] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.793] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpFilePart=0x0) returned 0x37
	[0112.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.793] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.795] GetFileType (hFile=0x2ec) returned 0x1
	[0112.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.796] GetFileType (hFile=0x2ec) returned 0x1
	[0112.796] WriteFile (in: hFile=0x2ec, lpBuffer=0x286dee0*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x286dee0*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.798] CloseHandle (hObject=0x2ec) returned 1
	[0112.798] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpFilePart=0x0) returned 0x37
	[0112.798] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0112.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.798] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d9081a9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.798] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.799] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", lpFilePart=0x0) returned 0x36
	[0112.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.799] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x287f334 | out: lpFileInformation=0x287f334*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.799] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", lpFilePart=0x0) returned 0x36
	[0112.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.799] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.799] GetFileType (hFile=0x2ec) returned 0x1
	[0112.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.799] GetFileType (hFile=0x2ec) returned 0x1
	[0112.800] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.800] ReadFile (in: hFile=0x2ec, lpBuffer=0x287f5dc, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x287f5dc*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.812] CloseHandle (hObject=0x2ec) returned 1
	[0112.812] CryptDestroyKey (hKey=0x82b040) returned 1
	[0112.813] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.813] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28959c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0112.813] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.813] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.813] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0112.813] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.813] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2895a80*=0x1, dwFlags=0x0) returned 1
	[0112.813] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2895a4c, dwFlags=0x0) returned 1
	[0112.813] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2895a90*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2895a90*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.813] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28a6aac*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28a6aac*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.813] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0112.813] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.813] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.813] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", lpFilePart=0x0) returned 0x36
	[0112.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.813] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.815] GetFileType (hFile=0x2ec) returned 0x1
	[0112.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.815] GetFileType (hFile=0x2ec) returned 0x1
	[0112.815] WriteFile (in: hFile=0x2ec, lpBuffer=0x2895a90*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2895a90*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.817] CloseHandle (hObject=0x2ec) returned 1
	[0112.818] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", lpFilePart=0x0) returned 0x36
	[0112.818] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0112.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.818] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d92e20d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.818] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.819] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", lpFilePart=0x0) returned 0x36
	[0112.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.819] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), fInfoLevelId=0x0, lpFileInformation=0x28a6ed8 | out: lpFileInformation=0x28a6ed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.819] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", lpFilePart=0x0) returned 0x36
	[0112.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.820] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.820] GetFileType (hFile=0x2ec) returned 0x1
	[0112.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.820] GetFileType (hFile=0x2ec) returned 0x1
	[0112.820] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.820] ReadFile (in: hFile=0x2ec, lpBuffer=0x28a7180, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x28a7180*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.840] CloseHandle (hObject=0x2ec) returned 1
	[0112.840] CryptDestroyKey (hKey=0x82b340) returned 1
	[0112.840] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.841] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28bebb4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0112.841] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.841] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.841] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0112.841] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.841] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x28bec6c*=0x1, dwFlags=0x0) returned 1
	[0112.841] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x28bec38, dwFlags=0x0) returned 1
	[0112.841] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28bec7c*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x28bec7c*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.841] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28cfc98*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28cfc98*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.841] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0112.841] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.841] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.841] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", lpFilePart=0x0) returned 0x36
	[0112.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.842] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.843] GetFileType (hFile=0x2ec) returned 0x1
	[0112.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.843] GetFileType (hFile=0x2ec) returned 0x1
	[0112.844] WriteFile (in: hFile=0x2ec, lpBuffer=0x28bec7c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x28bec7c*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.846] CloseHandle (hObject=0x2ec) returned 1
	[0112.846] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", lpFilePart=0x0) returned 0x36
	[0112.846] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0112.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.846] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d97a668, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.846] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.847] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", lpFilePart=0x0) returned 0x35
	[0112.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.847] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x28d00c4 | out: lpFileInformation=0x28d00c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.855] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", lpFilePart=0x0) returned 0x35
	[0112.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.855] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.856] GetFileType (hFile=0x2ec) returned 0x1
	[0112.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.856] GetFileType (hFile=0x2ec) returned 0x1
	[0112.856] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.856] ReadFile (in: hFile=0x2ec, lpBuffer=0x28d6b54, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x28d6b54*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.905] CloseHandle (hObject=0x2ec) returned 1
	[0112.905] CryptDestroyKey (hKey=0x82b540) returned 1
	[0112.905] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.905] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28ecf48, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0112.905] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.905] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.905] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b200) returned 1
	[0112.905] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.905] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x28ed000*=0x1, dwFlags=0x0) returned 1
	[0112.905] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x28ecfcc, dwFlags=0x0) returned 1
	[0112.906] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28ed010*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x28ed010*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.906] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28fe02c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28fe02c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.906] CryptDestroyKey (hKey=0x82b200) returned 1
	[0112.906] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.906] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.906] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", lpFilePart=0x0) returned 0x35
	[0112.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.906] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0112.908] GetFileType (hFile=0x2ec) returned 0x1
	[0112.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.908] GetFileType (hFile=0x2ec) returned 0x1
	[0112.908] WriteFile (in: hFile=0x2ec, lpBuffer=0x28ed010*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x28ed010*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.910] CloseHandle (hObject=0x2ec) returned 1
	[0112.910] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", lpFilePart=0x0) returned 0x35
	[0112.910] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0112.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.910] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7da13038, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.910] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.911] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", lpFilePart=0x0) returned 0x32
	[0112.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.911] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), fInfoLevelId=0x0, lpFileInformation=0x28fe44c | out: lpFileInformation=0x28fe44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.913] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", lpFilePart=0x0) returned 0x32
	[0112.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.913] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0112.913] GetFileType (hFile=0x5dc) returned 0x1
	[0112.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.913] GetFileType (hFile=0x5dc) returned 0x1
	[0112.914] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.914] ReadFile (in: hFile=0x5dc, lpBuffer=0x28fe6d4, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x28fe6d4*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.926] CloseHandle (hObject=0x5dc) returned 1
	[0112.926] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0112.926] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.927] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2613aa4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0112.927] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.927] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.927] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0112.927] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.927] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2613b5c*=0x1, dwFlags=0x0) returned 1
	[0112.927] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2613b28, dwFlags=0x0) returned 1
	[0112.927] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2613b6c*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2613b6c*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.927] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2624b88*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2624b88*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.927] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0112.927] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.927] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.927] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", lpFilePart=0x0) returned 0x32
	[0112.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.927] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0112.929] GetFileType (hFile=0x5dc) returned 0x1
	[0112.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.929] GetFileType (hFile=0x5dc) returned 0x1
	[0112.929] WriteFile (in: hFile=0x5dc, lpBuffer=0x2613b6c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2613b6c*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.931] CloseHandle (hObject=0x5dc) returned 1
	[0112.932] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", lpFilePart=0x0) returned 0x32
	[0112.932] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0112.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.932] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7da3959a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.932] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.933] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", lpFilePart=0x0) returned 0x2f
	[0112.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.933] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2624f84 | out: lpFileInformation=0x2624f84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.933] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", lpFilePart=0x0) returned 0x2f
	[0112.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.934] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0112.934] GetFileType (hFile=0x5dc) returned 0x1
	[0112.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.934] GetFileType (hFile=0x5dc) returned 0x1
	[0112.934] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.934] ReadFile (in: hFile=0x5dc, lpBuffer=0x26251ec, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26251ec*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.939] CloseHandle (hObject=0x5dc) returned 1
	[0112.939] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0112.939] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.939] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2638ee0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b4c0) returned 1
	[0112.939] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.939] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.939] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0112.940] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.940] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2638f98*=0x1, dwFlags=0x0) returned 1
	[0112.940] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2638f64, dwFlags=0x0) returned 1
	[0112.940] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2638fa8*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2638fa8*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.940] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2649fc4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2649fc4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.940] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0112.940] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.940] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.940] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", lpFilePart=0x0) returned 0x2f
	[0112.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.940] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0112.942] GetFileType (hFile=0x5dc) returned 0x1
	[0112.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.942] GetFileType (hFile=0x5dc) returned 0x1
	[0112.942] WriteFile (in: hFile=0x5dc, lpBuffer=0x2638fa8*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2638fa8*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.944] CloseHandle (hObject=0x5dc) returned 1
	[0112.944] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", lpFilePart=0x0) returned 0x2f
	[0112.944] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0112.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.944] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7da5f56b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.944] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.945] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", lpFilePart=0x0) returned 0x36
	[0112.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.945] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), fInfoLevelId=0x0, lpFileInformation=0x264a39c | out: lpFileInformation=0x264a39c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.946] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", lpFilePart=0x0) returned 0x36
	[0112.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.946] ReadFile (in: hFile=0x5dc, lpBuffer=0x264a644, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x264a644*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.963] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0112.963] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.963] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2687804, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0112.963] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.963] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.963] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b4c0) returned 1
	[0112.963] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.963] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26878bc*=0x1, dwFlags=0x0) returned 1
	[0112.963] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2687888, dwFlags=0x0) returned 1
	[0112.963] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26878cc*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x26878cc*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.964] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26988e8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26988e8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.964] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0112.964] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.964] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.964] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", lpFilePart=0x0) returned 0x36
	[0112.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.964] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0112.966] GetFileType (hFile=0x5dc) returned 0x1
	[0112.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.966] GetFileType (hFile=0x5dc) returned 0x1
	[0112.966] WriteFile (in: hFile=0x5dc, lpBuffer=0x26878cc*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26878cc*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0112.969] CloseHandle (hObject=0x5dc) returned 1
	[0112.969] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", lpFilePart=0x0) returned 0x36
	[0112.969] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0112.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0112.969] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7daae7bb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0112.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0112.969] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0112.972] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", lpFilePart=0x0) returned 0x35
	[0112.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0112.972] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x269d4a4 | out: lpFileInformation=0x269d4a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0112.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0112.972] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", lpFilePart=0x0) returned 0x35
	[0112.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0112.972] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0112.973] GetFileType (hFile=0x5dc) returned 0x1
	[0112.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0112.973] GetFileType (hFile=0x5dc) returned 0x1
	[0112.974] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0112.974] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a1a14, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26a1a14*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0112.995] CloseHandle (hObject=0x5dc) returned 1
	[0112.995] CryptDestroyKey (hKey=0x82b400) returned 1
	[0112.995] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.996] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d59bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b200) returned 1
	[0112.996] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.996] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.996] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b0c0) returned 1
	[0112.996] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0112.996] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26d5a74*=0x1, dwFlags=0x0) returned 1
	[0112.996] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x26d5a40, dwFlags=0x0) returned 1
	[0112.996] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d5a84*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x26d5a84*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0112.996] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e6aa0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26e6aa0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0112.996] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0112.996] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.996] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0112.996] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", lpFilePart=0x0) returned 0x35
	[0112.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0112.996] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0112.998] GetFileType (hFile=0x5dc) returned 0x1
	[0112.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0112.998] GetFileType (hFile=0x5dc) returned 0x1
	[0112.998] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d5a84*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26d5a84*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.000] CloseHandle (hObject=0x5dc) returned 1
	[0113.000] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", lpFilePart=0x0) returned 0x35
	[0113.000] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0113.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.000] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7daf7d9e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.001] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.002] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", lpFilePart=0x0) returned 0x32
	[0113.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.002] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26e6ec0 | out: lpFileInformation=0x26e6ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.003] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", lpFilePart=0x0) returned 0x32
	[0113.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.003] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.003] GetFileType (hFile=0x5dc) returned 0x1
	[0113.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.003] GetFileType (hFile=0x5dc) returned 0x1
	[0113.003] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.003] ReadFile (in: hFile=0x5dc, lpBuffer=0x26e7148, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26e7148*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.227] CloseHandle (hObject=0x5dc) returned 1
	[0113.227] CryptDestroyKey (hKey=0x82b200) returned 1
	[0113.227] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.227] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fdd34, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0113.227] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.227] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.227] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0113.228] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.228] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26fddec*=0x1, dwFlags=0x0) returned 1
	[0113.228] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26fddb8, dwFlags=0x0) returned 1
	[0113.228] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fddfc*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x26fddfc*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.228] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270ee18*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x270ee18*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.228] CryptDestroyKey (hKey=0x82b340) returned 1
	[0113.228] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.228] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.228] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", lpFilePart=0x0) returned 0x32
	[0113.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.228] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.230] GetFileType (hFile=0x5dc) returned 0x1
	[0113.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.230] GetFileType (hFile=0x5dc) returned 0x1
	[0113.230] WriteFile (in: hFile=0x5dc, lpBuffer=0x26fddfc*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26fddfc*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.233] CloseHandle (hObject=0x5dc) returned 1
	[0113.233] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", lpFilePart=0x0) returned 0x32
	[0113.233] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0113.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.233] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7dd3829f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.234] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.234] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", lpFilePart=0x0) returned 0x31
	[0113.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.235] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x270f214 | out: lpFileInformation=0x270f214*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.237] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", lpFilePart=0x0) returned 0x31
	[0113.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.237] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.237] GetFileType (hFile=0x5dc) returned 0x1
	[0113.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.237] GetFileType (hFile=0x5dc) returned 0x1
	[0113.237] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.237] ReadFile (in: hFile=0x5dc, lpBuffer=0x270f70c, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x270f70c*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.256] CloseHandle (hObject=0x5dc) returned 1
	[0113.256] CryptDestroyKey (hKey=0x82b300) returned 1
	[0113.256] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.257] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273d8e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0113.257] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.257] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.257] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0113.257] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.257] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x273d9a0*=0x1, dwFlags=0x0) returned 1
	[0113.257] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x273d96c, dwFlags=0x0) returned 1
	[0113.257] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273d9b0*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x273d9b0*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.257] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274e9cc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x274e9cc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.257] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0113.257] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.257] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.258] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", lpFilePart=0x0) returned 0x31
	[0113.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.258] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.259] GetFileType (hFile=0x5dc) returned 0x1
	[0113.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.259] GetFileType (hFile=0x5dc) returned 0x1
	[0113.259] WriteFile (in: hFile=0x5dc, lpBuffer=0x273d9b0*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x273d9b0*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.262] CloseHandle (hObject=0x5dc) returned 1
	[0113.262] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", lpFilePart=0x0) returned 0x31
	[0113.262] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x60
	[0113.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.262] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7dd5a2be, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.263] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.263] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpFilePart=0x0) returned 0x39
	[0113.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.264] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), fInfoLevelId=0x0, lpFileInformation=0x274edbc | out: lpFileInformation=0x274edbc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.264] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpFilePart=0x0) returned 0x39
	[0113.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.264] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.264] GetFileType (hFile=0x5dc) returned 0x1
	[0113.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.264] GetFileType (hFile=0x5dc) returned 0x1
	[0113.264] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.265] ReadFile (in: hFile=0x5dc, lpBuffer=0x274f074, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x274f074*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.299] CloseHandle (hObject=0x5dc) returned 1
	[0113.299] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0113.299] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.299] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276d7d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b440) returned 1
	[0113.299] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.299] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.299] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0113.299] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.300] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x276d888*=0x1, dwFlags=0x0) returned 1
	[0113.300] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x276d854, dwFlags=0x0) returned 1
	[0113.300] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276d898*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x276d898*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.300] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277e8b4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x277e8b4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.300] CryptDestroyKey (hKey=0x82b340) returned 1
	[0113.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.300] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpFilePart=0x0) returned 0x39
	[0113.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.300] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.310] GetFileType (hFile=0x5dc) returned 0x1
	[0113.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.310] GetFileType (hFile=0x5dc) returned 0x1
	[0113.310] WriteFile (in: hFile=0x5dc, lpBuffer=0x276d898*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x276d898*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.312] CloseHandle (hObject=0x5dc) returned 1
	[0113.312] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpFilePart=0x0) returned 0x39
	[0113.313] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0113.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.313] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7ddf91db, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.313] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.314] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpFilePart=0x0) returned 0x4a
	[0113.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.314] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x277ed04 | out: lpFileInformation=0x277ed04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.315] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpFilePart=0x0) returned 0x4a
	[0113.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.315] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.315] GetFileType (hFile=0x5dc) returned 0x1
	[0113.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.315] GetFileType (hFile=0x5dc) returned 0x1
	[0113.315] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.315] ReadFile (in: hFile=0x5dc, lpBuffer=0x277f04c, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x277f04c*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.346] CloseHandle (hObject=0x5dc) returned 1
	[0113.346] CryptDestroyKey (hKey=0x82b440) returned 1
	[0113.346] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.346] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c20ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0113.346] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.346] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.346] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0113.346] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.346] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27c2164*=0x1, dwFlags=0x0) returned 1
	[0113.346] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27c2130, dwFlags=0x0) returned 1
	[0113.347] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c2174*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x27c2174*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.347] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d3190*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27d3190*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.347] CryptDestroyKey (hKey=0x82b540) returned 1
	[0113.347] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.347] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.347] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpFilePart=0x0) returned 0x4a
	[0113.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.347] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.349] GetFileType (hFile=0x5dc) returned 0x1
	[0113.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.349] GetFileType (hFile=0x5dc) returned 0x1
	[0113.349] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c2174*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27c2174*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.351] CloseHandle (hObject=0x5dc) returned 1
	[0113.351] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpFilePart=0x0) returned 0x4a
	[0113.351] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x79
	[0113.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.352] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7de3f15f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.352] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.353] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpFilePart=0x0) returned 0x50
	[0113.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.353] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x27d36ac | out: lpFileInformation=0x27d36ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.353] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpFilePart=0x0) returned 0x50
	[0113.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.354] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.354] GetFileType (hFile=0x5dc) returned 0x1
	[0113.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.354] GetFileType (hFile=0x5dc) returned 0x1
	[0113.354] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.354] ReadFile (in: hFile=0x5dc, lpBuffer=0x27d3a24, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27d3a24*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.365] CloseHandle (hObject=0x5dc) returned 1
	[0113.365] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0113.365] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.365] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f0f40, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0113.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.365] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0113.365] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.365] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27f0ff8*=0x1, dwFlags=0x0) returned 1
	[0113.365] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27f0fc4, dwFlags=0x0) returned 1
	[0113.365] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f1008*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x27f1008*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.366] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2802024*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2802024*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.366] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0113.366] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.366] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.366] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpFilePart=0x0) returned 0x50
	[0113.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.367] GetFileType (hFile=0x5dc) returned 0x1
	[0113.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.368] GetFileType (hFile=0x5dc) returned 0x1
	[0113.368] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f1008*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27f1008*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.370] CloseHandle (hObject=0x5dc) returned 1
	[0113.370] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpFilePart=0x0) returned 0x50
	[0113.370] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7f
	[0113.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.370] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7de653fd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.370] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.372] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpFilePart=0x0) returned 0x4e
	[0113.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.372] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2802588 | out: lpFileInformation=0x2802588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.386] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpFilePart=0x0) returned 0x4e
	[0113.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.386] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.386] GetFileType (hFile=0x5dc) returned 0x1
	[0113.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.386] GetFileType (hFile=0x5dc) returned 0x1
	[0113.386] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.386] ReadFile (in: hFile=0x5dc, lpBuffer=0x26277e8, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26277e8*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.399] CloseHandle (hObject=0x5dc) returned 1
	[0113.399] CryptDestroyKey (hKey=0x82b280) returned 1
	[0113.399] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.399] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264dc48, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0113.399] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.399] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.399] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b4c0) returned 1
	[0113.399] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.399] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x264dd00*=0x1, dwFlags=0x0) returned 1
	[0113.399] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x264dccc, dwFlags=0x0) returned 1
	[0113.399] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264dd10*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x264dd10*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.399] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265ed2c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x265ed2c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.400] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0113.400] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.400] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.400] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpFilePart=0x0) returned 0x4e
	[0113.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.400] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.401] GetFileType (hFile=0x5dc) returned 0x1
	[0113.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.401] GetFileType (hFile=0x5dc) returned 0x1
	[0113.401] WriteFile (in: hFile=0x5dc, lpBuffer=0x264dd10*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x264dd10*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.404] CloseHandle (hObject=0x5dc) returned 1
	[0113.404] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpFilePart=0x0) returned 0x4e
	[0113.404] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7d
	[0113.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.404] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7ded7b50, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.404] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.405] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpFilePart=0x0) returned 0x54
	[0113.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.405] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x265f278 | out: lpFileInformation=0x265f278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.406] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpFilePart=0x0) returned 0x54
	[0113.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.406] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.406] GetFileType (hFile=0x5dc) returned 0x1
	[0113.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.406] GetFileType (hFile=0x5dc) returned 0x1
	[0113.407] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.407] ReadFile (in: hFile=0x5dc, lpBuffer=0x265f610, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x265f610*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.421] CloseHandle (hObject=0x5dc) returned 1
	[0113.421] CryptDestroyKey (hKey=0x82b280) returned 1
	[0113.421] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.421] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2685a70, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0113.421] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.421] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.422] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b000) returned 1
	[0113.422] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.422] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2685b28*=0x1, dwFlags=0x0) returned 1
	[0113.422] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2685af4, dwFlags=0x0) returned 1
	[0113.422] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2685b38*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2685b38*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.422] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2696b54*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2696b54*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.422] CryptDestroyKey (hKey=0x82b000) returned 1
	[0113.422] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.422] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.422] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpFilePart=0x0) returned 0x54
	[0113.424] WriteFile (in: hFile=0x5dc, lpBuffer=0x2685b38*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2685b38*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.426] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.427] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", lpFilePart=0x0) returned 0x32
	[0113.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.427] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.427] GetFileType (hFile=0x5dc) returned 0x1
	[0113.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.427] GetFileType (hFile=0x5dc) returned 0x1
	[0113.427] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.427] ReadFile (in: hFile=0x5dc, lpBuffer=0x2697370, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2697370*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.448] CloseHandle (hObject=0x5dc) returned 1
	[0113.448] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0113.448] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.448] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a840c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0113.448] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.448] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.448] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b0c0) returned 1
	[0113.448] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.448] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26a84c4*=0x1, dwFlags=0x0) returned 1
	[0113.448] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x26a8490, dwFlags=0x0) returned 1
	[0113.448] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a84d4*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x26a84d4*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.449] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b94f0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26b94f0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.449] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0113.449] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.449] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.449] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", lpFilePart=0x0) returned 0x32
	[0113.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.449] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.532] GetFileType (hFile=0x5dc) returned 0x1
	[0113.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.532] GetFileType (hFile=0x5dc) returned 0x1
	[0113.532] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a84d4*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26a84d4*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.534] CloseHandle (hObject=0x5dc) returned 1
	[0113.534] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", lpFilePart=0x0) returned 0x32
	[0113.534] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0113.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.549] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e010491, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.550] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.550] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", lpFilePart=0x0) returned 0x40
	[0113.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.551] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2709610 | out: lpFileInformation=0x2709610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.551] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", lpFilePart=0x0) returned 0x40
	[0113.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.551] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.551] GetFileType (hFile=0x5dc) returned 0x1
	[0113.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.551] GetFileType (hFile=0x5dc) returned 0x1
	[0113.551] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.552] ReadFile (in: hFile=0x5dc, lpBuffer=0x2709908, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2709908*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.565] CloseHandle (hObject=0x5dc) returned 1
	[0113.565] CryptDestroyKey (hKey=0x82b340) returned 1
	[0113.565] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.565] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271a9a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b480) returned 1
	[0113.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.566] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0113.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.566] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x271aa5c*=0x1, dwFlags=0x0) returned 1
	[0113.566] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x271aa28, dwFlags=0x0) returned 1
	[0113.566] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271aa6c*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x271aa6c*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.566] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272ba88*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x272ba88*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.566] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0113.566] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.566] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.566] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", lpFilePart=0x0) returned 0x40
	[0113.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.566] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.568] GetFileType (hFile=0x5dc) returned 0x1
	[0113.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.568] GetFileType (hFile=0x5dc) returned 0x1
	[0113.568] WriteFile (in: hFile=0x5dc, lpBuffer=0x271aa6c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x271aa6c*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.570] CloseHandle (hObject=0x5dc) returned 1
	[0113.570] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", lpFilePart=0x0) returned 0x40
	[0113.570] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0113.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.570] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e05c7da, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.571] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.571] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpFilePart=0x0) returned 0x34
	[0113.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.572] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), fInfoLevelId=0x0, lpFileInformation=0x272bf2c | out: lpFileInformation=0x272bf2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.572] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpFilePart=0x0) returned 0x34
	[0113.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.572] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.572] GetFileType (hFile=0x5dc) returned 0x1
	[0113.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.572] GetFileType (hFile=0x5dc) returned 0x1
	[0113.572] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.573] ReadFile (in: hFile=0x5dc, lpBuffer=0x272c1c4, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x272c1c4*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.583] CloseHandle (hObject=0x5dc) returned 1
	[0113.583] CryptDestroyKey (hKey=0x82b480) returned 1
	[0113.583] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.583] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27443e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0113.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.583] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b440) returned 1
	[0113.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.583] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x274449c*=0x1, dwFlags=0x0) returned 1
	[0113.583] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2744468, dwFlags=0x0) returned 1
	[0113.583] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27444ac*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x27444ac*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.584] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27554c8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27554c8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.584] CryptDestroyKey (hKey=0x82b440) returned 1
	[0113.584] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.584] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.584] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpFilePart=0x0) returned 0x34
	[0113.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.584] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.585] GetFileType (hFile=0x5dc) returned 0x1
	[0113.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.586] GetFileType (hFile=0x5dc) returned 0x1
	[0113.586] WriteFile (in: hFile=0x5dc, lpBuffer=0x27444ac*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27444ac*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.588] CloseHandle (hObject=0x5dc) returned 1
	[0113.588] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpFilePart=0x0) returned 0x34
	[0113.588] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x63
	[0113.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.588] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e082a52, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.588] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.589] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpFilePart=0x0) returned 0x35
	[0113.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.589] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), fInfoLevelId=0x0, lpFileInformation=0x27558dc | out: lpFileInformation=0x27558dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.589] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpFilePart=0x0) returned 0x35
	[0113.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.590] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.590] GetFileType (hFile=0x5dc) returned 0x1
	[0113.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.590] GetFileType (hFile=0x5dc) returned 0x1
	[0113.590] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.590] ReadFile (in: hFile=0x5dc, lpBuffer=0x2755b74, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2755b74*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.604] CloseHandle (hObject=0x5dc) returned 1
	[0113.605] CryptDestroyKey (hKey=0x82b400) returned 1
	[0113.605] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.605] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2766c10, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0113.605] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.605] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.605] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0113.605] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.605] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2766cc8*=0x1, dwFlags=0x0) returned 1
	[0113.605] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2766c94, dwFlags=0x0) returned 1
	[0113.605] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2766cd8*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2766cd8*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.605] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2777cf4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2777cf4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.606] CryptDestroyKey (hKey=0x82b280) returned 1
	[0113.606] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.606] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.606] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpFilePart=0x0) returned 0x35
	[0113.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.606] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.607] GetFileType (hFile=0x5dc) returned 0x1
	[0113.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.608] GetFileType (hFile=0x5dc) returned 0x1
	[0113.608] WriteFile (in: hFile=0x5dc, lpBuffer=0x2766cd8*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2766cd8*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.621] CloseHandle (hObject=0x5dc) returned 1
	[0113.622] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpFilePart=0x0) returned 0x35
	[0113.622] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0113.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.622] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e0cef8f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.622] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.623] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpFilePart=0x0) returned 0x41
	[0113.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.623] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x278cc00 | out: lpFileInformation=0x278cc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.624] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpFilePart=0x0) returned 0x41
	[0113.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.624] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.624] GetFileType (hFile=0x5dc) returned 0x1
	[0113.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.625] GetFileType (hFile=0x5dc) returned 0x1
	[0113.625] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.625] ReadFile (in: hFile=0x5dc, lpBuffer=0x278cef8, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x278cef8*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.627] CloseHandle (hObject=0x5dc) returned 1
	[0113.627] CryptDestroyKey (hKey=0x82b340) returned 1
	[0113.627] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.627] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279df94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b200) returned 1
	[0113.627] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.627] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.627] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b100) returned 1
	[0113.627] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.627] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x279e04c*=0x1, dwFlags=0x0) returned 1
	[0113.627] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x279e018, dwFlags=0x0) returned 1
	[0113.628] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279e05c*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x279e05c*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.628] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27af078*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27af078*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.628] CryptDestroyKey (hKey=0x82b100) returned 1
	[0113.628] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.628] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.628] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpFilePart=0x0) returned 0x41
	[0113.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.628] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.630] GetFileType (hFile=0x5dc) returned 0x1
	[0113.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.630] GetFileType (hFile=0x5dc) returned 0x1
	[0113.630] WriteFile (in: hFile=0x5dc, lpBuffer=0x279e05c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x279e05c*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.632] CloseHandle (hObject=0x5dc) returned 1
	[0113.632] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpFilePart=0x0) returned 0x41
	[0113.632] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x70
	[0113.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.633] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e0f5266, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.633] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.634] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", lpFilePart=0x0) returned 0x32
	[0113.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.634] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x27af528 | out: lpFileInformation=0x27af528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.634] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", lpFilePart=0x0) returned 0x32
	[0113.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.634] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.634] GetFileType (hFile=0x5dc) returned 0x1
	[0113.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.634] GetFileType (hFile=0x5dc) returned 0x1
	[0113.634] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.635] ReadFile (in: hFile=0x5dc, lpBuffer=0x27af7b0, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27af7b0*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.647] CloseHandle (hObject=0x5dc) returned 1
	[0113.647] CryptDestroyKey (hKey=0x82b200) returned 1
	[0113.647] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.647] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d43c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0113.647] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.647] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.648] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b480) returned 1
	[0113.648] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.648] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27d447c*=0x1, dwFlags=0x0) returned 1
	[0113.648] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27d4448, dwFlags=0x0) returned 1
	[0113.648] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d448c*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x27d448c*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.648] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e54a8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27e54a8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.648] CryptDestroyKey (hKey=0x82b480) returned 1
	[0113.648] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.648] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.648] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", lpFilePart=0x0) returned 0x32
	[0113.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.648] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.650] GetFileType (hFile=0x5dc) returned 0x1
	[0113.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.650] GetFileType (hFile=0x5dc) returned 0x1
	[0113.650] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d448c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27d448c*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.652] CloseHandle (hObject=0x5dc) returned 1
	[0113.652] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", lpFilePart=0x0) returned 0x32
	[0113.652] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0113.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.652] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e11b3c1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.652] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.653] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", lpFilePart=0x0) returned 0x3c
	[0113.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.653] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x27e58a4 | out: lpFileInformation=0x27e58a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.653] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", lpFilePart=0x0) returned 0x3c
	[0113.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.653] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.653] GetFileType (hFile=0x5dc) returned 0x1
	[0113.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.654] GetFileType (hFile=0x5dc) returned 0x1
	[0113.654] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.654] ReadFile (in: hFile=0x5dc, lpBuffer=0x27e5b7c, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27e5b7c*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.665] CloseHandle (hObject=0x5dc) returned 1
	[0113.665] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0113.665] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.665] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2802e80, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b4c0) returned 1
	[0113.665] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.665] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.665] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0113.665] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.665] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2802f38*=0x1, dwFlags=0x0) returned 1
	[0113.666] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2802f04, dwFlags=0x0) returned 1
	[0113.666] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2802f48*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2802f48*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.666] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2813f64*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2813f64*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.666] CryptDestroyKey (hKey=0x82b540) returned 1
	[0113.666] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.666] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.666] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", lpFilePart=0x0) returned 0x3c
	[0113.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.666] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.667] GetFileType (hFile=0x5dc) returned 0x1
	[0113.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.668] GetFileType (hFile=0x5dc) returned 0x1
	[0113.668] WriteFile (in: hFile=0x5dc, lpBuffer=0x2802f48*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2802f48*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.670] CloseHandle (hObject=0x5dc) returned 1
	[0113.673] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", lpFilePart=0x0) returned 0x3c
	[0113.673] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6b
	[0113.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.673] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e1415dc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.673] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.674] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", lpFilePart=0x0) returned 0x34
	[0113.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.674] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), fInfoLevelId=0x0, lpFileInformation=0x28143d8 | out: lpFileInformation=0x28143d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.674] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", lpFilePart=0x0) returned 0x34
	[0113.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.674] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.674] GetFileType (hFile=0x5dc) returned 0x1
	[0113.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.675] GetFileType (hFile=0x5dc) returned 0x1
	[0113.675] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.675] ReadFile (in: hFile=0x5dc, lpBuffer=0x2814670, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2814670*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.689] CloseHandle (hObject=0x5dc) returned 1
	[0113.689] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0113.689] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.689] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264cc14, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b480) returned 1
	[0113.689] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.689] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.689] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0113.689] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.689] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x264cccc*=0x1, dwFlags=0x0) returned 1
	[0113.689] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x264cc98, dwFlags=0x0) returned 1
	[0113.690] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264ccdc*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x264ccdc*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.690] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265dcf8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x265dcf8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.690] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0113.690] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.690] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.690] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", lpFilePart=0x0) returned 0x34
	[0113.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.690] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.691] GetFileType (hFile=0x5dc) returned 0x1
	[0113.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.691] GetFileType (hFile=0x5dc) returned 0x1
	[0113.691] WriteFile (in: hFile=0x5dc, lpBuffer=0x264ccdc*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x264ccdc*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.693] CloseHandle (hObject=0x5dc) returned 1
	[0113.694] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", lpFilePart=0x0) returned 0x34
	[0113.694] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x63
	[0113.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.694] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e18db9a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.694] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.695] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpFilePart=0x0) returned 0x5a
	[0113.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.695] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), fInfoLevelId=0x0, lpFileInformation=0x265e10c | out: lpFileInformation=0x265e10c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.695] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpFilePart=0x0) returned 0x5a
	[0113.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.696] ReadFile (in: hFile=0x5dc, lpBuffer=0x265e4d4, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x265e4d4*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.730] CryptDestroyKey (hKey=0x82b480) returned 1
	[0113.730] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.730] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a7d08, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b4c0) returned 1
	[0113.730] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.730] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.730] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0113.730] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.730] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26a7dc0*=0x1, dwFlags=0x0) returned 1
	[0113.730] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26a7d8c, dwFlags=0x0) returned 1
	[0113.730] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a7dd0*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x26a7dd0*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.730] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b8dec*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26b8dec*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.730] CryptDestroyKey (hKey=0x82b540) returned 1
	[0113.730] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.730] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.731] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpFilePart=0x0) returned 0x5a
	[0113.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.731] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.732] GetFileType (hFile=0x5dc) returned 0x1
	[0113.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.732] GetFileType (hFile=0x5dc) returned 0x1
	[0113.732] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a7dd0*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26a7dd0*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.735] CloseHandle (hObject=0x5dc) returned 1
	[0113.735] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpFilePart=0x0) returned 0x5a
	[0113.735] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x89
	[0113.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.735] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e20023f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.735] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.736] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpFilePart=0x0) returned 0x50
	[0113.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.736] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), fInfoLevelId=0x0, lpFileInformation=0x26b93c8 | out: lpFileInformation=0x26b93c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000)) returned 1
	[0113.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.737] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpFilePart=0x0) returned 0x50
	[0113.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.737] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0113.737] GetFileType (hFile=0x5dc) returned 0x1
	[0113.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.737] GetFileType (hFile=0x5dc) returned 0x1
	[0113.737] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x101000
	[0113.740] ReadFile (in: hFile=0x5dc, lpBuffer=0xdfc7118, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0xdfc7118*, lpNumberOfBytesRead=0x593f2cc*=0x101000, lpOverlapped=0x0) returned 1
	[0113.827] CloseHandle (hObject=0x5dc) returned 1
	[0113.827] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0113.827] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.828] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c3090, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b0c0) returned 1
	[0113.828] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.828] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.828] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b4c0) returned 1
	[0113.828] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.828] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26c3148*=0x1, dwFlags=0x0) returned 1
	[0113.828] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26c3114, dwFlags=0x0) returned 1
	[0113.843] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe0c8138*, pdwDataLen=0x593f2d4*=0x101010, dwBufLen=0x101010 | out: pbData=0xe0c8138*, pdwDataLen=0x593f2d4*=0x101010) returned 1
	[0113.844] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c5170*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26c5170*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.845] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0113.845] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.845] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.845] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpFilePart=0x0) returned 0x50
	[0113.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.845] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0113.846] GetFileType (hFile=0x2ec) returned 0x1
	[0113.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.846] GetFileType (hFile=0x2ec) returned 0x1
	[0113.846] WriteFile (in: hFile=0x2ec, lpBuffer=0xe0c8138*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0xe0c8138*, lpNumberOfBytesWritten=0x593f2c0*=0x101010, lpOverlapped=0x0) returned 1
	[0113.889] CloseHandle (hObject=0x2ec) returned 1
	[0113.890] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpFilePart=0x0) returned 0x50
	[0113.890] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x7f
	[0113.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.890] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e3578ec, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x101010)) returned 1
	[0113.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.898] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.899] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpFilePart=0x0) returned 0x41
	[0113.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.899] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2702424 | out: lpFileInformation=0x2702424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.900] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpFilePart=0x0) returned 0x41
	[0113.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.900] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0113.900] GetFileType (hFile=0x2ec) returned 0x1
	[0113.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.900] GetFileType (hFile=0x2ec) returned 0x1
	[0113.900] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.901] ReadFile (in: hFile=0x2ec, lpBuffer=0x270422c, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x270422c*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.924] CloseHandle (hObject=0x2ec) returned 1
	[0113.924] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0113.924] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.924] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2732abc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0113.924] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.924] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.924] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0113.924] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.924] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2732b74*=0x1, dwFlags=0x0) returned 1
	[0113.924] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2732b40, dwFlags=0x0) returned 1
	[0113.925] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2732b84*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2732b84*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.925] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2743ba0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2743ba0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.925] CryptDestroyKey (hKey=0x82b380) returned 1
	[0113.925] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.925] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.925] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpFilePart=0x0) returned 0x41
	[0113.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.925] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0113.927] GetFileType (hFile=0x2ec) returned 0x1
	[0113.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.927] GetFileType (hFile=0x2ec) returned 0x1
	[0113.927] WriteFile (in: hFile=0x2ec, lpBuffer=0x2732b84*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2732b84*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.929] CloseHandle (hObject=0x2ec) returned 1
	[0113.929] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpFilePart=0x0) returned 0x41
	[0113.929] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x70
	[0113.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.929] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e3c9e52, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.930] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.931] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", lpFilePart=0x0) returned 0x34
	[0113.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.931] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2744050 | out: lpFileInformation=0x2744050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0113.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.932] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", lpFilePart=0x0) returned 0x34
	[0113.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.932] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0113.932] GetFileType (hFile=0x2ec) returned 0x1
	[0113.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.932] GetFileType (hFile=0x2ec) returned 0x1
	[0113.932] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0113.932] ReadFile (in: hFile=0x2ec, lpBuffer=0x27442e8, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27442e8*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0113.961] CloseHandle (hObject=0x2ec) returned 1
	[0113.961] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0113.961] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.961] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2781da4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0113.961] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.961] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.962] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0113.962] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0113.962] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2781e5c*=0x1, dwFlags=0x0) returned 1
	[0113.962] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2781e28, dwFlags=0x0) returned 1
	[0113.962] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2781e6c*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x2781e6c*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0113.962] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2792e88*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2792e88*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0113.962] CryptDestroyKey (hKey=0x82b540) returned 1
	[0113.962] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.962] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0113.962] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", lpFilePart=0x0) returned 0x34
	[0113.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0113.962] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0113.964] GetFileType (hFile=0x2ec) returned 0x1
	[0113.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0113.964] GetFileType (hFile=0x2ec) returned 0x1
	[0113.964] WriteFile (in: hFile=0x2ec, lpBuffer=0x2781e6c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2781e6c*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0113.966] CloseHandle (hObject=0x2ec) returned 1
	[0113.967] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", lpFilePart=0x0) returned 0x34
	[0113.967] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x63
	[0113.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0113.967] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e4162bf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0113.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0113.967] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0113.968] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", lpFilePart=0x0) returned 0x38
	[0113.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0113.968] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x279329c | out: lpFileInformation=0x279329c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000)) returned 1
	[0113.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0113.969] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", lpFilePart=0x0) returned 0x38
	[0113.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0113.969] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0113.969] GetFileType (hFile=0x2ec) returned 0x1
	[0113.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0113.969] GetFileType (hFile=0x2ec) returned 0x1
	[0113.969] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x101000
	[0113.972] ReadFile (in: hFile=0x2ec, lpBuffer=0xe1c9168, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0xe1c9168*, lpNumberOfBytesRead=0x593f2cc*=0x101000, lpOverlapped=0x0) returned 1
	[0114.031] CloseHandle (hObject=0x2ec) returned 1
	[0114.031] CryptDestroyKey (hKey=0x82b280) returned 1
	[0114.031] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.031] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c8658, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0114.032] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.032] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.032] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b100) returned 1
	[0114.032] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.032] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27c8710*=0x1, dwFlags=0x0) returned 1
	[0114.032] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27c86dc, dwFlags=0x0) returned 1
	[0114.043] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe2ca188*, pdwDataLen=0x593f2d4*=0x101010, dwBufLen=0x101010 | out: pbData=0xe2ca188*, pdwDataLen=0x593f2d4*=0x101010) returned 1
	[0114.044] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8720*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27c8720*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0114.044] CryptDestroyKey (hKey=0x82b100) returned 1
	[0114.044] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.044] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.044] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", lpFilePart=0x0) returned 0x38
	[0114.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0114.044] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.045] GetFileType (hFile=0x2ec) returned 0x1
	[0114.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0114.045] GetFileType (hFile=0x2ec) returned 0x1
	[0114.045] WriteFile (in: hFile=0x2ec, lpBuffer=0xe2ca188*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0xe2ca188*, lpNumberOfBytesWritten=0x593f2c0*=0x101010, lpOverlapped=0x0) returned 1
	[0114.121] CloseHandle (hObject=0x2ec) returned 1
	[0114.121] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", lpFilePart=0x0) returned 0x38
	[0114.121] GetFullPathNameW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0114.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0114.121] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e593b31, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x101010)) returned 1
	[0114.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0114.122] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.123] GetFullPathNameW (in: lpFileName="C:\\Logs\\Security.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Security.evtx", lpFilePart=0x0) returned 0x15
	[0114.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0114.123] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), fInfoLevelId=0x0, lpFileInformation=0x27c8b64 | out: lpFileInformation=0x27c8b64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000)) returned 1
	[0114.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0114.123] GetFullPathNameW (in: lpFileName="C:\\Logs\\Security.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Security.evtx", lpFilePart=0x0) returned 0x15
	[0114.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0114.123] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.124] GetFileType (hFile=0x2ec) returned 0x1
	[0114.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0114.124] GetFileType (hFile=0x2ec) returned 0x1
	[0114.124] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x111000
	[0114.128] ReadFile (in: hFile=0x2ec, lpBuffer=0xe3cb1b8, nNumberOfBytesToRead=0x111000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0xe3cb1b8*, lpNumberOfBytesRead=0x593f2cc*=0x111000, lpOverlapped=0x0) returned 1
	[0114.182] CloseHandle (hObject=0x2ec) returned 1
	[0114.182] CryptDestroyKey (hKey=0x82b540) returned 1
	[0114.182] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.182] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f6010, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0114.182] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.183] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.183] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0114.183] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.183] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27f60c8*=0x1, dwFlags=0x0) returned 1
	[0114.183] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27f6094, dwFlags=0x0) returned 1
	[0114.216] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe4dc1d8*, pdwDataLen=0x593f2d4*=0x111010, dwBufLen=0x111010 | out: pbData=0xe4dc1d8*, pdwDataLen=0x593f2d4*=0x111010) returned 1
	[0114.217] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2828980*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2828980*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0114.217] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0114.218] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.218] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.218] GetFullPathNameW (in: lpFileName="C:\\Logs\\Security.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Security.evtx", lpFilePart=0x0) returned 0x15
	[0114.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0114.218] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.221] GetFileType (hFile=0x2ec) returned 0x1
	[0114.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0114.221] GetFileType (hFile=0x2ec) returned 0x1
	[0114.221] WriteFile (in: hFile=0x2ec, lpBuffer=0xe4dc1d8*, nNumberOfBytesToWrite=0x111010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0xe4dc1d8*, lpNumberOfBytesWritten=0x593f2c0*=0x111010, lpOverlapped=0x0) returned 1
	[0114.241] CloseHandle (hObject=0x2ec) returned 1
	[0114.241] GetFullPathNameW (in: lpFileName="C:\\Logs\\Security.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Security.evtx", lpFilePart=0x0) returned 0x15
	[0114.241] GetFullPathNameW (in: lpFileName="C:\\Logs\\Security.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Security.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x44
	[0114.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0114.241] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e6c4dc6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x111010)) returned 1
	[0114.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0114.242] MoveFileW (lpExistingFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), lpNewFileName="C:\\Logs\\Security.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\security.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.242] GetFullPathNameW (in: lpFileName="C:\\Logs\\Setup.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Setup.evtx", lpFilePart=0x0) returned 0x12
	[0114.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0114.242] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2828c20 | out: lpFileInformation=0x2828c20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0114.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0114.243] GetFullPathNameW (in: lpFileName="C:\\Logs\\Setup.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Setup.evtx", lpFilePart=0x0) returned 0x12
	[0114.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0114.243] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.243] GetFileType (hFile=0x2ec) returned 0x1
	[0114.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0114.243] GetFileType (hFile=0x2ec) returned 0x1
	[0114.243] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11000
	[0114.244] ReadFile (in: hFile=0x2ec, lpBuffer=0x2828da8, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2828da8*, lpNumberOfBytesRead=0x593f2cc*=0x11000, lpOverlapped=0x0) returned 1
	[0114.281] CloseHandle (hObject=0x2ec) returned 1
	[0114.281] CryptDestroyKey (hKey=0x82b540) returned 1
	[0114.281] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.281] CryptImportKey (in: hProv=0x7f93c0, pbData=0x287f918, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0114.281] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.282] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.282] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0114.282] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.282] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x287f9d0*=0x1, dwFlags=0x0) returned 1
	[0114.282] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x287f99c, dwFlags=0x0) returned 1
	[0114.282] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x287f9e0*, pdwDataLen=0x593f2d4*=0x11010, dwBufLen=0x11010 | out: pbData=0x287f9e0*, pdwDataLen=0x593f2d4*=0x11010) returned 1
	[0114.282] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28909fc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28909fc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0114.282] CryptDestroyKey (hKey=0x82b380) returned 1
	[0114.282] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.282] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.282] GetFullPathNameW (in: lpFileName="C:\\Logs\\Setup.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Setup.evtx", lpFilePart=0x0) returned 0x12
	[0114.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0114.282] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.284] GetFileType (hFile=0x2ec) returned 0x1
	[0114.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0114.284] GetFileType (hFile=0x2ec) returned 0x1
	[0114.284] WriteFile (in: hFile=0x2ec, lpBuffer=0x287f9e0*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x287f9e0*, lpNumberOfBytesWritten=0x593f2c0*=0x11010, lpOverlapped=0x0) returned 1
	[0114.286] CloseHandle (hObject=0x2ec) returned 1
	[0114.286] GetFullPathNameW (in: lpFileName="C:\\Logs\\Setup.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Setup.evtx", lpFilePart=0x0) returned 0x12
	[0114.286] GetFullPathNameW (in: lpFileName="C:\\Logs\\Setup.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Setup.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x41
	[0114.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0114.286] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e7373d3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1
	[0114.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0114.286] MoveFileW (lpExistingFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), lpNewFileName="C:\\Logs\\Setup.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\setup.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.287] GetFullPathNameW (in: lpFileName="C:\\Logs\\System.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\System.evtx", lpFilePart=0x0) returned 0x13
	[0114.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0114.287] GetFileAttributesExW (in: lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2890c78 | out: lpFileInformation=0x2890c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000)) returned 1
	[0114.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0114.288] GetFullPathNameW (in: lpFileName="C:\\Logs\\System.evtx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\System.evtx", lpFilePart=0x0) returned 0x13
	[0114.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0114.288] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.288] GetFileType (hFile=0x2ec) returned 0x1
	[0114.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0114.289] GetFileType (hFile=0x2ec) returned 0x1
	[0114.289] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x111000
	[0114.292] ReadFile (in: hFile=0x2ec, lpBuffer=0xe5ed208, nNumberOfBytesToRead=0x111000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0xe5ed208*, lpNumberOfBytesRead=0x593f2cc*=0x111000, lpOverlapped=0x0) returned 1
	[0114.368] CloseHandle (hObject=0x2ec) returned 1
	[0114.368] CryptDestroyKey (hKey=0x82b340) returned 1
	[0114.368] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.368] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28e172c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0114.368] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.368] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.368] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0114.368] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0114.369] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x28e17e4*=0x1, dwFlags=0x0) returned 1
	[0114.369] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x28e17b0, dwFlags=0x0) returned 1
	[0114.380] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe6fe228*, pdwDataLen=0x593f2d4*=0x111010, dwBufLen=0x111010 | out: pbData=0xe6fe228*, pdwDataLen=0x593f2d4*=0x111010) returned 1
	[0114.381] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28e17f4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28e17f4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0114.381] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0114.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0114.382] GetFullPathNameW (in: lpFileName="C:\\Logs\\System.evtx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\System.evtx", lpFilePart=0x0) returned 0x13
	[0114.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0114.382] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2ec
	[0114.383] GetFileType (hFile=0x2ec) returned 0x1
	[0114.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0114.384] GetFileType (hFile=0x2ec) returned 0x1
	[0114.384] WriteFile (in: hFile=0x2ec, lpBuffer=0xe6fe228*, nNumberOfBytesToWrite=0x111010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0xe6fe228*, lpNumberOfBytesWritten=0x593f2c0*=0x111010, lpOverlapped=0x0) returned 1
	[0114.405] CloseHandle (hObject=0x2ec) returned 1
	[0114.577] GetFullPathNameW (in: lpFileName="C:\\Logs\\System.evtx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\System.evtx", lpFilePart=0x0) returned 0x13
	[0114.577] GetFullPathNameW (in: lpFileName="C:\\Logs\\System.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\System.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x42
	[0114.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0114.577] GetFileAttributesExW (in: lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e84247c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x111010)) returned 1
	[0114.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0114.577] MoveFileW (lpExistingFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), lpNewFileName="C:\\Logs\\System.evtx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\logs\\system.evtx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0114.580] GetFullPathNameW (in: lpFileName="C:\\Logs\\Windows PowerShell.evtx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Logs\\Windows PowerShell.evtx", lpFilePart=0x0) returned 0x1f
	[0114.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0114.581] GetFileAttributesExW (in: lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), fInfoLevelId=0x0, lpFileInformation=0x2924dcc | out: lpFileInformation=0x2924dcc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1
	[0114.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0114.583] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.614] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.614] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.615] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.625] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.658] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.658] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.659] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.680] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.680] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.734] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.828] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0114.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.010] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.029] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.160] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0115.297] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.297] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.298] GetFileType (hFile=0x5dc) returned 0x1
	[0115.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.298] GetFileType (hFile=0x5dc) returned 0x1
	[0115.298] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4758
	[0115.298] ReadFile (in: hFile=0x5dc, lpBuffer=0x27f8750, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27f8750*, lpNumberOfBytesRead=0x593f2cc*=0x4758, lpOverlapped=0x0) returned 1
	[0115.319] CloseHandle (hObject=0x5dc) returned 1
	[0115.319] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0115.319] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.319] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28208b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0115.319] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.319] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.319] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b480) returned 1
	[0115.319] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.319] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2820968*=0x1, dwFlags=0x0) returned 1
	[0115.319] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2820934, dwFlags=0x0) returned 1
	[0115.319] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2820978*, pdwDataLen=0x593f2d4*=0x4760, dwBufLen=0x4760 | out: pbData=0x2820978*, pdwDataLen=0x593f2d4*=0x4760) returned 1
	[0115.320] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28250e4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28250e4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.320] CryptDestroyKey (hKey=0x82b480) returned 1
	[0115.320] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.320] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.320] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.320] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.321] GetFileType (hFile=0x5dc) returned 0x1
	[0115.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.322] GetFileType (hFile=0x5dc) returned 0x1
	[0115.322] WriteFile (in: hFile=0x5dc, lpBuffer=0x2820978*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2820978*, lpNumberOfBytesWritten=0x593f2c0*=0x4760, lpOverlapped=0x0) returned 1
	[0115.323] CloseHandle (hObject=0x5dc) returned 1
	[0115.323] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.323] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0115.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.324] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7f10d1b3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4760)) returned 1
	[0115.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.324] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.325] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.325] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2825480 | out: lpFileInformation=0x2825480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2)) returned 1
	[0115.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.325] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.325] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.325] GetFileType (hFile=0x5dc) returned 0x1
	[0115.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.325] GetFileType (hFile=0x5dc) returned 0x1
	[0115.325] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xcf2
	[0115.326] ReadFile (in: hFile=0x5dc, lpBuffer=0x2826340, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2826340*, lpNumberOfBytesRead=0x593f2cc*=0xcf2, lpOverlapped=0x0) returned 1
	[0115.327] CloseHandle (hObject=0x5dc) returned 1
	[0115.327] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0115.327] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.328] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28273dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0115.328] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.328] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.328] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0115.328] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.328] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2827494*=0x1, dwFlags=0x0) returned 1
	[0115.328] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2827460, dwFlags=0x0) returned 1
	[0115.328] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28274a4*, pdwDataLen=0x593f2d4*=0xd00, dwBufLen=0xd00 | out: pbData=0x28274a4*, pdwDataLen=0x593f2d4*=0xd00) returned 1
	[0115.328] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28281b0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28281b0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.328] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0115.328] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.328] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.328] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.329] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.330] GetFileType (hFile=0x5dc) returned 0x1
	[0115.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.330] GetFileType (hFile=0x5dc) returned 0x1
	[0115.330] WriteFile (in: hFile=0x5dc, lpBuffer=0x282829c*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x282829c*, lpNumberOfBytesWritten=0x593f294*=0xd00, lpOverlapped=0x0) returned 1
	[0115.331] CloseHandle (hObject=0x5dc) returned 1
	[0115.331] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.331] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0115.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.331] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7f133236, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xd00)) returned 1
	[0115.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.332] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.334] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.334] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x28294e0 | out: lpFileInformation=0x28294e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4)) returned 1
	[0115.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.334] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.335] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.335] GetFileType (hFile=0x5dc) returned 0x1
	[0115.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.335] GetFileType (hFile=0x5dc) returned 0x1
	[0115.335] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x12fb4
	[0115.335] ReadFile (in: hFile=0x5dc, lpBuffer=0x28296e8, nNumberOfBytesToRead=0x12fb4, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x28296e8*, lpNumberOfBytesRead=0x593f2cc*=0x12fb4, lpOverlapped=0x0) returned 1
	[0115.354] CloseHandle (hObject=0x5dc) returned 1
	[0115.355] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0115.355] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.355] CryptImportKey (in: hProv=0x7f93c0, pbData=0x285819c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0115.355] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.355] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.355] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b0c0) returned 1
	[0115.355] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.355] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x2858254*=0x1, dwFlags=0x0) returned 1
	[0115.355] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x2858220, dwFlags=0x0) returned 1
	[0115.355] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2858264*, pdwDataLen=0x593f2d4*=0x12fc0, dwBufLen=0x12fc0 | out: pbData=0x2858264*, pdwDataLen=0x593f2d4*=0x12fc0) returned 1
	[0115.355] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x286b230*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x286b230*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.355] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0115.355] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.355] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.355] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.356] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.357] GetFileType (hFile=0x5dc) returned 0x1
	[0115.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.358] GetFileType (hFile=0x5dc) returned 0x1
	[0115.358] WriteFile (in: hFile=0x5dc, lpBuffer=0x2858264*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2858264*, lpNumberOfBytesWritten=0x593f2c0*=0x12fc0, lpOverlapped=0x0) returned 1
	[0115.360] CloseHandle (hObject=0x5dc) returned 1
	[0115.360] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.360] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0115.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.360] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7f181044, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x12fc0)) returned 1
	[0115.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.361] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.361] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.362] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x286b5bc | out: lpFileInformation=0x286b5bc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758)) returned 1
	[0115.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.363] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.363] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.363] GetFileType (hFile=0x5dc) returned 0x1
	[0115.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.363] GetFileType (hFile=0x5dc) returned 0x1
	[0115.363] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4758
	[0115.363] ReadFile (in: hFile=0x5dc, lpBuffer=0x286b7cc, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x286b7cc*, lpNumberOfBytesRead=0x593f2cc*=0x4758, lpOverlapped=0x0) returned 1
	[0115.379] CloseHandle (hObject=0x5dc) returned 1
	[0115.379] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0115.379] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.379] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260cb5c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b440) returned 1
	[0115.380] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.380] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.380] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0115.380] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.380] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x260cc14*=0x1, dwFlags=0x0) returned 1
	[0115.380] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x260cbe0, dwFlags=0x0) returned 1
	[0115.380] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260cc24*, pdwDataLen=0x593f2d4*=0x4760, dwBufLen=0x4760 | out: pbData=0x260cc24*, pdwDataLen=0x593f2d4*=0x4760) returned 1
	[0115.380] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2611390*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2611390*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.380] CryptDestroyKey (hKey=0x82b340) returned 1
	[0115.380] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.380] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.380] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.380] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.382] GetFileType (hFile=0x5dc) returned 0x1
	[0115.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.382] GetFileType (hFile=0x5dc) returned 0x1
	[0115.382] WriteFile (in: hFile=0x5dc, lpBuffer=0x260cc24*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x260cc24*, lpNumberOfBytesWritten=0x593f2c0*=0x4760, lpOverlapped=0x0) returned 1
	[0115.383] CloseHandle (hObject=0x5dc) returned 1
	[0115.383] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.383] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0115.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.383] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7f1a58e4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4760)) returned 1
	[0115.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.384] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.384] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.385] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x261172c | out: lpFileInformation=0x261172c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b)) returned 1
	[0115.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.409] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.409] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.409] GetFileType (hFile=0x5dc) returned 0x1
	[0115.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.409] GetFileType (hFile=0x5dc) returned 0x1
	[0115.409] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xd5b
	[0115.409] ReadFile (in: hFile=0x5dc, lpBuffer=0x263ddc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x263ddc0*, lpNumberOfBytesRead=0x593f2cc*=0xd5b, lpOverlapped=0x0) returned 1
	[0115.417] CloseHandle (hObject=0x5dc) returned 1
	[0115.417] CryptDestroyKey (hKey=0x82b440) returned 1
	[0115.417] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.417] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264be58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0115.417] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.417] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.417] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0115.417] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.417] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x264bf10*=0x1, dwFlags=0x0) returned 1
	[0115.417] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x264bedc, dwFlags=0x0) returned 1
	[0115.417] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264bf20*, pdwDataLen=0x593f2d4*=0xd60, dwBufLen=0xd60 | out: pbData=0x264bf20*, pdwDataLen=0x593f2d4*=0xd60) returned 1
	[0115.417] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264cc8c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x264cc8c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.418] CryptDestroyKey (hKey=0x82b380) returned 1
	[0115.418] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.418] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.418] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.418] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.419] GetFileType (hFile=0x5dc) returned 0x1
	[0115.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.419] GetFileType (hFile=0x5dc) returned 0x1
	[0115.419] WriteFile (in: hFile=0x5dc, lpBuffer=0x264cd78*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x264cd78*, lpNumberOfBytesWritten=0x593f294*=0xd60, lpOverlapped=0x0) returned 1
	[0115.420] CloseHandle (hObject=0x5dc) returned 1
	[0115.420] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.420] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0115.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.420] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7f1f1dcf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xd60)) returned 1
	[0115.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.420] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.423] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.423] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x264dfbc | out: lpFileInformation=0x264dfbc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa)) returned 1
	[0115.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.424] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.424] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.424] GetFileType (hFile=0x5dc) returned 0x1
	[0115.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.424] GetFileType (hFile=0x5dc) returned 0x1
	[0115.424] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x141aa
	[0115.424] ReadFile (in: hFile=0x5dc, lpBuffer=0x264e1c4, nNumberOfBytesToRead=0x141aa, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x264e1c4*, lpNumberOfBytesRead=0x593f2cc*=0x141aa, lpOverlapped=0x0) returned 1
	[0115.460] CloseHandle (hObject=0x5dc) returned 1
	[0115.460] CryptDestroyKey (hKey=0x82b340) returned 1
	[0115.460] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.460] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268fd58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0115.460] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.460] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.461] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0115.461] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.461] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x268fe10*=0x1, dwFlags=0x0) returned 1
	[0115.461] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x268fddc, dwFlags=0x0) returned 1
	[0115.461] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268fe20*, pdwDataLen=0x593f2d4*=0x141b0, dwBufLen=0x141b0 | out: pbData=0x268fe20*, pdwDataLen=0x593f2d4*=0x141b0) returned 1
	[0115.461] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a3fdc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26a3fdc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.461] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0115.461] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.461] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.461] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.461] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.463] GetFileType (hFile=0x5dc) returned 0x1
	[0115.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.463] GetFileType (hFile=0x5dc) returned 0x1
	[0115.463] WriteFile (in: hFile=0x5dc, lpBuffer=0x268fe20*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x268fe20*, lpNumberOfBytesWritten=0x593f2c0*=0x141b0, lpOverlapped=0x0) returned 1
	[0115.465] CloseHandle (hObject=0x5dc) returned 1
	[0115.465] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.465] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0115.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.466] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7f264504, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x141b0)) returned 1
	[0115.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.466] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.467] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.467] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x26a4368 | out: lpFileInformation=0x26a4368*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958)) returned 1
	[0115.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.467] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.468] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.468] GetFileType (hFile=0x5dc) returned 0x1
	[0115.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.468] GetFileType (hFile=0x5dc) returned 0x1
	[0115.468] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4958
	[0115.468] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a4578, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26a4578*, lpNumberOfBytesRead=0x593f2cc*=0x4958, lpOverlapped=0x0) returned 1
	[0115.475] CloseHandle (hObject=0x5dc) returned 1
	[0115.476] CryptDestroyKey (hKey=0x82b280) returned 1
	[0115.476] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.476] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26af178, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0115.476] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.476] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.476] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0115.476] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.476] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26af230*=0x1, dwFlags=0x0) returned 1
	[0115.476] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26af1fc, dwFlags=0x0) returned 1
	[0115.476] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26af240*, pdwDataLen=0x593f2d4*=0x4960, dwBufLen=0x4960 | out: pbData=0x26af240*, pdwDataLen=0x593f2d4*=0x4960) returned 1
	[0115.476] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b3bac*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26b3bac*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.476] CryptDestroyKey (hKey=0x82b540) returned 1
	[0115.476] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.476] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.476] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.476] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.478] GetFileType (hFile=0x5dc) returned 0x1
	[0115.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.478] GetFileType (hFile=0x5dc) returned 0x1
	[0115.478] WriteFile (in: hFile=0x5dc, lpBuffer=0x26af240*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26af240*, lpNumberOfBytesWritten=0x593f2c0*=0x4960, lpOverlapped=0x0) returned 1
	[0115.479] CloseHandle (hObject=0x5dc) returned 1
	[0115.479] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.479] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0115.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.479] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7f29839f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4960)) returned 1
	[0115.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.480] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.480] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.481] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x26b3f48 | out: lpFileInformation=0x26b3f48*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac)) returned 1
	[0115.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.484] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.484] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.484] GetFileType (hFile=0x5dc) returned 0x1
	[0115.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.484] GetFileType (hFile=0x5dc) returned 0x1
	[0115.484] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x22ac
	[0115.484] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b6d7c, nNumberOfBytesToRead=0x22ac, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26b6d7c*, lpNumberOfBytesRead=0x593f2cc*=0x22ac, lpOverlapped=0x0) returned 1
	[0115.527] CloseHandle (hObject=0x5dc) returned 1
	[0115.528] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0115.528] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.528] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d9eb0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b080) returned 1
	[0115.528] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.528] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.528] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0115.528] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.528] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26d9f68*=0x1, dwFlags=0x0) returned 1
	[0115.528] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26d9f34, dwFlags=0x0) returned 1
	[0115.528] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d9f78*, pdwDataLen=0x593f2d4*=0x22b0, dwBufLen=0x22b0 | out: pbData=0x26d9f78*, pdwDataLen=0x593f2d4*=0x22b0) returned 1
	[0115.528] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dc234*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26dc234*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.528] CryptDestroyKey (hKey=0x82b280) returned 1
	[0115.528] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.528] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.528] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.528] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.530] GetFileType (hFile=0x5dc) returned 0x1
	[0115.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.530] GetFileType (hFile=0x5dc) returned 0x1
	[0115.530] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d9f78*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26d9f78*, lpNumberOfBytesWritten=0x593f2c0*=0x22b0, lpOverlapped=0x0) returned 1
	[0115.531] CloseHandle (hObject=0x5dc) returned 1
	[0115.531] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.531] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0115.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.531] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7f3233a2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x22b0)) returned 1
	[0115.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.532] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.534] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.534] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x26dc558 | out: lpFileInformation=0x26dc558*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c)) returned 1
	[0115.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.534] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.534] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.534] GetFileType (hFile=0x5dc) returned 0x1
	[0115.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.535] GetFileType (hFile=0x5dc) returned 0x1
	[0115.535] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1510c
	[0115.535] ReadFile (in: hFile=0x5dc, lpBuffer=0xc7af518, nNumberOfBytesToRead=0x1510c, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0xc7af518*, lpNumberOfBytesRead=0x593f2cc*=0x1510c, lpOverlapped=0x0) returned 1
	[0115.545] CloseHandle (hObject=0x5dc) returned 1
	[0115.546] CryptDestroyKey (hKey=0x82b080) returned 1
	[0115.546] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.546] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26eca24, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b480) returned 1
	[0115.546] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.546] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.546] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0115.546] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.546] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26ecadc*=0x1, dwFlags=0x0) returned 1
	[0115.546] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26ecaa8, dwFlags=0x0) returned 1
	[0115.548] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xc7c4640*, pdwDataLen=0x593f2d4*=0x15110, dwBufLen=0x15110 | out: pbData=0xc7c4640*, pdwDataLen=0x593f2d4*=0x15110) returned 1
	[0115.548] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ecaec*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26ecaec*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.548] CryptDestroyKey (hKey=0x82b540) returned 1
	[0115.548] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.548] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.548] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.548] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.550] GetFileType (hFile=0x5dc) returned 0x1
	[0115.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.550] GetFileType (hFile=0x5dc) returned 0x1
	[0115.550] WriteFile (in: hFile=0x5dc, lpBuffer=0xc7c4640*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0xc7c4640*, lpNumberOfBytesWritten=0x593f2c0*=0x15110, lpOverlapped=0x0) returned 1
	[0115.552] CloseHandle (hObject=0x5dc) returned 1
	[0115.553] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.553] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0115.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.553] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7f350462, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x15110)) returned 1
	[0115.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.553] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.554] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.554] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x26ece78 | out: lpFileInformation=0x26ece78*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58)) returned 1
	[0115.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.554] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.555] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.555] GetFileType (hFile=0x5dc) returned 0x1
	[0115.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.555] GetFileType (hFile=0x5dc) returned 0x1
	[0115.555] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4b58
	[0115.555] ReadFile (in: hFile=0x5dc, lpBuffer=0x26ed088, nNumberOfBytesToRead=0x4b58, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26ed088*, lpNumberOfBytesRead=0x593f2cc*=0x4b58, lpOverlapped=0x0) returned 1
	[0115.568] CloseHandle (hObject=0x5dc) returned 1
	[0115.568] CryptDestroyKey (hKey=0x82b480) returned 1
	[0115.568] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.568] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270397c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0115.568] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.568] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.568] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0115.568] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.568] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x2703a34*=0x1, dwFlags=0x0) returned 1
	[0115.568] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x2703a00, dwFlags=0x0) returned 1
	[0115.568] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2703a44*, pdwDataLen=0x593f2d4*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x2703a44*, pdwDataLen=0x593f2d4*=0x4b60) returned 1
	[0115.568] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27085b0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27085b0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.568] CryptDestroyKey (hKey=0x82b340) returned 1
	[0115.569] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.569] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.569] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.569] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.570] GetFileType (hFile=0x5dc) returned 0x1
	[0115.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.570] GetFileType (hFile=0x5dc) returned 0x1
	[0115.570] WriteFile (in: hFile=0x5dc, lpBuffer=0x2703a44*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2703a44*, lpNumberOfBytesWritten=0x593f2c0*=0x4b60, lpOverlapped=0x0) returned 1
	[0115.572] CloseHandle (hObject=0x5dc) returned 1
	[0115.572] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.572] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0115.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.572] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7f36f513, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4b60)) returned 1
	[0115.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.572] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.573] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.573] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x270894c | out: lpFileInformation=0x270894c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74)) returned 1
	[0115.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.574] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.574] ReadFile (in: hFile=0x5dc, lpBuffer=0x270978c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x270978c*, lpNumberOfBytesRead=0x593f2cc*=0xc74, lpOverlapped=0x0) returned 1
	[0115.594] CryptDestroyKey (hKey=0x82b300) returned 1
	[0115.594] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.594] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272fe94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0115.594] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.594] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.595] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0115.595] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.595] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x272ff4c*=0x1, dwFlags=0x0) returned 1
	[0115.595] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x272ff18, dwFlags=0x0) returned 1
	[0115.595] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272ff5c*, pdwDataLen=0x593f2d4*=0xc80, dwBufLen=0xc80 | out: pbData=0x272ff5c*, pdwDataLen=0x593f2d4*=0xc80) returned 1
	[0115.595] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2730be8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2730be8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.595] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0115.595] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.595] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.595] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.595] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.597] GetFileType (hFile=0x5dc) returned 0x1
	[0115.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.597] GetFileType (hFile=0x5dc) returned 0x1
	[0115.597] WriteFile (in: hFile=0x5dc, lpBuffer=0x2730cd4*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2730cd4*, lpNumberOfBytesWritten=0x593f294*=0xc80, lpOverlapped=0x0) returned 1
	[0115.598] CloseHandle (hObject=0x5dc) returned 1
	[0115.598] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.598] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0115.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.598] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0x7f3bbb1b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xc80)) returned 1
	[0115.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.599] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.611] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.611] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2743c18 | out: lpFileInformation=0x2743c18*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0)) returned 1
	[0115.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.611] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.611] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.611] GetFileType (hFile=0x5dc) returned 0x1
	[0115.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.611] GetFileType (hFile=0x5dc) returned 0x1
	[0115.611] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x12db0
	[0115.611] ReadFile (in: hFile=0x5dc, lpBuffer=0x2743e20, nNumberOfBytesToRead=0x12db0, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2743e20*, lpNumberOfBytesRead=0x593f2cc*=0x12db0, lpOverlapped=0x0) returned 1
	[0115.625] CloseHandle (hObject=0x5dc) returned 1
	[0115.625] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0115.625] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.625] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276d17c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0115.625] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.625] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.625] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b200) returned 1
	[0115.626] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.626] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x276d234*=0x1, dwFlags=0x0) returned 1
	[0115.626] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x276d200, dwFlags=0x0) returned 1
	[0115.626] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276d244*, pdwDataLen=0x593f2d4*=0x12dc0, dwBufLen=0x12dc0 | out: pbData=0x276d244*, pdwDataLen=0x593f2d4*=0x12dc0) returned 1
	[0115.626] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2780010*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2780010*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.626] CryptDestroyKey (hKey=0x82b200) returned 1
	[0115.626] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.626] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.626] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.626] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.628] GetFileType (hFile=0x5dc) returned 0x1
	[0115.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.628] GetFileType (hFile=0x5dc) returned 0x1
	[0115.628] WriteFile (in: hFile=0x5dc, lpBuffer=0x276d244*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x276d244*, lpNumberOfBytesWritten=0x593f2c0*=0x12dc0, lpOverlapped=0x0) returned 1
	[0115.630] CloseHandle (hObject=0x5dc) returned 1
	[0115.630] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.631] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0115.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.631] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7f407df7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x12dc0)) returned 1
	[0115.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.631] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.632] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.632] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x278039c | out: lpFileInformation=0x278039c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358)) returned 1
	[0115.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.632] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.632] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.632] GetFileType (hFile=0x5dc) returned 0x1
	[0115.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.632] GetFileType (hFile=0x5dc) returned 0x1
	[0115.632] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4358
	[0115.633] ReadFile (in: hFile=0x5dc, lpBuffer=0x27805ac, nNumberOfBytesToRead=0x4358, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27805ac*, lpNumberOfBytesRead=0x593f2cc*=0x4358, lpOverlapped=0x0) returned 1
	[0115.645] CloseHandle (hObject=0x5dc) returned 1
	[0115.645] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0115.645] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.645] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27849a0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b2c0) returned 1
	[0115.645] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.645] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.646] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0115.646] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.646] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2784a58*=0x1, dwFlags=0x0) returned 1
	[0115.646] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2784a24, dwFlags=0x0) returned 1
	[0115.646] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2784a68*, pdwDataLen=0x593f2d4*=0x4360, dwBufLen=0x4360 | out: pbData=0x2784a68*, pdwDataLen=0x593f2d4*=0x4360) returned 1
	[0115.646] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2788dd4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2788dd4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.646] CryptDestroyKey (hKey=0x82b540) returned 1
	[0115.646] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.646] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.646] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.646] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.647] GetFileType (hFile=0x5dc) returned 0x1
	[0115.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.648] GetFileType (hFile=0x5dc) returned 0x1
	[0115.648] WriteFile (in: hFile=0x5dc, lpBuffer=0x2784a68*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2784a68*, lpNumberOfBytesWritten=0x593f2c0*=0x4360, lpOverlapped=0x0) returned 1
	[0115.649] CloseHandle (hObject=0x5dc) returned 1
	[0115.649] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.649] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0115.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.649] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7f42e14b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4360)) returned 1
	[0115.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.650] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.650] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.650] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2789170 | out: lpFileInformation=0x2789170*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76)) returned 1
	[0115.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.651] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.651] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.651] GetFileType (hFile=0x5dc) returned 0x1
	[0115.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.651] GetFileType (hFile=0x5dc) returned 0x1
	[0115.651] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xe76
	[0115.651] ReadFile (in: hFile=0x5dc, lpBuffer=0x278a1b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x278a1b4*, lpNumberOfBytesRead=0x593f2cc*=0xe76, lpOverlapped=0x0) returned 1
	[0115.725] CloseHandle (hObject=0x5dc) returned 1
	[0115.725] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0115.725] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.725] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d2aa0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b100) returned 1
	[0115.725] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.725] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.725] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0115.725] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.726] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27d2b58*=0x1, dwFlags=0x0) returned 1
	[0115.726] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27d2b24, dwFlags=0x0) returned 1
	[0115.726] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d2b68*, pdwDataLen=0x593f2d4*=0xe80, dwBufLen=0xe80 | out: pbData=0x27d2b68*, pdwDataLen=0x593f2d4*=0xe80) returned 1
	[0115.726] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d39f4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27d39f4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.726] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0115.726] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.726] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.726] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.728] GetFileType (hFile=0x5dc) returned 0x1
	[0115.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.728] GetFileType (hFile=0x5dc) returned 0x1
	[0115.728] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d3ae0*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x27d3ae0*, lpNumberOfBytesWritten=0x593f294*=0xe80, lpOverlapped=0x0) returned 1
	[0115.729] CloseHandle (hObject=0x5dc) returned 1
	[0115.729] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.729] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0115.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.729] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7f4ecce0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xe80)) returned 1
	[0115.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.729] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.732] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.732] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x27d4d24 | out: lpFileInformation=0x27d4d24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde)) returned 1
	[0115.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.732] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.732] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.732] GetFileType (hFile=0x5dc) returned 0x1
	[0115.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.733] GetFileType (hFile=0x5dc) returned 0x1
	[0115.733] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x12cde
	[0115.733] ReadFile (in: hFile=0x5dc, lpBuffer=0x27d4f2c, nNumberOfBytesToRead=0x12cde, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27d4f2c*, lpNumberOfBytesRead=0x593f2cc*=0x12cde, lpOverlapped=0x0) returned 1
	[0115.743] CloseHandle (hObject=0x5dc) returned 1
	[0115.743] CryptDestroyKey (hKey=0x82b100) returned 1
	[0115.744] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.744] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e7ca8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b480) returned 1
	[0115.744] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.744] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.744] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0115.744] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.744] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27e7d60*=0x1, dwFlags=0x0) returned 1
	[0115.744] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27e7d2c, dwFlags=0x0) returned 1
	[0115.744] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e7d70*, pdwDataLen=0x593f2d4*=0x12ce0, dwBufLen=0x12ce0 | out: pbData=0x27e7d70*, pdwDataLen=0x593f2d4*=0x12ce0) returned 1
	[0115.744] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27faa5c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27faa5c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.744] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0115.744] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.744] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.744] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.746] GetFileType (hFile=0x5dc) returned 0x1
	[0115.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.746] GetFileType (hFile=0x5dc) returned 0x1
	[0115.746] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e7d70*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27e7d70*, lpNumberOfBytesWritten=0x593f2c0*=0x12ce0, lpOverlapped=0x0) returned 1
	[0115.748] CloseHandle (hObject=0x5dc) returned 1
	[0115.752] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.752] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0115.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.752] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7f512f19, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x12ce0)) returned 1
	[0115.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.752] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.753] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.753] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x27fade8 | out: lpFileInformation=0x27fade8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758)) returned 1
	[0115.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.754] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.754] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.754] GetFileType (hFile=0x5dc) returned 0x1
	[0115.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.754] GetFileType (hFile=0x5dc) returned 0x1
	[0115.754] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4758
	[0115.754] ReadFile (in: hFile=0x5dc, lpBuffer=0x27faff8, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27faff8*, lpNumberOfBytesRead=0x593f2cc*=0x4758, lpOverlapped=0x0) returned 1
	[0115.756] CloseHandle (hObject=0x5dc) returned 1
	[0115.756] CryptDestroyKey (hKey=0x82b480) returned 1
	[0115.756] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.756] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ff7ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b080) returned 1
	[0115.756] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.757] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.757] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0115.757] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.757] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27ff8a4*=0x1, dwFlags=0x0) returned 1
	[0115.757] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27ff870, dwFlags=0x0) returned 1
	[0115.757] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ff8b4*, pdwDataLen=0x593f2d4*=0x4760, dwBufLen=0x4760 | out: pbData=0x27ff8b4*, pdwDataLen=0x593f2d4*=0x4760) returned 1
	[0115.757] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2804020*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2804020*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.757] CryptDestroyKey (hKey=0x82b540) returned 1
	[0115.757] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.757] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.757] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.757] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.758] GetFileType (hFile=0x5dc) returned 0x1
	[0115.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.759] GetFileType (hFile=0x5dc) returned 0x1
	[0115.759] WriteFile (in: hFile=0x5dc, lpBuffer=0x27ff8b4*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27ff8b4*, lpNumberOfBytesWritten=0x593f2c0*=0x4760, lpOverlapped=0x0) returned 1
	[0115.760] CloseHandle (hObject=0x5dc) returned 1
	[0115.760] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0115.760] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0115.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.760] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7f5391ba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4760)) returned 1
	[0115.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.760] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.761] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.761] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x28043bc | out: lpFileInformation=0x28043bc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6)) returned 1
	[0115.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.762] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.762] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.762] GetFileType (hFile=0x5dc) returned 0x1
	[0115.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.763] GetFileType (hFile=0x5dc) returned 0x1
	[0115.763] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xdc6
	[0115.763] ReadFile (in: hFile=0x5dc, lpBuffer=0x2805350, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2805350*, lpNumberOfBytesRead=0x593f2cc*=0xdc6, lpOverlapped=0x0) returned 1
	[0115.765] CloseHandle (hObject=0x5dc) returned 1
	[0115.768] CryptDestroyKey (hKey=0x82b080) returned 1
	[0115.768] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.768] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28063ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b380) returned 1
	[0115.768] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.768] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.769] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0115.769] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0115.769] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x28064a4*=0x1, dwFlags=0x0) returned 1
	[0115.769] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2806470, dwFlags=0x0) returned 1
	[0115.769] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28064b4*, pdwDataLen=0x593f2d4*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x28064b4*, pdwDataLen=0x593f2d4*=0xdd0) returned 1
	[0115.769] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2807290*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2807290*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0115.769] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0115.769] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.769] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0115.769] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0115.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.770] GetFileType (hFile=0x5dc) returned 0x1
	[0115.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0115.770] GetFileType (hFile=0x5dc) returned 0x1
	[0115.770] WriteFile (in: hFile=0x5dc, lpBuffer=0x280737c*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x280737c*, lpNumberOfBytesWritten=0x593f294*=0xdd0, lpOverlapped=0x0) returned 1
	[0115.771] CloseHandle (hObject=0x5dc) returned 1
	[0115.772] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0115.772] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0115.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0115.772] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7f565d8e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xdd0)) returned 1
	[0115.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0115.772] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0115.894] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0115.894] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2619acc | out: lpFileInformation=0x2619acc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412)) returned 1
	[0115.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0115.894] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0115.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0115.997] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0115.998] GetFileType (hFile=0x5dc) returned 0x1
	[0115.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0115.998] GetFileType (hFile=0x5dc) returned 0x1
	[0115.998] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x14412
	[0115.998] ReadFile (in: hFile=0x5dc, lpBuffer=0x26556b4, nNumberOfBytesToRead=0x14412, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26556b4*, lpNumberOfBytesRead=0x593f2cc*=0x14412, lpOverlapped=0x0) returned 1
	[0116.022] CloseHandle (hObject=0x5dc) returned 1
	[0116.022] CryptDestroyKey (hKey=0x82b380) returned 1
	[0116.022] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.022] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2669b64, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0116.022] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.022] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.023] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0116.023] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.023] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2669c1c*=0x1, dwFlags=0x0) returned 1
	[0116.023] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2669be8, dwFlags=0x0) returned 1
	[0116.023] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2669c2c*, pdwDataLen=0x593f2d4*=0x14420, dwBufLen=0x14420 | out: pbData=0x2669c2c*, pdwDataLen=0x593f2d4*=0x14420) returned 1
	[0116.023] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267e058*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x267e058*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.023] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0116.023] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.023] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.023] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.023] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.026] GetFileType (hFile=0x5dc) returned 0x1
	[0116.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.026] GetFileType (hFile=0x5dc) returned 0x1
	[0116.026] WriteFile (in: hFile=0x5dc, lpBuffer=0x2669c2c*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2669c2c*, lpNumberOfBytesWritten=0x593f2c0*=0x14420, lpOverlapped=0x0) returned 1
	[0116.029] CloseHandle (hObject=0x5dc) returned 1
	[0116.030] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.030] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0116.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.030] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7f7c3ca1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x14420)) returned 1
	[0116.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.031] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.032] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.033] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x267e3e4 | out: lpFileInformation=0x267e3e4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958)) returned 1
	[0116.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.034] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.034] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.034] GetFileType (hFile=0x5dc) returned 0x1
	[0116.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.034] GetFileType (hFile=0x5dc) returned 0x1
	[0116.034] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4958
	[0116.034] ReadFile (in: hFile=0x5dc, lpBuffer=0x267e5f4, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x267e5f4*, lpNumberOfBytesRead=0x593f2cc*=0x4958, lpOverlapped=0x0) returned 1
	[0116.044] CloseHandle (hObject=0x5dc) returned 1
	[0116.045] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0116.045] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.045] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2682fe8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b0c0) returned 1
	[0116.045] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.045] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.045] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b100) returned 1
	[0116.045] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.045] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26830a0*=0x1, dwFlags=0x0) returned 1
	[0116.045] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x268306c, dwFlags=0x0) returned 1
	[0116.045] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26830b0*, pdwDataLen=0x593f2d4*=0x4960, dwBufLen=0x4960 | out: pbData=0x26830b0*, pdwDataLen=0x593f2d4*=0x4960) returned 1
	[0116.045] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2687a1c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2687a1c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.045] CryptDestroyKey (hKey=0x82b100) returned 1
	[0116.045] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.045] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.045] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.045] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.047] GetFileType (hFile=0x5dc) returned 0x1
	[0116.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.047] GetFileType (hFile=0x5dc) returned 0x1
	[0116.047] WriteFile (in: hFile=0x5dc, lpBuffer=0x26830b0*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26830b0*, lpNumberOfBytesWritten=0x593f2c0*=0x4960, lpOverlapped=0x0) returned 1
	[0116.048] CloseHandle (hObject=0x5dc) returned 1
	[0116.049] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.049] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0116.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.050] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7f80de37, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4960)) returned 1
	[0116.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.050] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.051] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.051] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2687db8 | out: lpFileInformation=0x2687db8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3)) returned 1
	[0116.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.051] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.052] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.052] GetFileType (hFile=0x5dc) returned 0x1
	[0116.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.052] GetFileType (hFile=0x5dc) returned 0x1
	[0116.052] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1ac3
	[0116.052] ReadFile (in: hFile=0x5dc, lpBuffer=0x2687f78, nNumberOfBytesToRead=0x1ac3, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2687f78*, lpNumberOfBytesRead=0x593f2cc*=0x1ac3, lpOverlapped=0x0) returned 1
	[0116.082] CloseHandle (hObject=0x5dc) returned 1
	[0116.082] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0116.082] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.082] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bc1f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b380) returned 1
	[0116.082] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.082] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.082] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b4c0) returned 1
	[0116.083] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.083] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26bc2b0*=0x1, dwFlags=0x0) returned 1
	[0116.083] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26bc27c, dwFlags=0x0) returned 1
	[0116.083] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bc2c0*, pdwDataLen=0x593f2d4*=0x1ad0, dwBufLen=0x1ad0 | out: pbData=0x26bc2c0*, pdwDataLen=0x593f2d4*=0x1ad0) returned 1
	[0116.083] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bdd9c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26bdd9c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.083] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0116.083] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.083] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.083] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.083] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.084] GetFileType (hFile=0x5dc) returned 0x1
	[0116.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.084] GetFileType (hFile=0x5dc) returned 0x1
	[0116.085] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bc2c0*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26bc2c0*, lpNumberOfBytesWritten=0x593f2c0*=0x1ad0, lpOverlapped=0x0) returned 1
	[0116.085] CloseHandle (hObject=0x5dc) returned 1
	[0116.086] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.086] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0116.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.086] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7f85a504, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1ad0)) returned 1
	[0116.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.086] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.093] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.093] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x26c7380 | out: lpFileInformation=0x26c7380*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c)) returned 1
	[0116.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.212] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.212] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.212] GetFileType (hFile=0x5dc) returned 0x1
	[0116.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.212] GetFileType (hFile=0x5dc) returned 0x1
	[0116.212] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1198c
	[0116.212] ReadFile (in: hFile=0x5dc, lpBuffer=0x26d24a8, nNumberOfBytesToRead=0x1198c, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26d24a8*, lpNumberOfBytesRead=0x593f2cc*=0x1198c, lpOverlapped=0x0) returned 1
	[0116.231] CloseHandle (hObject=0x5dc) returned 1
	[0116.232] CryptDestroyKey (hKey=0x82b380) returned 1
	[0116.232] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.232] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ff720, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0116.232] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.232] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.232] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0116.232] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.232] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26ff7d8*=0x1, dwFlags=0x0) returned 1
	[0116.232] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26ff7a4, dwFlags=0x0) returned 1
	[0116.232] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ff7e8*, pdwDataLen=0x593f2d4*=0x11990, dwBufLen=0x11990 | out: pbData=0x26ff7e8*, pdwDataLen=0x593f2d4*=0x11990) returned 1
	[0116.232] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2711184*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2711184*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.232] CryptDestroyKey (hKey=0x82b540) returned 1
	[0116.232] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.233] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.233] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.233] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.235] GetFileType (hFile=0x5dc) returned 0x1
	[0116.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.235] GetFileType (hFile=0x5dc) returned 0x1
	[0116.235] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ff7e8*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26ff7e8*, lpNumberOfBytesWritten=0x593f2c0*=0x11990, lpOverlapped=0x0) returned 1
	[0116.236] CloseHandle (hObject=0x5dc) returned 1
	[0116.237] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.237] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0116.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.237] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7f9d7b2f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11990)) returned 1
	[0116.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.237] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.238] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.238] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x2711510 | out: lpFileInformation=0x2711510*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158)) returned 1
	[0116.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.239] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.239] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.239] GetFileType (hFile=0x5dc) returned 0x1
	[0116.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.239] GetFileType (hFile=0x5dc) returned 0x1
	[0116.239] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4158
	[0116.239] ReadFile (in: hFile=0x5dc, lpBuffer=0x2711720, nNumberOfBytesToRead=0x4158, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2711720*, lpNumberOfBytesRead=0x593f2cc*=0x4158, lpOverlapped=0x0) returned 1
	[0116.249] CloseHandle (hObject=0x5dc) returned 1
	[0116.249] CryptDestroyKey (hKey=0x82b340) returned 1
	[0116.249] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.249] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27185f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0116.249] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.249] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.249] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0116.249] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.249] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27186b0*=0x1, dwFlags=0x0) returned 1
	[0116.249] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x271867c, dwFlags=0x0) returned 1
	[0116.249] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27186c0*, pdwDataLen=0x593f2d4*=0x4160, dwBufLen=0x4160 | out: pbData=0x27186c0*, pdwDataLen=0x593f2d4*=0x4160) returned 1
	[0116.249] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x271c82c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x271c82c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.249] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0116.249] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.251] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.251] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.251] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.252] GetFileType (hFile=0x5dc) returned 0x1
	[0116.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.252] GetFileType (hFile=0x5dc) returned 0x1
	[0116.252] WriteFile (in: hFile=0x5dc, lpBuffer=0x27186c0*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27186c0*, lpNumberOfBytesWritten=0x593f2c0*=0x4160, lpOverlapped=0x0) returned 1
	[0116.254] CloseHandle (hObject=0x5dc) returned 1
	[0116.254] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.254] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0116.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.254] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7f9fde86, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4160)) returned 1
	[0116.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.255] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.255] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.255] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x271cbc8 | out: lpFileInformation=0x271cbc8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e)) returned 1
	[0116.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.256] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.256] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.256] GetFileType (hFile=0x5dc) returned 0x1
	[0116.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.256] GetFileType (hFile=0x5dc) returned 0x1
	[0116.256] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x109e
	[0116.256] ReadFile (in: hFile=0x5dc, lpBuffer=0x271cd88, nNumberOfBytesToRead=0x109e, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x271cd88*, lpNumberOfBytesRead=0x593f2cc*=0x109e, lpOverlapped=0x0) returned 1
	[0116.261] CloseHandle (hObject=0x5dc) returned 1
	[0116.261] CryptDestroyKey (hKey=0x82b540) returned 1
	[0116.261] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.261] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2724ab0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0116.261] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.261] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.261] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0116.262] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.262] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2724b68*=0x1, dwFlags=0x0) returned 1
	[0116.262] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2724b34, dwFlags=0x0) returned 1
	[0116.262] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2724b78*, pdwDataLen=0x593f2d4*=0x10a0, dwBufLen=0x10a0 | out: pbData=0x2724b78*, pdwDataLen=0x593f2d4*=0x10a0) returned 1
	[0116.262] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2725c24*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2725c24*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.262] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0116.262] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.262] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.262] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.262] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.264] GetFileType (hFile=0x5dc) returned 0x1
	[0116.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.264] GetFileType (hFile=0x5dc) returned 0x1
	[0116.264] WriteFile (in: hFile=0x5dc, lpBuffer=0x2724b78*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2724b78*, lpNumberOfBytesWritten=0x593f2c0*=0x10a0, lpOverlapped=0x0) returned 1
	[0116.265] CloseHandle (hObject=0x5dc) returned 1
	[0116.265] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.266] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0116.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.266] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7f9fde86, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10a0)) returned 1
	[0116.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.266] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.272] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.273] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x272f904 | out: lpFileInformation=0x272f904*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa)) returned 1
	[0116.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.273] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.273] GetFileType (hFile=0x5dc) returned 0x1
	[0116.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.274] GetFileType (hFile=0x5dc) returned 0x1
	[0116.274] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x151aa
	[0116.274] ReadFile (in: hFile=0x5dc, lpBuffer=0xc7d9770, nNumberOfBytesToRead=0x151aa, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0xc7d9770*, lpNumberOfBytesRead=0x593f2cc*=0x151aa, lpOverlapped=0x0) returned 1
	[0116.295] CloseHandle (hObject=0x5dc) returned 1
	[0116.295] CryptDestroyKey (hKey=0x82b540) returned 1
	[0116.296] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.296] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274db6c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0116.296] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.296] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.296] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0116.296] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.296] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x274dc24*=0x1, dwFlags=0x0) returned 1
	[0116.296] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x274dbf0, dwFlags=0x0) returned 1
	[0116.297] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xc7ee938*, pdwDataLen=0x593f2d4*=0x151b0, dwBufLen=0x151b0 | out: pbData=0xc7ee938*, pdwDataLen=0x593f2d4*=0x151b0) returned 1
	[0116.297] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274dc34*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x274dc34*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.297] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0116.297] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.297] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.297] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.298] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.299] GetFileType (hFile=0x5dc) returned 0x1
	[0116.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.300] GetFileType (hFile=0x5dc) returned 0x1
	[0116.300] WriteFile (in: hFile=0x5dc, lpBuffer=0xc7ee938*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0xc7ee938*, lpNumberOfBytesWritten=0x593f2c0*=0x151b0, lpOverlapped=0x0) returned 1
	[0116.302] CloseHandle (hObject=0x5dc) returned 1
	[0116.302] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.302] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0116.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.302] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7fa70577, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x151b0)) returned 1
	[0116.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.303] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.304] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.304] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x274dfc0 | out: lpFileInformation=0x274dfc0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958)) returned 1
	[0116.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.305] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.305] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.305] GetFileType (hFile=0x5dc) returned 0x1
	[0116.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.305] GetFileType (hFile=0x5dc) returned 0x1
	[0116.305] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4958
	[0116.305] ReadFile (in: hFile=0x5dc, lpBuffer=0x274e1d0, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x274e1d0*, lpNumberOfBytesRead=0x593f2cc*=0x4958, lpOverlapped=0x0) returned 1
	[0116.333] CloseHandle (hObject=0x5dc) returned 1
	[0116.333] CryptDestroyKey (hKey=0x82b540) returned 1
	[0116.333] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.333] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275faa8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0116.333] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.333] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.333] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b480) returned 1
	[0116.333] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.333] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x275fb60*=0x1, dwFlags=0x0) returned 1
	[0116.334] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x275fb2c, dwFlags=0x0) returned 1
	[0116.334] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275fb70*, pdwDataLen=0x593f2d4*=0x4960, dwBufLen=0x4960 | out: pbData=0x275fb70*, pdwDataLen=0x593f2d4*=0x4960) returned 1
	[0116.334] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27644dc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27644dc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.334] CryptDestroyKey (hKey=0x82b480) returned 1
	[0116.334] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.334] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.334] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.334] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.335] GetFileType (hFile=0x5dc) returned 0x1
	[0116.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.335] GetFileType (hFile=0x5dc) returned 0x1
	[0116.335] WriteFile (in: hFile=0x5dc, lpBuffer=0x275fb70*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x275fb70*, lpNumberOfBytesWritten=0x593f2c0*=0x4960, lpOverlapped=0x0) returned 1
	[0116.337] CloseHandle (hObject=0x5dc) returned 1
	[0116.337] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.337] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0116.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.337] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7fabc93c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4960)) returned 1
	[0116.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.337] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.344] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.344] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x276de8c | out: lpFileInformation=0x276de8c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b)) returned 1
	[0116.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.345] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.345] ReadFile (in: hFile=0x5dc, lpBuffer=0x276ee94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x276ee94*, lpNumberOfBytesRead=0x593f2cc*=0xe3b, lpOverlapped=0x0) returned 1
	[0116.347] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0116.347] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.347] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276ff30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0116.347] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.347] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.347] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0116.347] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.347] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x276ffe8*=0x1, dwFlags=0x0) returned 1
	[0116.347] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x276ffb4, dwFlags=0x0) returned 1
	[0116.348] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276fff8*, pdwDataLen=0x593f2d4*=0xe40, dwBufLen=0xe40 | out: pbData=0x276fff8*, pdwDataLen=0x593f2d4*=0xe40) returned 1
	[0116.348] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2770e44*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2770e44*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.348] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0116.348] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.348] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.348] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.348] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.349] GetFileType (hFile=0x5dc) returned 0x1
	[0116.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.349] GetFileType (hFile=0x5dc) returned 0x1
	[0116.349] WriteFile (in: hFile=0x5dc, lpBuffer=0x2770f30*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2770f30*, lpNumberOfBytesWritten=0x593f294*=0xe40, lpOverlapped=0x0) returned 1
	[0116.350] CloseHandle (hObject=0x5dc) returned 1
	[0116.350] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.350] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0116.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.350] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7fae2a83, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xe40)) returned 1
	[0116.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.351] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.353] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.353] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2772174 | out: lpFileInformation=0x2772174*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc)) returned 1
	[0116.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.353] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.353] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.354] GetFileType (hFile=0x5dc) returned 0x1
	[0116.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.354] GetFileType (hFile=0x5dc) returned 0x1
	[0116.354] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x138bc
	[0116.354] ReadFile (in: hFile=0x5dc, lpBuffer=0x277237c, nNumberOfBytesToRead=0x138bc, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x277237c*, lpNumberOfBytesRead=0x593f2cc*=0x138bc, lpOverlapped=0x0) returned 1
	[0116.371] CloseHandle (hObject=0x5dc) returned 1
	[0116.371] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0116.371] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.372] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a28dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0116.372] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.372] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.372] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b0c0) returned 1
	[0116.372] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.372] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27a2994*=0x1, dwFlags=0x0) returned 1
	[0116.372] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x27a2960, dwFlags=0x0) returned 1
	[0116.372] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a29a4*, pdwDataLen=0x593f2d4*=0x138c0, dwBufLen=0x138c0 | out: pbData=0x27a29a4*, pdwDataLen=0x593f2d4*=0x138c0) returned 1
	[0116.372] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b6270*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27b6270*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.372] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0116.373] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.373] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.373] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.373] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.375] GetFileType (hFile=0x5dc) returned 0x1
	[0116.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.375] GetFileType (hFile=0x5dc) returned 0x1
	[0116.375] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a29a4*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27a29a4*, lpNumberOfBytesWritten=0x593f2c0*=0x138c0, lpOverlapped=0x0) returned 1
	[0116.377] CloseHandle (hObject=0x5dc) returned 1
	[0116.377] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.377] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0116.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.378] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7fb2f24e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x138c0)) returned 1
	[0116.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.378] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.379] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.379] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x27b65fc | out: lpFileInformation=0x27b65fc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758)) returned 1
	[0116.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.455] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.455] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.455] GetFileType (hFile=0x5dc) returned 0x1
	[0116.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.455] GetFileType (hFile=0x5dc) returned 0x1
	[0116.455] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4758
	[0116.455] ReadFile (in: hFile=0x5dc, lpBuffer=0x27b680c, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27b680c*, lpNumberOfBytesRead=0x593f2cc*=0x4758, lpOverlapped=0x0) returned 1
	[0116.466] CloseHandle (hObject=0x5dc) returned 1
	[0116.466] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0116.466] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.467] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27bb000, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b440) returned 1
	[0116.467] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.467] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.467] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0116.467] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.467] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27bb0b8*=0x1, dwFlags=0x0) returned 1
	[0116.467] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27bb084, dwFlags=0x0) returned 1
	[0116.467] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27bb0c8*, pdwDataLen=0x593f2d4*=0x4760, dwBufLen=0x4760 | out: pbData=0x27bb0c8*, pdwDataLen=0x593f2d4*=0x4760) returned 1
	[0116.467] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27bf834*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27bf834*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.467] CryptDestroyKey (hKey=0x82b340) returned 1
	[0116.467] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.467] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.467] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.467] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.470] GetFileType (hFile=0x5dc) returned 0x1
	[0116.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.470] GetFileType (hFile=0x5dc) returned 0x1
	[0116.470] WriteFile (in: hFile=0x5dc, lpBuffer=0x27bb0c8*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27bb0c8*, lpNumberOfBytesWritten=0x593f2c0*=0x4760, lpOverlapped=0x0) returned 1
	[0116.471] CloseHandle (hObject=0x5dc) returned 1
	[0116.471] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.471] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0116.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.472] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7fc13e39, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4760)) returned 1
	[0116.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.472] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.472] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.473] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x27bfbd0 | out: lpFileInformation=0x27bfbd0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d)) returned 1
	[0116.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.473] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.473] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.473] GetFileType (hFile=0x5dc) returned 0x1
	[0116.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.473] GetFileType (hFile=0x5dc) returned 0x1
	[0116.473] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x278d
	[0116.473] ReadFile (in: hFile=0x5dc, lpBuffer=0x27bfd90, nNumberOfBytesToRead=0x278d, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27bfd90*, lpNumberOfBytesRead=0x593f2cc*=0x278d, lpOverlapped=0x0) returned 1
	[0116.512] CloseHandle (hObject=0x5dc) returned 1
	[0116.512] CryptDestroyKey (hKey=0x82b440) returned 1
	[0116.512] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.513] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c25bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0116.513] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.513] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.513] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0116.513] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.513] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27c2674*=0x1, dwFlags=0x0) returned 1
	[0116.513] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27c2640, dwFlags=0x0) returned 1
	[0116.513] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c2684*, pdwDataLen=0x593f2d4*=0x2790, dwBufLen=0x2790 | out: pbData=0x27c2684*, pdwDataLen=0x593f2d4*=0x2790) returned 1
	[0116.513] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c4e20*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27c4e20*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.513] CryptDestroyKey (hKey=0x82b380) returned 1
	[0116.513] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.513] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.513] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.513] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.515] GetFileType (hFile=0x5dc) returned 0x1
	[0116.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.515] GetFileType (hFile=0x5dc) returned 0x1
	[0116.515] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c2684*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27c2684*, lpNumberOfBytesWritten=0x593f2c0*=0x2790, lpOverlapped=0x0) returned 1
	[0116.527] CloseHandle (hObject=0x5dc) returned 1
	[0116.528] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.528] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0116.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.528] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7fc86495, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2790)) returned 1
	[0116.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.528] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.530] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.530] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x27c5144 | out: lpFileInformation=0x27c5144*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82)) returned 1
	[0116.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.531] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.531] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.532] GetFileType (hFile=0x5dc) returned 0x1
	[0116.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.532] GetFileType (hFile=0x5dc) returned 0x1
	[0116.532] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x10a82
	[0116.532] ReadFile (in: hFile=0x5dc, lpBuffer=0x27c534c, nNumberOfBytesToRead=0x10a82, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27c534c*, lpNumberOfBytesRead=0x593f2cc*=0x10a82, lpOverlapped=0x0) returned 1
	[0116.550] CloseHandle (hObject=0x5dc) returned 1
	[0116.550] CryptDestroyKey (hKey=0x82b340) returned 1
	[0116.550] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.550] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d5e6c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0116.551] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.551] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.551] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0116.551] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.551] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27d5f24*=0x1, dwFlags=0x0) returned 1
	[0116.551] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27d5ef0, dwFlags=0x0) returned 1
	[0116.551] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d5f34*, pdwDataLen=0x593f2d4*=0x10a90, dwBufLen=0x10a90 | out: pbData=0x27d5f34*, pdwDataLen=0x593f2d4*=0x10a90) returned 1
	[0116.551] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e69d0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27e69d0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.551] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0116.551] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.551] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.551] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.551] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.552] GetFileType (hFile=0x5dc) returned 0x1
	[0116.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.553] GetFileType (hFile=0x5dc) returned 0x1
	[0116.553] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d5f34*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27d5f34*, lpNumberOfBytesWritten=0x593f2c0*=0x10a90, lpOverlapped=0x0) returned 1
	[0116.554] CloseHandle (hObject=0x5dc) returned 1
	[0116.554] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.554] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0116.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.555] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7fcd2971, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10a90)) returned 1
	[0116.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.555] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.556] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.556] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x27e6d5c | out: lpFileInformation=0x27e6d5c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58)) returned 1
	[0116.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.556] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.556] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.556] GetFileType (hFile=0x5dc) returned 0x1
	[0116.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.556] GetFileType (hFile=0x5dc) returned 0x1
	[0116.556] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3d58
	[0116.556] ReadFile (in: hFile=0x5dc, lpBuffer=0x27e6f6c, nNumberOfBytesToRead=0x3d58, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27e6f6c*, lpNumberOfBytesRead=0x593f2cc*=0x3d58, lpOverlapped=0x0) returned 1
	[0116.563] CloseHandle (hObject=0x5dc) returned 1
	[0116.564] CryptDestroyKey (hKey=0x82b280) returned 1
	[0116.564] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.564] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ead60, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0116.564] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.564] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.564] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0116.564] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.564] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27eae18*=0x1, dwFlags=0x0) returned 1
	[0116.564] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27eade4, dwFlags=0x0) returned 1
	[0116.564] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27eae28*, pdwDataLen=0x593f2d4*=0x3d60, dwBufLen=0x3d60 | out: pbData=0x27eae28*, pdwDataLen=0x593f2d4*=0x3d60) returned 1
	[0116.564] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27eeb94*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27eeb94*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.564] CryptDestroyKey (hKey=0x82b540) returned 1
	[0116.564] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.564] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.564] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.564] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.565] GetFileType (hFile=0x5dc) returned 0x1
	[0116.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.565] GetFileType (hFile=0x5dc) returned 0x1
	[0116.565] WriteFile (in: hFile=0x5dc, lpBuffer=0x27eae28*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27eae28*, lpNumberOfBytesWritten=0x593f2c0*=0x3d60, lpOverlapped=0x0) returned 1
	[0116.567] CloseHandle (hObject=0x5dc) returned 1
	[0116.567] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.567] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0116.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.567] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7fcf8af7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3d60)) returned 1
	[0116.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.567] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.568] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.568] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x27eef30 | out: lpFileInformation=0x27eef30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f)) returned 1
	[0116.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.568] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.568] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.568] GetFileType (hFile=0x5dc) returned 0x1
	[0116.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.568] GetFileType (hFile=0x5dc) returned 0x1
	[0116.569] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x318f
	[0116.569] ReadFile (in: hFile=0x5dc, lpBuffer=0x27ef0f0, nNumberOfBytesToRead=0x318f, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27ef0f0*, lpNumberOfBytesRead=0x593f2cc*=0x318f, lpOverlapped=0x0) returned 1
	[0116.579] CloseHandle (hObject=0x5dc) returned 1
	[0116.579] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0116.579] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.579] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f231c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b080) returned 1
	[0116.579] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.579] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.579] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0116.579] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.579] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27f23d4*=0x1, dwFlags=0x0) returned 1
	[0116.579] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27f23a0, dwFlags=0x0) returned 1
	[0116.579] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f23e4*, pdwDataLen=0x593f2d4*=0x3190, dwBufLen=0x3190 | out: pbData=0x27f23e4*, pdwDataLen=0x593f2d4*=0x3190) returned 1
	[0116.580] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f5580*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27f5580*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.580] CryptDestroyKey (hKey=0x82b280) returned 1
	[0116.580] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.580] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.580] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.580] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.581] GetFileType (hFile=0x5dc) returned 0x1
	[0116.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.581] GetFileType (hFile=0x5dc) returned 0x1
	[0116.581] WriteFile (in: hFile=0x5dc, lpBuffer=0x27f23e4*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27f23e4*, lpNumberOfBytesWritten=0x593f2c0*=0x3190, lpOverlapped=0x0) returned 1
	[0116.582] CloseHandle (hObject=0x5dc) returned 1
	[0116.582] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.582] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0116.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.583] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7fd1ee89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3190)) returned 1
	[0116.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.583] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.590] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.590] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x27f58a4 | out: lpFileInformation=0x27f58a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6)) returned 1
	[0116.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.591] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.591] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.591] GetFileType (hFile=0x5dc) returned 0x1
	[0116.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.591] GetFileType (hFile=0x5dc) returned 0x1
	[0116.591] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xfed6
	[0116.591] ReadFile (in: hFile=0x5dc, lpBuffer=0x27f5aac, nNumberOfBytesToRead=0xfed6, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27f5aac*, lpNumberOfBytesRead=0x593f2cc*=0xfed6, lpOverlapped=0x0) returned 1
	[0116.604] CloseHandle (hObject=0x5dc) returned 1
	[0116.604] CryptDestroyKey (hKey=0x82b080) returned 1
	[0116.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.604] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2805a20, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b480) returned 1
	[0116.604] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.604] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.604] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0116.604] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.605] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2805ad8*=0x1, dwFlags=0x0) returned 1
	[0116.605] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2805aa4, dwFlags=0x0) returned 1
	[0116.605] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x280843c*, pdwDataLen=0x593f2d4*=0xfee0, dwBufLen=0xfee0 | out: pbData=0x280843c*, pdwDataLen=0x593f2d4*=0xfee0) returned 1
	[0116.608] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263a978*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x263a978*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.608] CryptDestroyKey (hKey=0x82b540) returned 1
	[0116.609] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.609] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.609] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.609] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.610] GetFileType (hFile=0x5dc) returned 0x1
	[0116.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.610] GetFileType (hFile=0x5dc) returned 0x1
	[0116.610] WriteFile (in: hFile=0x5dc, lpBuffer=0x262aa80*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x262aa80*, lpNumberOfBytesWritten=0x593f2c0*=0xfee0, lpOverlapped=0x0) returned 1
	[0116.612] CloseHandle (hObject=0x5dc) returned 1
	[0116.612] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.612] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0116.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.612] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7fd6b307, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xfee0)) returned 1
	[0116.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.612] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.613] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.613] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x263ad04 | out: lpFileInformation=0x263ad04*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58)) returned 1
	[0116.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.614] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.614] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.614] GetFileType (hFile=0x5dc) returned 0x1
	[0116.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.614] GetFileType (hFile=0x5dc) returned 0x1
	[0116.614] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3b58
	[0116.614] ReadFile (in: hFile=0x5dc, lpBuffer=0x263af14, nNumberOfBytesToRead=0x3b58, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x263af14*, lpNumberOfBytesRead=0x593f2cc*=0x3b58, lpOverlapped=0x0) returned 1
	[0116.658] CloseHandle (hObject=0x5dc) returned 1
	[0116.658] CryptDestroyKey (hKey=0x82b480) returned 1
	[0116.658] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.658] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263eb08, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0116.659] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.659] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.659] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0116.659] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.659] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x263ebc0*=0x1, dwFlags=0x0) returned 1
	[0116.659] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x263eb8c, dwFlags=0x0) returned 1
	[0116.659] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263ebd0*, pdwDataLen=0x593f2d4*=0x3b60, dwBufLen=0x3b60 | out: pbData=0x263ebd0*, pdwDataLen=0x593f2d4*=0x3b60) returned 1
	[0116.659] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264273c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x264273c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.659] CryptDestroyKey (hKey=0x82b340) returned 1
	[0116.659] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.659] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.659] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.659] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.660] GetFileType (hFile=0x5dc) returned 0x1
	[0116.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.661] GetFileType (hFile=0x5dc) returned 0x1
	[0116.661] WriteFile (in: hFile=0x5dc, lpBuffer=0x263ebd0*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x263ebd0*, lpNumberOfBytesWritten=0x593f2c0*=0x3b60, lpOverlapped=0x0) returned 1
	[0116.662] CloseHandle (hObject=0x5dc) returned 1
	[0116.662] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.662] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0116.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.662] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7fdddb34, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3b60)) returned 1
	[0116.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.662] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.663] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.663] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2642ad8 | out: lpFileInformation=0x2642ad8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda)) returned 1
	[0116.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.664] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.665] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.665] GetFileType (hFile=0x5dc) returned 0x1
	[0116.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.665] GetFileType (hFile=0x5dc) returned 0x1
	[0116.665] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xdda
	[0116.665] ReadFile (in: hFile=0x5dc, lpBuffer=0x2643a80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2643a80*, lpNumberOfBytesRead=0x593f2cc*=0xdda, lpOverlapped=0x0) returned 1
	[0116.685] CloseHandle (hObject=0x5dc) returned 1
	[0116.685] CryptDestroyKey (hKey=0x82b300) returned 1
	[0116.685] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.685] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2644b1c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0116.685] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.685] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.685] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0116.685] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.685] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2644bd4*=0x1, dwFlags=0x0) returned 1
	[0116.685] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2644ba0, dwFlags=0x0) returned 1
	[0116.686] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2644be4*, pdwDataLen=0x593f2d4*=0xde0, dwBufLen=0xde0 | out: pbData=0x2644be4*, pdwDataLen=0x593f2d4*=0xde0) returned 1
	[0116.686] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26459d0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26459d0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.686] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0116.686] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.686] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.686] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.686] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.688] GetFileType (hFile=0x5dc) returned 0x1
	[0116.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.688] GetFileType (hFile=0x5dc) returned 0x1
	[0116.688] WriteFile (in: hFile=0x5dc, lpBuffer=0x2645abc*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2645abc*, lpNumberOfBytesWritten=0x593f294*=0xde0, lpOverlapped=0x0) returned 1
	[0116.689] CloseHandle (hObject=0x5dc) returned 1
	[0116.689] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.689] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0116.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.689] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7fe2a001, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xde0)) returned 1
	[0116.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.689] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.692] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.692] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2646d00 | out: lpFileInformation=0x2646d00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712)) returned 1
	[0116.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.694] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.694] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.694] GetFileType (hFile=0x5dc) returned 0x1
	[0116.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.694] GetFileType (hFile=0x5dc) returned 0x1
	[0116.694] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x13712
	[0116.695] ReadFile (in: hFile=0x5dc, lpBuffer=0x2646f08, nNumberOfBytesToRead=0x13712, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2646f08*, lpNumberOfBytesRead=0x593f2cc*=0x13712, lpOverlapped=0x0) returned 1
	[0116.713] CloseHandle (hObject=0x5dc) returned 1
	[0116.713] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0116.713] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.713] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265a6b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0116.713] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.713] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.713] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b200) returned 1
	[0116.713] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.713] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x265a770*=0x1, dwFlags=0x0) returned 1
	[0116.714] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x265a73c, dwFlags=0x0) returned 1
	[0116.714] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265a780*, pdwDataLen=0x593f2d4*=0x13720, dwBufLen=0x13720 | out: pbData=0x265a780*, pdwDataLen=0x593f2d4*=0x13720) returned 1
	[0116.714] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266deac*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x266deac*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.714] CryptDestroyKey (hKey=0x82b200) returned 1
	[0116.714] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.714] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.714] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.714] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.716] GetFileType (hFile=0x5dc) returned 0x1
	[0116.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.716] GetFileType (hFile=0x5dc) returned 0x1
	[0116.716] WriteFile (in: hFile=0x5dc, lpBuffer=0x265a780*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x265a780*, lpNumberOfBytesWritten=0x593f2c0*=0x13720, lpOverlapped=0x0) returned 1
	[0116.718] CloseHandle (hObject=0x5dc) returned 1
	[0116.718] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.718] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0116.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.719] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7fe50211, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13720)) returned 1
	[0116.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.719] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.720] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.720] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x266e238 | out: lpFileInformation=0x266e238*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58)) returned 1
	[0116.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.720] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.721] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.721] GetFileType (hFile=0x5dc) returned 0x1
	[0116.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.721] GetFileType (hFile=0x5dc) returned 0x1
	[0116.721] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4b58
	[0116.721] ReadFile (in: hFile=0x5dc, lpBuffer=0x266e448, nNumberOfBytesToRead=0x4b58, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x266e448*, lpNumberOfBytesRead=0x593f2cc*=0x4b58, lpOverlapped=0x0) returned 1
	[0116.765] CloseHandle (hObject=0x5dc) returned 1
	[0116.766] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0116.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.766] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267303c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b2c0) returned 1
	[0116.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.766] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0116.766] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.766] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26730f4*=0x1, dwFlags=0x0) returned 1
	[0116.767] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26730c0, dwFlags=0x0) returned 1
	[0116.767] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2673104*, pdwDataLen=0x593f2d4*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x2673104*, pdwDataLen=0x593f2d4*=0x4b60) returned 1
	[0116.767] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2677c70*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2677c70*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.767] CryptDestroyKey (hKey=0x82b540) returned 1
	[0116.767] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.767] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.767] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.767] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.768] GetFileType (hFile=0x5dc) returned 0x1
	[0116.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.769] GetFileType (hFile=0x5dc) returned 0x1
	[0116.769] WriteFile (in: hFile=0x5dc, lpBuffer=0x2673104*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2673104*, lpNumberOfBytesWritten=0x593f2c0*=0x4b60, lpOverlapped=0x0) returned 1
	[0116.770] CloseHandle (hObject=0x5dc) returned 1
	[0116.770] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.770] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0116.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.770] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7fee8b93, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4b60)) returned 1
	[0116.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.771] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.771] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.772] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x267800c | out: lpFileInformation=0x267800c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6)) returned 1
	[0116.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.772] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.772] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.773] GetFileType (hFile=0x5dc) returned 0x1
	[0116.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.773] GetFileType (hFile=0x5dc) returned 0x1
	[0116.773] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xbe6
	[0116.773] ReadFile (in: hFile=0x5dc, lpBuffer=0x2678dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2678dc0*, lpNumberOfBytesRead=0x593f2cc*=0xbe6, lpOverlapped=0x0) returned 1
	[0116.775] CloseHandle (hObject=0x5dc) returned 1
	[0116.775] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0116.775] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.775] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2679e5c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b100) returned 1
	[0116.775] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.775] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.775] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0116.775] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.776] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2679f14*=0x1, dwFlags=0x0) returned 1
	[0116.776] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2679ee0, dwFlags=0x0) returned 1
	[0116.776] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2679f24*, pdwDataLen=0x593f2d4*=0xbf0, dwBufLen=0xbf0 | out: pbData=0x2679f24*, pdwDataLen=0x593f2d4*=0xbf0) returned 1
	[0116.776] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267ab20*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x267ab20*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.776] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0116.776] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.776] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.776] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.776] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.777] GetFileType (hFile=0x5dc) returned 0x1
	[0116.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.778] GetFileType (hFile=0x5dc) returned 0x1
	[0116.778] WriteFile (in: hFile=0x5dc, lpBuffer=0x267ac0c*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x267ac0c*, lpNumberOfBytesWritten=0x593f294*=0xbf0, lpOverlapped=0x0) returned 1
	[0116.779] CloseHandle (hObject=0x5dc) returned 1
	[0116.779] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.779] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0116.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.779] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7fee8b93, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xbf0)) returned 1
	[0116.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.779] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.782] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.782] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x267be50 | out: lpFileInformation=0x267be50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0)) returned 1
	[0116.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.782] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.783] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.783] GetFileType (hFile=0x5dc) returned 0x1
	[0116.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.783] GetFileType (hFile=0x5dc) returned 0x1
	[0116.783] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x135c0
	[0116.783] ReadFile (in: hFile=0x5dc, lpBuffer=0x267c058, nNumberOfBytesToRead=0x135c0, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x267c058*, lpNumberOfBytesRead=0x593f2cc*=0x135c0, lpOverlapped=0x0) returned 1
	[0116.792] CloseHandle (hObject=0x5dc) returned 1
	[0116.792] CryptDestroyKey (hKey=0x82b100) returned 1
	[0116.792] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.792] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268f6b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b480) returned 1
	[0116.793] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.793] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.793] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0116.793] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.793] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x268f76c*=0x1, dwFlags=0x0) returned 1
	[0116.793] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x268f738, dwFlags=0x0) returned 1
	[0116.793] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268f77c*, pdwDataLen=0x593f2d4*=0x135d0, dwBufLen=0x135d0 | out: pbData=0x268f77c*, pdwDataLen=0x593f2d4*=0x135d0) returned 1
	[0116.793] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a2d58*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26a2d58*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.793] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0116.793] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.793] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.793] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.794] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.795] GetFileType (hFile=0x5dc) returned 0x1
	[0116.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.795] GetFileType (hFile=0x5dc) returned 0x1
	[0116.796] WriteFile (in: hFile=0x5dc, lpBuffer=0x268f77c*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x268f77c*, lpNumberOfBytesWritten=0x593f2c0*=0x135d0, lpOverlapped=0x0) returned 1
	[0116.798] CloseHandle (hObject=0x5dc) returned 1
	[0116.798] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.798] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0116.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.798] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7ff34f1e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x135d0)) returned 1
	[0116.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.799] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.799] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.800] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x26a30e4 | out: lpFileInformation=0x26a30e4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558)) returned 1
	[0116.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.800] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.800] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.801] GetFileType (hFile=0x5dc) returned 0x1
	[0116.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.801] GetFileType (hFile=0x5dc) returned 0x1
	[0116.801] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4558
	[0116.801] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a32f4, nNumberOfBytesToRead=0x4558, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26a32f4*, lpNumberOfBytesRead=0x593f2cc*=0x4558, lpOverlapped=0x0) returned 1
	[0116.843] CloseHandle (hObject=0x5dc) returned 1
	[0116.844] CryptDestroyKey (hKey=0x82b480) returned 1
	[0116.844] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.844] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a78e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b080) returned 1
	[0116.844] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.844] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.844] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0116.844] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.844] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26a79a0*=0x1, dwFlags=0x0) returned 1
	[0116.844] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26a796c, dwFlags=0x0) returned 1
	[0116.844] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a79b0*, pdwDataLen=0x593f2d4*=0x4560, dwBufLen=0x4560 | out: pbData=0x26a79b0*, pdwDataLen=0x593f2d4*=0x4560) returned 1
	[0116.845] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26abf1c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26abf1c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.845] CryptDestroyKey (hKey=0x82b540) returned 1
	[0116.845] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.845] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.845] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.845] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.846] GetFileType (hFile=0x5dc) returned 0x1
	[0116.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.846] GetFileType (hFile=0x5dc) returned 0x1
	[0116.846] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a79b0*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26a79b0*, lpNumberOfBytesWritten=0x593f2c0*=0x4560, lpOverlapped=0x0) returned 1
	[0116.848] CloseHandle (hObject=0x5dc) returned 1
	[0116.848] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.848] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0116.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.848] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7ffa76d1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4560)) returned 1
	[0116.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.848] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.849] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.849] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x26ac2b8 | out: lpFileInformation=0x26ac2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8)) returned 1
	[0116.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.850] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.850] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.850] GetFileType (hFile=0x5dc) returned 0x1
	[0116.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.850] GetFileType (hFile=0x5dc) returned 0x1
	[0116.850] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xfc8
	[0116.851] ReadFile (in: hFile=0x5dc, lpBuffer=0x26ad44c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26ad44c*, lpNumberOfBytesRead=0x593f2cc*=0xfc8, lpOverlapped=0x0) returned 1
	[0116.863] CloseHandle (hObject=0x5dc) returned 1
	[0116.863] CryptDestroyKey (hKey=0x82b080) returned 1
	[0116.863] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.863] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263aa08, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b380) returned 1
	[0116.863] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.863] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.863] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0116.863] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.864] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x263aac0*=0x1, dwFlags=0x0) returned 1
	[0116.864] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x263aa8c, dwFlags=0x0) returned 1
	[0116.864] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263aad0*, pdwDataLen=0x593f2d4*=0xfd0, dwBufLen=0xfd0 | out: pbData=0x263aad0*, pdwDataLen=0x593f2d4*=0xfd0) returned 1
	[0116.864] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263baac*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x263baac*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.864] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0116.864] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.864] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.864] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.864] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.865] GetFileType (hFile=0x5dc) returned 0x1
	[0116.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.866] GetFileType (hFile=0x5dc) returned 0x1
	[0116.866] WriteFile (in: hFile=0x5dc, lpBuffer=0x263bb98*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x263bb98*, lpNumberOfBytesWritten=0x593f294*=0xfd0, lpOverlapped=0x0) returned 1
	[0116.867] CloseHandle (hObject=0x5dc) returned 1
	[0116.867] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.867] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0116.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.867] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7ffcd953, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xfd0)) returned 1
	[0116.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.867] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.870] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.870] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x263cddc | out: lpFileInformation=0x263cddc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6)) returned 1
	[0116.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.870] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.871] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.871] GetFileType (hFile=0x5dc) returned 0x1
	[0116.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.871] GetFileType (hFile=0x5dc) returned 0x1
	[0116.871] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x141c6
	[0116.871] ReadFile (in: hFile=0x5dc, lpBuffer=0x263cfe4, nNumberOfBytesToRead=0x141c6, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x263cfe4*, lpNumberOfBytesRead=0x593f2cc*=0x141c6, lpOverlapped=0x0) returned 1
	[0116.890] CloseHandle (hObject=0x5dc) returned 1
	[0116.890] CryptDestroyKey (hKey=0x82b380) returned 1
	[0116.890] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.890] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2651248, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0116.891] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.891] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.891] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0116.891] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.891] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2651300*=0x1, dwFlags=0x0) returned 1
	[0116.891] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26512cc, dwFlags=0x0) returned 1
	[0116.891] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2651310*, pdwDataLen=0x593f2d4*=0x141d0, dwBufLen=0x141d0 | out: pbData=0x2651310*, pdwDataLen=0x593f2d4*=0x141d0) returned 1
	[0116.891] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26654ec*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26654ec*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.891] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0116.891] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.891] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.891] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.892] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.893] GetFileType (hFile=0x5dc) returned 0x1
	[0116.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.894] GetFileType (hFile=0x5dc) returned 0x1
	[0116.894] WriteFile (in: hFile=0x5dc, lpBuffer=0x2651310*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2651310*, lpNumberOfBytesWritten=0x593f2c0*=0x141d0, lpOverlapped=0x0) returned 1
	[0116.896] CloseHandle (hObject=0x5dc) returned 1
	[0116.896] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.896] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0116.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.896] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x80019d96, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x141d0)) returned 1
	[0116.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.897] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.897] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.897] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x2665878 | out: lpFileInformation=0x2665878*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758)) returned 1
	[0116.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.898] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.898] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.898] GetFileType (hFile=0x5dc) returned 0x1
	[0116.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.898] GetFileType (hFile=0x5dc) returned 0x1
	[0116.899] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4758
	[0116.899] ReadFile (in: hFile=0x5dc, lpBuffer=0x2665a88, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2665a88*, lpNumberOfBytesRead=0x593f2cc*=0x4758, lpOverlapped=0x0) returned 1
	[0116.911] CloseHandle (hObject=0x5dc) returned 1
	[0116.911] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0116.911] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.912] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266a27c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b0c0) returned 1
	[0116.912] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.912] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.912] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b100) returned 1
	[0116.912] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.912] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x266a334*=0x1, dwFlags=0x0) returned 1
	[0116.912] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x266a300, dwFlags=0x0) returned 1
	[0116.912] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266a344*, pdwDataLen=0x593f2d4*=0x4760, dwBufLen=0x4760 | out: pbData=0x266a344*, pdwDataLen=0x593f2d4*=0x4760) returned 1
	[0116.912] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266eab0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x266eab0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.913] CryptDestroyKey (hKey=0x82b100) returned 1
	[0116.913] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.913] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.913] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.913] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.914] GetFileType (hFile=0x5dc) returned 0x1
	[0116.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.914] GetFileType (hFile=0x5dc) returned 0x1
	[0116.914] WriteFile (in: hFile=0x5dc, lpBuffer=0x266a344*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x266a344*, lpNumberOfBytesWritten=0x593f2c0*=0x4760, lpOverlapped=0x0) returned 1
	[0116.916] CloseHandle (hObject=0x5dc) returned 1
	[0116.916] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.916] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0116.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.916] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x8004008d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4760)) returned 1
	[0116.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.916] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.917] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.917] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x266ee4c | out: lpFileInformation=0x266ee4c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63)) returned 1
	[0116.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.918] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.918] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.918] GetFileType (hFile=0x5dc) returned 0x1
	[0116.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.918] GetFileType (hFile=0x5dc) returned 0x1
	[0116.918] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xe63
	[0116.918] ReadFile (in: hFile=0x5dc, lpBuffer=0x266fe7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x266fe7c*, lpNumberOfBytesRead=0x593f2cc*=0xe63, lpOverlapped=0x0) returned 1
	[0116.955] CloseHandle (hObject=0x5dc) returned 1
	[0116.956] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0116.956] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.956] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2670f18, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b380) returned 1
	[0116.956] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.956] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.956] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b4c0) returned 1
	[0116.956] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.956] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2670fd0*=0x1, dwFlags=0x0) returned 1
	[0116.956] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2670f9c, dwFlags=0x0) returned 1
	[0116.956] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2670fe0*, pdwDataLen=0x593f2d4*=0xe70, dwBufLen=0xe70 | out: pbData=0x2670fe0*, pdwDataLen=0x593f2d4*=0xe70) returned 1
	[0116.956] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2671e5c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2671e5c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.956] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0116.956] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.956] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.956] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.956] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.958] GetFileType (hFile=0x5dc) returned 0x1
	[0116.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.958] GetFileType (hFile=0x5dc) returned 0x1
	[0116.958] WriteFile (in: hFile=0x5dc, lpBuffer=0x2671f48*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2671f48*, lpNumberOfBytesWritten=0x593f294*=0xe70, lpOverlapped=0x0) returned 1
	[0116.959] CloseHandle (hObject=0x5dc) returned 1
	[0116.959] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.959] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0116.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.959] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x800b277b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xe70)) returned 1
	[0116.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.959] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.962] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.962] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x267318c | out: lpFileInformation=0x267318c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62)) returned 1
	[0116.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.962] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.962] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.962] GetFileType (hFile=0x5dc) returned 0x1
	[0116.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.962] GetFileType (hFile=0x5dc) returned 0x1
	[0116.962] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x13b62
	[0116.963] ReadFile (in: hFile=0x5dc, lpBuffer=0x2673394, nNumberOfBytesToRead=0x13b62, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2673394*, lpNumberOfBytesRead=0x593f2cc*=0x13b62, lpOverlapped=0x0) returned 1
	[0116.974] CloseHandle (hObject=0x5dc) returned 1
	[0116.974] CryptDestroyKey (hKey=0x82b380) returned 1
	[0116.974] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.974] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2686f94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0116.974] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.974] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.975] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0116.975] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.975] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x268704c*=0x1, dwFlags=0x0) returned 1
	[0116.975] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2687018, dwFlags=0x0) returned 1
	[0116.975] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268705c*, pdwDataLen=0x593f2d4*=0x13b70, dwBufLen=0x13b70 | out: pbData=0x268705c*, pdwDataLen=0x593f2d4*=0x13b70) returned 1
	[0116.975] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269abd8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x269abd8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.975] CryptDestroyKey (hKey=0x82b540) returned 1
	[0116.975] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.975] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.975] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.975] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.977] GetFileType (hFile=0x5dc) returned 0x1
	[0116.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.977] GetFileType (hFile=0x5dc) returned 0x1
	[0116.977] WriteFile (in: hFile=0x5dc, lpBuffer=0x268705c*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x268705c*, lpNumberOfBytesWritten=0x593f2c0*=0x13b70, lpOverlapped=0x0) returned 1
	[0116.979] CloseHandle (hObject=0x5dc) returned 1
	[0116.980] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0116.980] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0116.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.980] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x800d8938, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13b70)) returned 1
	[0116.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.980] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.981] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.981] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x269af64 | out: lpFileInformation=0x269af64*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758)) returned 1
	[0116.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.981] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.982] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.982] GetFileType (hFile=0x5dc) returned 0x1
	[0116.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.982] GetFileType (hFile=0x5dc) returned 0x1
	[0116.982] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4758
	[0116.982] ReadFile (in: hFile=0x5dc, lpBuffer=0x269b174, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x269b174*, lpNumberOfBytesRead=0x593f2cc*=0x4758, lpOverlapped=0x0) returned 1
	[0116.990] CloseHandle (hObject=0x5dc) returned 1
	[0116.990] CryptDestroyKey (hKey=0x82b340) returned 1
	[0116.991] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.991] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269f968, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0116.991] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.991] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.991] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0116.991] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0116.991] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x269fa20*=0x1, dwFlags=0x0) returned 1
	[0116.991] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x269f9ec, dwFlags=0x0) returned 1
	[0116.991] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269fa30*, pdwDataLen=0x593f2d4*=0x4760, dwBufLen=0x4760 | out: pbData=0x269fa30*, pdwDataLen=0x593f2d4*=0x4760) returned 1
	[0116.991] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a419c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26a419c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0116.991] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0116.991] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.991] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0116.991] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0116.992] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.993] GetFileType (hFile=0x5dc) returned 0x1
	[0116.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0116.993] GetFileType (hFile=0x5dc) returned 0x1
	[0116.993] WriteFile (in: hFile=0x5dc, lpBuffer=0x269fa30*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x269fa30*, lpNumberOfBytesWritten=0x593f2c0*=0x4760, lpOverlapped=0x0) returned 1
	[0116.994] CloseHandle (hObject=0x5dc) returned 1
	[0116.994] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0116.994] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0116.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0116.994] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x800febcf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4760)) returned 1
	[0116.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0116.995] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0116.995] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0116.996] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x26a4538 | out: lpFileInformation=0x26a4538*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8)) returned 1
	[0116.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0116.996] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0116.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0116.997] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0116.997] GetFileType (hFile=0x5dc) returned 0x1
	[0116.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0116.997] GetFileType (hFile=0x5dc) returned 0x1
	[0116.997] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xd4b8
	[0116.997] ReadFile (in: hFile=0x5dc, lpBuffer=0x26afc54, nNumberOfBytesToRead=0xd4b8, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26afc54*, lpNumberOfBytesRead=0x593f2cc*=0xd4b8, lpOverlapped=0x0) returned 1
	[0117.019] CloseHandle (hObject=0x5dc) returned 1
	[0117.019] CryptDestroyKey (hKey=0x82b540) returned 1
	[0117.019] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.019] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bd1a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0117.019] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.019] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.019] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0117.020] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.020] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26bd260*=0x1, dwFlags=0x0) returned 1
	[0117.020] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26bd22c, dwFlags=0x0) returned 1
	[0117.020] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bd270*, pdwDataLen=0x593f2d4*=0xd4c0, dwBufLen=0xd4c0 | out: pbData=0x26bd270*, pdwDataLen=0x593f2d4*=0xd4c0) returned 1
	[0117.020] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ca73c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26ca73c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0117.020] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0117.020] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.020] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.020] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0117.020] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.022] GetFileType (hFile=0x5dc) returned 0x1
	[0117.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0117.022] GetFileType (hFile=0x5dc) returned 0x1
	[0117.022] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bd270*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26bd270*, lpNumberOfBytesWritten=0x593f2c0*=0xd4c0, lpOverlapped=0x0) returned 1
	[0117.024] CloseHandle (hObject=0x5dc) returned 1
	[0117.024] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.024] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0117.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0117.024] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8014b0c3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xd4c0)) returned 1
	[0117.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0117.025] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.027] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0117.027] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x26caa60 | out: lpFileInformation=0x26caa60*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a)) returned 1
	[0117.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0117.028] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0117.028] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.028] GetFileType (hFile=0x5dc) returned 0x1
	[0117.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0117.028] GetFileType (hFile=0x5dc) returned 0x1
	[0117.028] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x13e4a
	[0117.028] ReadFile (in: hFile=0x5dc, lpBuffer=0x26cac68, nNumberOfBytesToRead=0x13e4a, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26cac68*, lpNumberOfBytesRead=0x593f2cc*=0x13e4a, lpOverlapped=0x0) returned 1
	[0117.041] CloseHandle (hObject=0x5dc) returned 1
	[0117.041] CryptDestroyKey (hKey=0x82b540) returned 1
	[0117.041] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.042] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26deb50, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0117.042] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.042] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.042] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0117.042] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.042] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26dec08*=0x1, dwFlags=0x0) returned 1
	[0117.042] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26debd4, dwFlags=0x0) returned 1
	[0117.042] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26dec18*, pdwDataLen=0x593f2d4*=0x13e50, dwBufLen=0x13e50 | out: pbData=0x26dec18*, pdwDataLen=0x593f2d4*=0x13e50) returned 1
	[0117.042] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f2a74*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26f2a74*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0117.042] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0117.042] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.043] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.043] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0117.043] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.045] GetFileType (hFile=0x5dc) returned 0x1
	[0117.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0117.045] GetFileType (hFile=0x5dc) returned 0x1
	[0117.045] WriteFile (in: hFile=0x5dc, lpBuffer=0x26dec18*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26dec18*, lpNumberOfBytesWritten=0x593f2c0*=0x13e50, lpOverlapped=0x0) returned 1
	[0117.047] CloseHandle (hObject=0x5dc) returned 1
	[0117.047] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.048] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0117.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0117.048] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x8019751f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13e50)) returned 1
	[0117.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0117.048] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.049] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0117.049] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x26f2e00 | out: lpFileInformation=0x26f2e00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758)) returned 1
	[0117.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0117.049] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0117.049] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.049] GetFileType (hFile=0x5dc) returned 0x1
	[0117.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0117.050] GetFileType (hFile=0x5dc) returned 0x1
	[0117.050] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4758
	[0117.050] ReadFile (in: hFile=0x5dc, lpBuffer=0x26f3010, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26f3010*, lpNumberOfBytesRead=0x593f2cc*=0x4758, lpOverlapped=0x0) returned 1
	[0117.065] CloseHandle (hObject=0x5dc) returned 1
	[0117.065] CryptDestroyKey (hKey=0x82b540) returned 1
	[0117.065] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.066] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f7804, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0117.066] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.066] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.066] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b480) returned 1
	[0117.066] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.066] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26f78bc*=0x1, dwFlags=0x0) returned 1
	[0117.066] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26f7888, dwFlags=0x0) returned 1
	[0117.066] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f78cc*, pdwDataLen=0x593f2d4*=0x4760, dwBufLen=0x4760 | out: pbData=0x26f78cc*, pdwDataLen=0x593f2d4*=0x4760) returned 1
	[0117.066] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fc038*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26fc038*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0117.066] CryptDestroyKey (hKey=0x82b480) returned 1
	[0117.066] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.066] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.066] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0117.067] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.068] GetFileType (hFile=0x5dc) returned 0x1
	[0117.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0117.068] GetFileType (hFile=0x5dc) returned 0x1
	[0117.068] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f78cc*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26f78cc*, lpNumberOfBytesWritten=0x593f2c0*=0x4760, lpOverlapped=0x0) returned 1
	[0117.069] CloseHandle (hObject=0x5dc) returned 1
	[0117.070] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.070] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0117.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0117.070] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x801bd6db, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4760)) returned 1
	[0117.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0117.070] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.074] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0117.075] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x26fc3d4 | out: lpFileInformation=0x26fc3d4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19)) returned 1
	[0117.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0117.075] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0117.075] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.075] GetFileType (hFile=0x5dc) returned 0x1
	[0117.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0117.076] GetFileType (hFile=0x5dc) returned 0x1
	[0117.076] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xf19
	[0117.076] ReadFile (in: hFile=0x5dc, lpBuffer=0x26fd4bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26fd4bc*, lpNumberOfBytesRead=0x593f2cc*=0xf19, lpOverlapped=0x0) returned 1
	[0117.099] CloseHandle (hObject=0x5dc) returned 1
	[0117.099] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0117.099] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.099] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fe558, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0117.099] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.099] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.099] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0117.099] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.100] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26fe610*=0x1, dwFlags=0x0) returned 1
	[0117.100] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26fe5dc, dwFlags=0x0) returned 1
	[0117.100] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fe620*, pdwDataLen=0x593f2d4*=0xf20, dwBufLen=0xf20 | out: pbData=0x26fe620*, pdwDataLen=0x593f2d4*=0xf20) returned 1
	[0117.100] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ff54c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26ff54c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0117.100] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0117.100] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.100] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.100] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0117.100] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.101] GetFileType (hFile=0x5dc) returned 0x1
	[0117.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0117.102] GetFileType (hFile=0x5dc) returned 0x1
	[0117.102] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ff638*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x26ff638*, lpNumberOfBytesWritten=0x593f294*=0xf20, lpOverlapped=0x0) returned 1
	[0117.103] CloseHandle (hObject=0x5dc) returned 1
	[0117.103] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.103] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0117.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0117.103] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x80209c4b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xf20)) returned 1
	[0117.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0117.103] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.105] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0117.106] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x270087c | out: lpFileInformation=0x270087c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70)) returned 1
	[0117.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0117.106] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0117.107] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.107] GetFileType (hFile=0x5dc) returned 0x1
	[0117.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0117.107] GetFileType (hFile=0x5dc) returned 0x1
	[0117.107] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x12f70
	[0117.107] ReadFile (in: hFile=0x5dc, lpBuffer=0x2700a84, nNumberOfBytesToRead=0x12f70, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2700a84*, lpNumberOfBytesRead=0x593f2cc*=0x12f70, lpOverlapped=0x0) returned 1
	[0117.219] CloseHandle (hObject=0x5dc) returned 1
	[0117.219] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0117.219] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.219] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2713a90, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0117.219] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.219] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.220] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b0c0) returned 1
	[0117.220] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.220] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x2713b48*=0x1, dwFlags=0x0) returned 1
	[0117.220] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x2713b14, dwFlags=0x0) returned 1
	[0117.220] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2713b58*, pdwDataLen=0x593f2d4*=0x12f80, dwBufLen=0x12f80 | out: pbData=0x2713b58*, pdwDataLen=0x593f2d4*=0x12f80) returned 1
	[0117.220] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2726ae4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2726ae4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0117.220] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0117.220] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.220] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.220] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0117.220] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.222] GetFileType (hFile=0x5dc) returned 0x1
	[0117.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0117.223] GetFileType (hFile=0x5dc) returned 0x1
	[0117.223] WriteFile (in: hFile=0x5dc, lpBuffer=0x2713b58*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2713b58*, lpNumberOfBytesWritten=0x593f2c0*=0x12f80, lpOverlapped=0x0) returned 1
	[0117.225] CloseHandle (hObject=0x5dc) returned 1
	[0117.225] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.225] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0117.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0117.225] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x8033af09, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x12f80)) returned 1
	[0117.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0117.225] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.226] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0117.227] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x2726e70 | out: lpFileInformation=0x2726e70*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558)) returned 1
	[0117.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0117.227] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0117.228] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.228] GetFileType (hFile=0x5dc) returned 0x1
	[0117.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0117.228] GetFileType (hFile=0x5dc) returned 0x1
	[0117.228] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4558
	[0117.228] ReadFile (in: hFile=0x5dc, lpBuffer=0x2727080, nNumberOfBytesToRead=0x4558, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2727080*, lpNumberOfBytesRead=0x593f2cc*=0x4558, lpOverlapped=0x0) returned 1
	[0117.251] CloseHandle (hObject=0x5dc) returned 1
	[0117.251] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0117.251] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.251] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272b674, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b440) returned 1
	[0117.251] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.251] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.251] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0117.251] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.251] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x272b72c*=0x1, dwFlags=0x0) returned 1
	[0117.252] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x272b6f8, dwFlags=0x0) returned 1
	[0117.252] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272b73c*, pdwDataLen=0x593f2d4*=0x4560, dwBufLen=0x4560 | out: pbData=0x272b73c*, pdwDataLen=0x593f2d4*=0x4560) returned 1
	[0117.252] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272fca8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x272fca8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0117.252] CryptDestroyKey (hKey=0x82b340) returned 1
	[0117.252] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.252] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.252] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0117.252] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.254] GetFileType (hFile=0x5dc) returned 0x1
	[0117.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0117.254] GetFileType (hFile=0x5dc) returned 0x1
	[0117.254] WriteFile (in: hFile=0x5dc, lpBuffer=0x272b73c*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x272b73c*, lpNumberOfBytesWritten=0x593f2c0*=0x4560, lpOverlapped=0x0) returned 1
	[0117.255] CloseHandle (hObject=0x5dc) returned 1
	[0117.255] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.255] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0117.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0117.255] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x80387376, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4560)) returned 1
	[0117.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0117.256] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.256] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0117.257] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2730044 | out: lpFileInformation=0x2730044*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13)) returned 1
	[0117.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0117.257] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0117.257] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.258] GetFileType (hFile=0x5dc) returned 0x1
	[0117.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0117.258] GetFileType (hFile=0x5dc) returned 0x1
	[0117.258] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xf13
	[0117.258] ReadFile (in: hFile=0x5dc, lpBuffer=0x2731124, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2731124*, lpNumberOfBytesRead=0x593f2cc*=0xf13, lpOverlapped=0x0) returned 1
	[0117.269] CloseHandle (hObject=0x5dc) returned 1
	[0117.270] CryptDestroyKey (hKey=0x82b440) returned 1
	[0117.270] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.270] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27321c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0117.270] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.270] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.270] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0117.270] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.270] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2732278*=0x1, dwFlags=0x0) returned 1
	[0117.270] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2732244, dwFlags=0x0) returned 1
	[0117.270] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2732288*, pdwDataLen=0x593f2d4*=0xf20, dwBufLen=0xf20 | out: pbData=0x2732288*, pdwDataLen=0x593f2d4*=0xf20) returned 1
	[0117.270] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27331b4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27331b4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0117.270] CryptDestroyKey (hKey=0x82b380) returned 1
	[0117.271] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.271] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.271] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0117.271] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.273] GetFileType (hFile=0x5dc) returned 0x1
	[0117.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0117.273] GetFileType (hFile=0x5dc) returned 0x1
	[0117.273] WriteFile (in: hFile=0x5dc, lpBuffer=0x27332a0*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x27332a0*, lpNumberOfBytesWritten=0x593f294*=0xf20, lpOverlapped=0x0) returned 1
	[0117.274] CloseHandle (hObject=0x5dc) returned 1
	[0117.274] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.274] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0117.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0117.275] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x803ad63c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xf20)) returned 1
	[0117.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0117.275] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.287] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0117.287] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x27344e4 | out: lpFileInformation=0x27344e4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12)) returned 1
	[0117.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0117.288] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0117.288] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.288] GetFileType (hFile=0x5dc) returned 0x1
	[0117.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0117.288] GetFileType (hFile=0x5dc) returned 0x1
	[0117.288] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x12c12
	[0117.288] ReadFile (in: hFile=0x5dc, lpBuffer=0x27346ec, nNumberOfBytesToRead=0x12c12, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27346ec*, lpNumberOfBytesRead=0x593f2cc*=0x12c12, lpOverlapped=0x0) returned 1
	[0117.314] CloseHandle (hObject=0x5dc) returned 1
	[0117.314] CryptDestroyKey (hKey=0x82b340) returned 1
	[0117.314] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.314] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274739c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0117.314] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.314] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.314] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0117.314] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.314] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2747454*=0x1, dwFlags=0x0) returned 1
	[0117.315] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2747420, dwFlags=0x0) returned 1
	[0117.315] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2747464*, pdwDataLen=0x593f2d4*=0x12c20, dwBufLen=0x12c20 | out: pbData=0x2747464*, pdwDataLen=0x593f2d4*=0x12c20) returned 1
	[0117.315] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275a090*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x275a090*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0117.315] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0117.315] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.315] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.315] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0117.315] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.317] GetFileType (hFile=0x5dc) returned 0x1
	[0117.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0117.317] GetFileType (hFile=0x5dc) returned 0x1
	[0117.317] WriteFile (in: hFile=0x5dc, lpBuffer=0x2747464*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2747464*, lpNumberOfBytesWritten=0x593f2c0*=0x12c20, lpOverlapped=0x0) returned 1
	[0117.319] CloseHandle (hObject=0x5dc) returned 1
	[0117.319] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.319] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0117.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0117.320] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x8041fcc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x12c20)) returned 1
	[0117.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0117.320] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.320] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0117.321] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x275a41c | out: lpFileInformation=0x275a41c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558)) returned 1
	[0117.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0117.321] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0117.321] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.321] GetFileType (hFile=0x5dc) returned 0x1
	[0117.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0117.322] GetFileType (hFile=0x5dc) returned 0x1
	[0117.322] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4558
	[0117.322] ReadFile (in: hFile=0x5dc, lpBuffer=0x275a62c, nNumberOfBytesToRead=0x4558, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x275a62c*, lpNumberOfBytesRead=0x593f2cc*=0x4558, lpOverlapped=0x0) returned 1
	[0117.324] CloseHandle (hObject=0x5dc) returned 1
	[0117.324] CryptDestroyKey (hKey=0x82b280) returned 1
	[0117.324] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.324] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275ec20, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0117.324] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.324] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.324] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0117.324] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.324] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x275ecd8*=0x1, dwFlags=0x0) returned 1
	[0117.324] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x275eca4, dwFlags=0x0) returned 1
	[0117.324] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275ece8*, pdwDataLen=0x593f2d4*=0x4560, dwBufLen=0x4560 | out: pbData=0x275ece8*, pdwDataLen=0x593f2d4*=0x4560) returned 1
	[0117.325] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2763254*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2763254*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0117.325] CryptDestroyKey (hKey=0x82b540) returned 1
	[0117.325] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.325] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.325] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0117.325] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.326] GetFileType (hFile=0x5dc) returned 0x1
	[0117.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0117.327] GetFileType (hFile=0x5dc) returned 0x1
	[0117.327] WriteFile (in: hFile=0x5dc, lpBuffer=0x275ece8*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x275ece8*, lpNumberOfBytesWritten=0x593f2c0*=0x4560, lpOverlapped=0x0) returned 1
	[0117.364] CloseHandle (hObject=0x5dc) returned 1
	[0117.364] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.365] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0117.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0117.365] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x80492568, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4560)) returned 1
	[0117.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0117.365] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.366] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0117.366] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x27635f0 | out: lpFileInformation=0x27635f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3)) returned 1
	[0117.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0117.367] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0117.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.367] GetFileType (hFile=0x5dc) returned 0x1
	[0117.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0117.367] GetFileType (hFile=0x5dc) returned 0x1
	[0117.367] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x16c3
	[0117.367] ReadFile (in: hFile=0x5dc, lpBuffer=0x27637b0, nNumberOfBytesToRead=0x16c3, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27637b0*, lpNumberOfBytesRead=0x593f2cc*=0x16c3, lpOverlapped=0x0) returned 1
	[0117.382] CloseHandle (hObject=0x5dc) returned 1
	[0117.382] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0117.382] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.383] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2764f10, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b080) returned 1
	[0117.383] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.383] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.383] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0117.385] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.385] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2764fc8*=0x1, dwFlags=0x0) returned 1
	[0117.385] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2764f94, dwFlags=0x0) returned 1
	[0117.386] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2764fd8*, pdwDataLen=0x593f2d4*=0x16d0, dwBufLen=0x16d0 | out: pbData=0x2764fd8*, pdwDataLen=0x593f2d4*=0x16d0) returned 1
	[0117.386] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27666b4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27666b4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0117.386] CryptDestroyKey (hKey=0x82b280) returned 1
	[0117.386] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.386] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.386] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0117.386] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.388] GetFileType (hFile=0x5dc) returned 0x1
	[0117.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0117.388] GetFileType (hFile=0x5dc) returned 0x1
	[0117.388] WriteFile (in: hFile=0x5dc, lpBuffer=0x2764fd8*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2764fd8*, lpNumberOfBytesWritten=0x593f2c0*=0x16d0, lpOverlapped=0x0) returned 1
	[0117.389] CloseHandle (hObject=0x5dc) returned 1
	[0117.390] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\eula.rtf", lpFilePart=0x0) returned 0x23
	[0117.390] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0117.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0117.390] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x804b86ca, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x16d0)) returned 1
	[0117.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0117.391] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.393] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0117.394] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x27669d8 | out: lpFileInformation=0x27669d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c)) returned 1
	[0117.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0117.395] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0117.395] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.395] GetFileType (hFile=0x5dc) returned 0x1
	[0117.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0117.395] GetFileType (hFile=0x5dc) returned 0x1
	[0117.395] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xed0c
	[0117.395] ReadFile (in: hFile=0x5dc, lpBuffer=0x2766be0, nNumberOfBytesToRead=0xed0c, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2766be0*, lpNumberOfBytesRead=0x593f2cc*=0xed0c, lpOverlapped=0x0) returned 1
	[0117.408] CloseHandle (hObject=0x5dc) returned 1
	[0117.408] CryptDestroyKey (hKey=0x82b080) returned 1
	[0117.408] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.409] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2775988, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b480) returned 1
	[0117.409] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.409] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.409] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0117.409] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0117.409] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2775a40*=0x1, dwFlags=0x0) returned 1
	[0117.409] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2775a0c, dwFlags=0x0) returned 1
	[0117.409] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2775a50*, pdwDataLen=0x593f2d4*=0xed10, dwBufLen=0xed10 | out: pbData=0x2775a50*, pdwDataLen=0x593f2d4*=0xed10) returned 1
	[0117.409] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278476c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x278476c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0117.409] CryptDestroyKey (hKey=0x82b540) returned 1
	[0117.409] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.410] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0117.410] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0117.410] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0117.411] GetFileType (hFile=0x5dc) returned 0x1
	[0117.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0117.412] GetFileType (hFile=0x5dc) returned 0x1
	[0117.412] WriteFile (in: hFile=0x5dc, lpBuffer=0x2775a50*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2775a50*, lpNumberOfBytesWritten=0x593f2c0*=0xed10, lpOverlapped=0x0) returned 1
	[0117.413] CloseHandle (hObject=0x5dc) returned 1
	[0117.414] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c
	[0117.414] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0117.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0117.414] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x80504b85, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xed10)) returned 1
	[0117.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0117.414] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0117.415] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", lpFilePart=0x0) returned 0x2d
	[0117.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0117.415] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x2784af8 | out: lpFileInformation=0x2784af8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758)) returned 1
	[0117.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.221] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.221] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.347] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.348] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.349] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.374] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.374] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.374] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.374] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.376] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.399] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.406] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.446] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.446] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0118.475] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", lpFilePart=0x0) returned 0x2a
	[0118.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.475] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.476] GetFileType (hFile=0x5dc) returned 0x1
	[0118.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.476] GetFileType (hFile=0x5dc) returned 0x1
	[0118.476] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x37e
	[0118.476] ReadFile (in: hFile=0x5dc, lpBuffer=0x28564a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x28564a4*, lpNumberOfBytesRead=0x593f2cc*=0x37e, lpOverlapped=0x0) returned 1
	[0118.488] CloseHandle (hObject=0x5dc) returned 1
	[0118.488] CryptDestroyKey (hKey=0x82b380) returned 1
	[0118.488] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.489] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2857540, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0118.489] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.489] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.489] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0118.489] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.489] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x28575f8*=0x1, dwFlags=0x0) returned 1
	[0118.489] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x28575c4, dwFlags=0x0) returned 1
	[0118.489] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2857608*, pdwDataLen=0x593f2d4*=0x380, dwBufLen=0x380 | out: pbData=0x2857608*, pdwDataLen=0x593f2d4*=0x380) returned 1
	[0118.489] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2857994*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2857994*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0118.489] CryptDestroyKey (hKey=0x82b340) returned 1
	[0118.489] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.489] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.489] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", lpFilePart=0x0) returned 0x2a
	[0118.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0118.489] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.492] GetFileType (hFile=0x5dc) returned 0x1
	[0118.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0118.492] GetFileType (hFile=0x5dc) returned 0x1
	[0118.492] WriteFile (in: hFile=0x5dc, lpBuffer=0x2857a94*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2857a94*, lpNumberOfBytesWritten=0x593f294*=0x380, lpOverlapped=0x0) returned 1
	[0118.493] CloseHandle (hObject=0x5dc) returned 1
	[0118.494] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", lpFilePart=0x0) returned 0x2a
	[0118.494] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0118.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0118.494] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80f632c2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0118.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0118.494] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.499] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", lpFilePart=0x0) returned 0x2a
	[0118.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0118.500] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), fInfoLevelId=0x0, lpFileInformation=0x2858d0c | out: lpFileInformation=0x2858d0c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e)) returned 1
	[0118.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.500] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", lpFilePart=0x0) returned 0x2a
	[0118.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.500] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.500] GetFileType (hFile=0x5dc) returned 0x1
	[0118.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.500] GetFileType (hFile=0x5dc) returned 0x1
	[0118.500] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x37e
	[0118.500] ReadFile (in: hFile=0x5dc, lpBuffer=0x2859280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2859280*, lpNumberOfBytesRead=0x593f2cc*=0x37e, lpOverlapped=0x0) returned 1
	[0118.509] CloseHandle (hObject=0x5dc) returned 1
	[0118.509] CryptDestroyKey (hKey=0x82b300) returned 1
	[0118.511] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.511] CryptImportKey (in: hProv=0x7f93c0, pbData=0x285a31c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0118.511] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.511] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.511] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0118.511] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.511] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x285a3d4*=0x1, dwFlags=0x0) returned 1
	[0118.511] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x285a3a0, dwFlags=0x0) returned 1
	[0118.511] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x285a3e4*, pdwDataLen=0x593f2d4*=0x380, dwBufLen=0x380 | out: pbData=0x285a3e4*, pdwDataLen=0x593f2d4*=0x380) returned 1
	[0118.511] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x285a770*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x285a770*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0118.511] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0118.512] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.512] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.512] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", lpFilePart=0x0) returned 0x2a
	[0118.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0118.512] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.513] GetFileType (hFile=0x5dc) returned 0x1
	[0118.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0118.513] GetFileType (hFile=0x5dc) returned 0x1
	[0118.513] WriteFile (in: hFile=0x5dc, lpBuffer=0x285a870*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x285a870*, lpNumberOfBytesWritten=0x593f294*=0x380, lpOverlapped=0x0) returned 1
	[0118.515] CloseHandle (hObject=0x5dc) returned 1
	[0118.515] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", lpFilePart=0x0) returned 0x2a
	[0118.515] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0118.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0118.515] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80f9789b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0118.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0118.515] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.516] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", lpFilePart=0x0) returned 0x2a
	[0118.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0118.516] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), fInfoLevelId=0x0, lpFileInformation=0x285bae8 | out: lpFileInformation=0x285bae8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e)) returned 1
	[0118.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.517] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", lpFilePart=0x0) returned 0x2a
	[0118.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.517] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.517] GetFileType (hFile=0x5dc) returned 0x1
	[0118.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.517] GetFileType (hFile=0x5dc) returned 0x1
	[0118.517] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x37e
	[0118.517] ReadFile (in: hFile=0x5dc, lpBuffer=0x285c05c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x285c05c*, lpNumberOfBytesRead=0x593f2cc*=0x37e, lpOverlapped=0x0) returned 1
	[0118.520] CloseHandle (hObject=0x5dc) returned 1
	[0118.520] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0118.520] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.520] CryptImportKey (in: hProv=0x7f93c0, pbData=0x285d0f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0118.520] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.520] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.520] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0118.520] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.520] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x285d1b0*=0x1, dwFlags=0x0) returned 1
	[0118.520] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x285d17c, dwFlags=0x0) returned 1
	[0118.520] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x285d1c0*, pdwDataLen=0x593f2d4*=0x380, dwBufLen=0x380 | out: pbData=0x285d1c0*, pdwDataLen=0x593f2d4*=0x380) returned 1
	[0118.520] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x285d54c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x285d54c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0118.521] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0118.521] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.521] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.521] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", lpFilePart=0x0) returned 0x2a
	[0118.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0118.521] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.522] GetFileType (hFile=0x5dc) returned 0x1
	[0118.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0118.522] GetFileType (hFile=0x5dc) returned 0x1
	[0118.522] WriteFile (in: hFile=0x5dc, lpBuffer=0x285d64c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x285d64c*, lpNumberOfBytesWritten=0x593f294*=0x380, lpOverlapped=0x0) returned 1
	[0118.524] CloseHandle (hObject=0x5dc) returned 1
	[0118.524] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", lpFilePart=0x0) returned 0x2a
	[0118.524] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0118.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0118.524] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80fa762f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0118.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0118.524] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.525] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", lpFilePart=0x0) returned 0x2a
	[0118.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0118.525] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), fInfoLevelId=0x0, lpFileInformation=0x285e8c4 | out: lpFileInformation=0x285e8c4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e)) returned 1
	[0118.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.526] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", lpFilePart=0x0) returned 0x2a
	[0118.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.526] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.527] GetFileType (hFile=0x5dc) returned 0x1
	[0118.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.527] GetFileType (hFile=0x5dc) returned 0x1
	[0118.527] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x37e
	[0118.527] ReadFile (in: hFile=0x5dc, lpBuffer=0x285ee38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x285ee38*, lpNumberOfBytesRead=0x593f2cc*=0x37e, lpOverlapped=0x0) returned 1
	[0118.534] CloseHandle (hObject=0x5dc) returned 1
	[0118.534] CryptDestroyKey (hKey=0x82b400) returned 1
	[0118.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.534] CryptImportKey (in: hProv=0x7f93c0, pbData=0x285fed4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0118.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.534] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b2c0) returned 1
	[0118.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.534] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x285ff8c*=0x1, dwFlags=0x0) returned 1
	[0118.534] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x285ff58, dwFlags=0x0) returned 1
	[0118.534] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x285ff9c*, pdwDataLen=0x593f2d4*=0x380, dwBufLen=0x380 | out: pbData=0x285ff9c*, pdwDataLen=0x593f2d4*=0x380) returned 1
	[0118.535] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2860328*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2860328*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0118.535] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0118.535] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.535] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.535] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", lpFilePart=0x0) returned 0x2a
	[0118.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0118.535] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.536] GetFileType (hFile=0x5dc) returned 0x1
	[0118.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0118.536] GetFileType (hFile=0x5dc) returned 0x1
	[0118.536] WriteFile (in: hFile=0x5dc, lpBuffer=0x2860428*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2860428*, lpNumberOfBytesWritten=0x593f294*=0x380, lpOverlapped=0x0) returned 1
	[0118.538] CloseHandle (hObject=0x5dc) returned 1
	[0118.538] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", lpFilePart=0x0) returned 0x2a
	[0118.538] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0118.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0118.538] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80fcdbed, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0118.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0118.538] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.539] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Save.ico", lpFilePart=0x0) returned 0x27
	[0118.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0118.539] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), fInfoLevelId=0x0, lpFileInformation=0x28616a0 | out: lpFileInformation=0x28616a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e)) returned 1
	[0118.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.540] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Save.ico", lpFilePart=0x0) returned 0x27
	[0118.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.540] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.540] GetFileType (hFile=0x5dc) returned 0x1
	[0118.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.540] GetFileType (hFile=0x5dc) returned 0x1
	[0118.540] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x47e
	[0118.540] ReadFile (in: hFile=0x5dc, lpBuffer=0x2861cfc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2861cfc*, lpNumberOfBytesRead=0x593f2cc*=0x47e, lpOverlapped=0x0) returned 1
	[0118.546] CloseHandle (hObject=0x5dc) returned 1
	[0118.546] CryptDestroyKey (hKey=0x82b280) returned 1
	[0118.546] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.546] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2862d98, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b2c0) returned 1
	[0118.546] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.546] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.546] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0118.546] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.546] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2862e50*=0x1, dwFlags=0x0) returned 1
	[0118.547] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2862e1c, dwFlags=0x0) returned 1
	[0118.547] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2862e60*, pdwDataLen=0x593f2d4*=0x480, dwBufLen=0x480 | out: pbData=0x2862e60*, pdwDataLen=0x593f2d4*=0x480) returned 1
	[0118.547] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28632ec*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28632ec*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0118.547] CryptDestroyKey (hKey=0x82b280) returned 1
	[0118.547] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.547] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.547] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Save.ico", lpFilePart=0x0) returned 0x27
	[0118.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0118.547] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.548] GetFileType (hFile=0x5dc) returned 0x1
	[0118.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0118.548] GetFileType (hFile=0x5dc) returned 0x1
	[0118.548] WriteFile (in: hFile=0x5dc, lpBuffer=0x28633e0*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x28633e0*, lpNumberOfBytesWritten=0x593f294*=0x480, lpOverlapped=0x0) returned 1
	[0118.549] CloseHandle (hObject=0x5dc) returned 1
	[0118.549] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Save.ico", lpFilePart=0x0) returned 0x27
	[0118.549] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Save.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0118.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0118.550] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80fcdbed, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x480)) returned 1
	[0118.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0118.550] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.550] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", lpFilePart=0x0) returned 0x28
	[0118.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0118.551] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), fInfoLevelId=0x0, lpFileInformation=0x2864644 | out: lpFileInformation=0x2864644*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66)) returned 1
	[0118.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.551] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", lpFilePart=0x0) returned 0x28
	[0118.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.551] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.551] GetFileType (hFile=0x5dc) returned 0x1
	[0118.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.551] GetFileType (hFile=0x5dc) returned 0x1
	[0118.551] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x8f66
	[0118.551] ReadFile (in: hFile=0x5dc, lpBuffer=0x286481c, nNumberOfBytesToRead=0x8f66, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x286481c*, lpNumberOfBytesRead=0x593f2cc*=0x8f66, lpOverlapped=0x0) returned 1
	[0118.556] CloseHandle (hObject=0x5dc) returned 1
	[0118.556] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0118.556] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.557] CryptImportKey (in: hProv=0x7f93c0, pbData=0x286d820, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0118.557] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.557] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.557] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b0c0) returned 1
	[0118.557] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.557] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x286d8d8*=0x1, dwFlags=0x0) returned 1
	[0118.557] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x286d8a4, dwFlags=0x0) returned 1
	[0118.557] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x286d8e8*, pdwDataLen=0x593f2d4*=0x8f70, dwBufLen=0x8f70 | out: pbData=0x286d8e8*, pdwDataLen=0x593f2d4*=0x8f70) returned 1
	[0118.557] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2876864*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2876864*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0118.557] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0118.557] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.557] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.557] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", lpFilePart=0x0) returned 0x28
	[0118.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0118.557] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.559] GetFileType (hFile=0x5dc) returned 0x1
	[0118.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0118.559] GetFileType (hFile=0x5dc) returned 0x1
	[0118.559] WriteFile (in: hFile=0x5dc, lpBuffer=0x286d8e8*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x286d8e8*, lpNumberOfBytesWritten=0x593f2c0*=0x8f70, lpOverlapped=0x0) returned 1
	[0118.560] CloseHandle (hObject=0x5dc) returned 1
	[0118.560] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", lpFilePart=0x0) returned 0x28
	[0118.560] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Setup.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0118.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0118.561] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80ff3e78, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8f70)) returned 1
	[0118.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0118.561] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.562] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\stop.ico", lpFilePart=0x0) returned 0x27
	[0118.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0118.563] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), fInfoLevelId=0x0, lpFileInformation=0x2876bb8 | out: lpFileInformation=0x2876bb8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796)) returned 1
	[0118.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.563] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\stop.ico", lpFilePart=0x0) returned 0x27
	[0118.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.563] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.563] GetFileType (hFile=0x5dc) returned 0x1
	[0118.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.564] GetFileType (hFile=0x5dc) returned 0x1
	[0118.564] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2796
	[0118.564] ReadFile (in: hFile=0x5dc, lpBuffer=0x2876d88, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2876d88*, lpNumberOfBytesRead=0x593f2cc*=0x2796, lpOverlapped=0x0) returned 1
	[0118.565] CloseHandle (hObject=0x5dc) returned 1
	[0118.565] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0118.565] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.565] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28795bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0118.565] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.566] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b300) returned 1
	[0118.566] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.566] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2879674*=0x1, dwFlags=0x0) returned 1
	[0118.566] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2879640, dwFlags=0x0) returned 1
	[0118.566] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2879684*, pdwDataLen=0x593f2d4*=0x27a0, dwBufLen=0x27a0 | out: pbData=0x2879684*, pdwDataLen=0x593f2d4*=0x27a0) returned 1
	[0118.566] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x287be30*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x287be30*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0118.566] CryptDestroyKey (hKey=0x82b300) returned 1
	[0118.566] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.566] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.566] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\stop.ico", lpFilePart=0x0) returned 0x27
	[0118.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0118.566] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.567] GetFileType (hFile=0x5dc) returned 0x1
	[0118.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0118.568] GetFileType (hFile=0x5dc) returned 0x1
	[0118.568] WriteFile (in: hFile=0x5dc, lpBuffer=0x2879684*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2879684*, lpNumberOfBytesWritten=0x593f2c0*=0x27a0, lpOverlapped=0x0) returned 1
	[0118.569] CloseHandle (hObject=0x5dc) returned 1
	[0118.569] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\stop.ico", lpFilePart=0x0) returned 0x27
	[0118.569] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\stop.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0118.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0118.569] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x80ff3e78, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x27a0)) returned 1
	[0118.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0118.569] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.570] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", lpFilePart=0x0) returned 0x2c
	[0118.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0118.570] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), fInfoLevelId=0x0, lpFileInformation=0x287c17c | out: lpFileInformation=0x287c17c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e)) returned 1
	[0118.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.571] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", lpFilePart=0x0) returned 0x2c
	[0118.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.571] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.571] GetFileType (hFile=0x5dc) returned 0x1
	[0118.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.571] GetFileType (hFile=0x5dc) returned 0x1
	[0118.571] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x47e
	[0118.571] ReadFile (in: hFile=0x5dc, lpBuffer=0x287c800, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x287c800*, lpNumberOfBytesRead=0x593f2cc*=0x47e, lpOverlapped=0x0) returned 1
	[0118.573] CloseHandle (hObject=0x5dc) returned 1
	[0118.573] CryptDestroyKey (hKey=0x82b540) returned 1
	[0118.573] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.573] CryptImportKey (in: hProv=0x7f93c0, pbData=0x287d89c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0118.573] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.573] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.573] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0118.573] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.573] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x287d954*=0x1, dwFlags=0x0) returned 1
	[0118.573] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x287d920, dwFlags=0x0) returned 1
	[0118.573] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x287d964*, pdwDataLen=0x593f2d4*=0x480, dwBufLen=0x480 | out: pbData=0x287d964*, pdwDataLen=0x593f2d4*=0x480) returned 1
	[0118.574] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x287ddf0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x287ddf0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0118.574] CryptDestroyKey (hKey=0x82b280) returned 1
	[0118.574] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.574] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.574] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", lpFilePart=0x0) returned 0x2c
	[0118.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0118.574] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.575] GetFileType (hFile=0x5dc) returned 0x1
	[0118.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0118.575] GetFileType (hFile=0x5dc) returned 0x1
	[0118.575] WriteFile (in: hFile=0x5dc, lpBuffer=0x287def8*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x287def8*, lpNumberOfBytesWritten=0x593f294*=0x480, lpOverlapped=0x0) returned 1
	[0118.576] CloseHandle (hObject=0x5dc) returned 1
	[0118.576] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", lpFilePart=0x0) returned 0x2c
	[0118.576] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0118.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0118.577] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x8101e7d8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x480)) returned 1
	[0118.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0118.577] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.577] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", lpFilePart=0x0) returned 0x2f
	[0118.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0118.578] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), fInfoLevelId=0x0, lpFileInformation=0x287f180 | out: lpFileInformation=0x287f180*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e)) returned 1
	[0118.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.578] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", lpFilePart=0x0) returned 0x2f
	[0118.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.578] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.578] GetFileType (hFile=0x5dc) returned 0x1
	[0118.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.578] GetFileType (hFile=0x5dc) returned 0x1
	[0118.578] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x47e
	[0118.578] ReadFile (in: hFile=0x5dc, lpBuffer=0x287f81c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x287f81c*, lpNumberOfBytesRead=0x593f2cc*=0x47e, lpOverlapped=0x0) returned 1
	[0118.583] CloseHandle (hObject=0x5dc) returned 1
	[0118.583] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0118.583] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.583] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28808b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0118.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.583] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0118.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.583] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2880970*=0x1, dwFlags=0x0) returned 1
	[0118.583] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x288093c, dwFlags=0x0) returned 1
	[0118.583] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2880980*, pdwDataLen=0x593f2d4*=0x480, dwBufLen=0x480 | out: pbData=0x2880980*, pdwDataLen=0x593f2d4*=0x480) returned 1
	[0118.583] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880e0c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2880e0c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0118.583] CryptDestroyKey (hKey=0x82b380) returned 1
	[0118.583] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.583] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.583] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", lpFilePart=0x0) returned 0x2f
	[0118.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0118.584] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.585] GetFileType (hFile=0x5dc) returned 0x1
	[0118.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0118.585] GetFileType (hFile=0x5dc) returned 0x1
	[0118.585] WriteFile (in: hFile=0x5dc, lpBuffer=0x2880f20*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2880f20*, lpNumberOfBytesWritten=0x593f294*=0x480, lpOverlapped=0x0) returned 1
	[0118.586] CloseHandle (hObject=0x5dc) returned 1
	[0118.586] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", lpFilePart=0x0) returned 0x2f
	[0118.586] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0118.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0118.586] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x81040332, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x480)) returned 1
	[0118.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0118.587] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.587] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\warn.ico", lpFilePart=0x0) returned 0x27
	[0118.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0118.587] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), fInfoLevelId=0x0, lpFileInformation=0x28821c4 | out: lpFileInformation=0x28821c4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796)) returned 1
	[0118.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.588] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\warn.ico", lpFilePart=0x0) returned 0x27
	[0118.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.588] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.588] GetFileType (hFile=0x5dc) returned 0x1
	[0118.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.588] GetFileType (hFile=0x5dc) returned 0x1
	[0118.588] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2796
	[0118.588] ReadFile (in: hFile=0x5dc, lpBuffer=0x2882394, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2882394*, lpNumberOfBytesRead=0x593f2cc*=0x2796, lpOverlapped=0x0) returned 1
	[0118.600] CloseHandle (hObject=0x5dc) returned 1
	[0118.600] CryptDestroyKey (hKey=0x82b300) returned 1
	[0118.600] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.600] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2884bc8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b100) returned 1
	[0118.600] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.600] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.600] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b480) returned 1
	[0118.601] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.601] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2884c80*=0x1, dwFlags=0x0) returned 1
	[0118.601] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2884c4c, dwFlags=0x0) returned 1
	[0118.601] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2884c90*, pdwDataLen=0x593f2d4*=0x27a0, dwBufLen=0x27a0 | out: pbData=0x2884c90*, pdwDataLen=0x593f2d4*=0x27a0) returned 1
	[0118.601] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x288743c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x288743c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0118.601] CryptDestroyKey (hKey=0x82b480) returned 1
	[0118.601] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.601] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.601] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\warn.ico", lpFilePart=0x0) returned 0x27
	[0118.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0118.601] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.602] GetFileType (hFile=0x5dc) returned 0x1
	[0118.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0118.602] GetFileType (hFile=0x5dc) returned 0x1
	[0118.602] WriteFile (in: hFile=0x5dc, lpBuffer=0x2884c90*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2884c90*, lpNumberOfBytesWritten=0x593f2c0*=0x27a0, lpOverlapped=0x0) returned 1
	[0118.604] CloseHandle (hObject=0x5dc) returned 1
	[0118.604] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\warn.ico", lpFilePart=0x0) returned 0x27
	[0118.604] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\warn.ico id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0118.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0118.604] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x810665b0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x27a0)) returned 1
	[0118.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0118.604] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0118.605] GetFullPathNameW (in: lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\bg-BG\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0118.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0118.605] GetFileAttributesExW (in: lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2887788 | out: lpFileInformation=0x2887788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60)) returned 1
	[0118.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.605] GetFullPathNameW (in: lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\bg-BG\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0118.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.606] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.606] GetFileType (hFile=0x5dc) returned 0x1
	[0118.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.606] GetFileType (hFile=0x5dc) returned 0x1
	[0118.606] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x12f60
	[0118.606] ReadFile (in: hFile=0x5dc, lpBuffer=0x2887948, nNumberOfBytesToRead=0x12f60, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2887948*, lpNumberOfBytesRead=0x593f2cc*=0x12f60, lpOverlapped=0x0) returned 1
	[0118.621] CloseHandle (hObject=0x5dc) returned 1
	[0118.621] CryptDestroyKey (hKey=0x82b100) returned 1
	[0118.621] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.621] CryptImportKey (in: hProv=0x7f93c0, pbData=0x289a944, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b4c0) returned 1
	[0118.621] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.622] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.622] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0118.622] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.622] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x289a9fc*=0x1, dwFlags=0x0) returned 1
	[0118.622] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x289a9c8, dwFlags=0x0) returned 1
	[0118.622] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x289aa0c*, pdwDataLen=0x593f2d4*=0x12f70, dwBufLen=0x12f70 | out: pbData=0x289aa0c*, pdwDataLen=0x593f2d4*=0x12f70) returned 1
	[0118.622] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28ad988*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28ad988*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0118.622] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0118.622] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.622] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.622] GetFullPathNameW (in: lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\bg-BG\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0118.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0118.622] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0118.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0118.624] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0118.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0118.625] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x28adf3c | out: lpFileInformation=0x28adf3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58)) returned 1
	[0118.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.625] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0118.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.625] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.625] GetFileType (hFile=0x5dc) returned 0x1
	[0118.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.625] GetFileType (hFile=0x5dc) returned 0x1
	[0118.625] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x12b58
	[0118.626] ReadFile (in: hFile=0x5dc, lpBuffer=0x28ae0fc, nNumberOfBytesToRead=0x12b58, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x28ae0fc*, lpNumberOfBytesRead=0x593f2cc*=0x12b58, lpOverlapped=0x0) returned 1
	[0118.628] CloseHandle (hObject=0x5dc) returned 1
	[0118.628] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0118.628] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.628] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28c0cf0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0118.628] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.628] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.628] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0118.628] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.628] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x28c0da8*=0x1, dwFlags=0x0) returned 1
	[0118.628] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x28c0d74, dwFlags=0x0) returned 1
	[0118.629] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28c0db8*, pdwDataLen=0x593f2d4*=0x12b60, dwBufLen=0x12b60 | out: pbData=0x28c0db8*, pdwDataLen=0x593f2d4*=0x12b60) returned 1
	[0118.629] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28d3924*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28d3924*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0118.629] CryptDestroyKey (hKey=0x82b340) returned 1
	[0118.629] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.629] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.629] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0118.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0118.629] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0118.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0118.631] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0118.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0118.631] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x28d3e90 | out: lpFileInformation=0x28d3e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0)) returned 1
	[0118.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0118.632] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0118.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0118.632] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0118.632] GetFileType (hFile=0x5dc) returned 0x1
	[0118.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0118.632] GetFileType (hFile=0x5dc) returned 0x1
	[0118.632] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xb1a0
	[0118.632] ReadFile (in: hFile=0x5dc, lpBuffer=0x28d4050, nNumberOfBytesToRead=0xb1a0, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x28d4050*, lpNumberOfBytesRead=0x593f2cc*=0xb1a0, lpOverlapped=0x0) returned 1
	[0118.639] CloseHandle (hObject=0x5dc) returned 1
	[0118.639] CryptDestroyKey (hKey=0x82b300) returned 1
	[0118.639] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0118.639] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28df28c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0118.639] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.639] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.639] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0118.639] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0118.639] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x28df344*=0x1, dwFlags=0x0) returned 1
	[0118.639] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x28df310, dwFlags=0x0) returned 1
	[0119.030] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260c398*, pdwDataLen=0x593f2d4*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x260c398*, pdwDataLen=0x593f2d4*=0xb1b0) returned 1
	[0119.031] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2617554*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2617554*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0119.031] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0119.031] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.031] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.031] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0119.031] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0119.033] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0119.033] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2617a08 | out: lpFileInformation=0x2617a08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760)) returned 1
	[0119.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0119.034] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0119.035] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.035] GetFileType (hFile=0x5dc) returned 0x1
	[0119.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0119.035] GetFileType (hFile=0x5dc) returned 0x1
	[0119.035] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x12760
	[0119.035] ReadFile (in: hFile=0x5dc, lpBuffer=0x2617bc8, nNumberOfBytesToRead=0x12760, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2617bc8*, lpNumberOfBytesRead=0x593f2cc*=0x12760, lpOverlapped=0x0) returned 1
	[0119.038] CloseHandle (hObject=0x5dc) returned 1
	[0119.038] CryptDestroyKey (hKey=0x82b340) returned 1
	[0119.038] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.038] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262a3c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0119.038] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.038] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.038] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b0c0) returned 1
	[0119.038] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.038] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x262a47c*=0x1, dwFlags=0x0) returned 1
	[0119.039] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x262a448, dwFlags=0x0) returned 1
	[0119.039] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262a48c*, pdwDataLen=0x593f2d4*=0x12770, dwBufLen=0x12770 | out: pbData=0x262a48c*, pdwDataLen=0x593f2d4*=0x12770) returned 1
	[0119.039] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263cc08*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x263cc08*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0119.039] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0119.039] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.039] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.039] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0119.039] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0119.041] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0119.042] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x263d0bc | out: lpFileInformation=0x263d0bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0)) returned 1
	[0119.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0119.042] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0119.042] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.043] GetFileType (hFile=0x5dc) returned 0x1
	[0119.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0119.043] GetFileType (hFile=0x5dc) returned 0x1
	[0119.043] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xb1a0
	[0119.043] ReadFile (in: hFile=0x5dc, lpBuffer=0x263d27c, nNumberOfBytesToRead=0xb1a0, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x263d27c*, lpNumberOfBytesRead=0x593f2cc*=0xb1a0, lpOverlapped=0x0) returned 1
	[0119.045] CloseHandle (hObject=0x5dc) returned 1
	[0119.045] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0119.045] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.045] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26484b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0119.045] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.045] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.046] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0119.046] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.046] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2648570*=0x1, dwFlags=0x0) returned 1
	[0119.046] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x264853c, dwFlags=0x0) returned 1
	[0119.046] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2648580*, pdwDataLen=0x593f2d4*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x2648580*, pdwDataLen=0x593f2d4*=0xb1b0) returned 1
	[0119.046] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265373c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x265373c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0119.046] CryptDestroyKey (hKey=0x82b540) returned 1
	[0119.046] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.046] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.046] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0119.046] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0119.048] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0119.048] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2653bf0 | out: lpFileInformation=0x2653bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560)) returned 1
	[0119.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0119.049] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0119.049] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.049] GetFileType (hFile=0x5dc) returned 0x1
	[0119.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0119.049] GetFileType (hFile=0x5dc) returned 0x1
	[0119.049] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x13560
	[0119.050] ReadFile (in: hFile=0x5dc, lpBuffer=0x2653db0, nNumberOfBytesToRead=0x13560, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2653db0*, lpNumberOfBytesRead=0x593f2cc*=0x13560, lpOverlapped=0x0) returned 1
	[0119.052] CloseHandle (hObject=0x5dc) returned 1
	[0119.052] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0119.052] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.052] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26673ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0119.052] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.052] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.052] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0119.052] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.052] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2667464*=0x1, dwFlags=0x0) returned 1
	[0119.052] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2667430, dwFlags=0x0) returned 1
	[0119.053] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2667474*, pdwDataLen=0x593f2d4*=0x13570, dwBufLen=0x13570 | out: pbData=0x2667474*, pdwDataLen=0x593f2d4*=0x13570) returned 1
	[0119.053] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267a9f0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x267a9f0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0119.053] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0119.053] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.053] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.053] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0119.053] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0119.055] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0119.055] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x267aea4 | out: lpFileInformation=0x267aea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0)) returned 1
	[0119.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0119.056] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0119.056] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.056] GetFileType (hFile=0x5dc) returned 0x1
	[0119.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0119.056] GetFileType (hFile=0x5dc) returned 0x1
	[0119.057] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xb3a0
	[0119.057] ReadFile (in: hFile=0x5dc, lpBuffer=0x267b064, nNumberOfBytesToRead=0xb3a0, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x267b064*, lpNumberOfBytesRead=0x593f2cc*=0xb3a0, lpOverlapped=0x0) returned 1
	[0119.059] CloseHandle (hObject=0x5dc) returned 1
	[0119.059] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0119.059] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.059] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26864a0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0119.059] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.059] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.059] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0119.059] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.059] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2686558*=0x1, dwFlags=0x0) returned 1
	[0119.060] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2686524, dwFlags=0x0) returned 1
	[0119.060] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2686568*, pdwDataLen=0x593f2d4*=0xb3b0, dwBufLen=0xb3b0 | out: pbData=0x2686568*, pdwDataLen=0x593f2d4*=0xb3b0) returned 1
	[0119.060] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2691924*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2691924*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0119.060] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0119.060] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.060] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.060] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0119.060] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0119.062] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0119.062] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2691dd8 | out: lpFileInformation=0x2691dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960)) returned 1
	[0119.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0119.063] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0119.063] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.063] GetFileType (hFile=0x5dc) returned 0x1
	[0119.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0119.063] GetFileType (hFile=0x5dc) returned 0x1
	[0119.063] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x13960
	[0119.064] ReadFile (in: hFile=0x5dc, lpBuffer=0x2691f98, nNumberOfBytesToRead=0x13960, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2691f98*, lpNumberOfBytesRead=0x593f2cc*=0x13960, lpOverlapped=0x0) returned 1
	[0119.070] CloseHandle (hObject=0x5dc) returned 1
	[0119.070] CryptDestroyKey (hKey=0x82b540) returned 1
	[0119.070] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.070] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a5994, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0119.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.071] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b200) returned 1
	[0119.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.071] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26a5a4c*=0x1, dwFlags=0x0) returned 1
	[0119.071] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26a5a18, dwFlags=0x0) returned 1
	[0119.071] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a5a5c*, pdwDataLen=0x593f2d4*=0x13970, dwBufLen=0x13970 | out: pbData=0x26a5a5c*, pdwDataLen=0x593f2d4*=0x13970) returned 1
	[0119.071] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b93d8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26b93d8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0119.071] CryptDestroyKey (hKey=0x82b200) returned 1
	[0119.071] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.071] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.071] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0119.071] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0119.074] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0119.074] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26b988c | out: lpFileInformation=0x26b988c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0)) returned 1
	[0119.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0119.074] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0119.075] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.075] GetFileType (hFile=0x5dc) returned 0x1
	[0119.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0119.075] GetFileType (hFile=0x5dc) returned 0x1
	[0119.075] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xb5a0
	[0119.075] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b9a4c, nNumberOfBytesToRead=0xb5a0, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26b9a4c*, lpNumberOfBytesRead=0x593f2cc*=0xb5a0, lpOverlapped=0x0) returned 1
	[0119.077] CloseHandle (hObject=0x5dc) returned 1
	[0119.077] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0119.077] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.077] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c5088, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0119.077] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.077] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.077] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0119.077] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.077] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26c5140*=0x1, dwFlags=0x0) returned 1
	[0119.077] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26c510c, dwFlags=0x0) returned 1
	[0119.077] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c5150*, pdwDataLen=0x593f2d4*=0xb5b0, dwBufLen=0xb5b0 | out: pbData=0x26c5150*, pdwDataLen=0x593f2d4*=0xb5b0) returned 1
	[0119.078] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d070c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26d070c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0119.078] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0119.078] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.078] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.078] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0119.078] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0119.080] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-GB\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0119.080] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26d0bc0 | out: lpFileInformation=0x26d0bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158)) returned 1
	[0119.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0119.080] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-GB\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0119.080] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0119.081] GetFileType (hFile=0x5dc) returned 0x1
	[0119.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0119.081] GetFileType (hFile=0x5dc) returned 0x1
	[0119.081] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x12158
	[0119.081] ReadFile (in: hFile=0x5dc, lpBuffer=0x26d0d80, nNumberOfBytesToRead=0x12158, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26d0d80*, lpNumberOfBytesRead=0x593f2cc*=0x12158, lpOverlapped=0x0) returned 1
	[0119.083] CloseHandle (hObject=0x5dc) returned 1
	[0119.083] CryptDestroyKey (hKey=0x82b280) returned 1
	[0119.083] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.083] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e2f74, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b4c0) returned 1
	[0119.083] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.083] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.083] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0119.083] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0119.083] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26e302c*=0x1, dwFlags=0x0) returned 1
	[0119.083] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26e2ff8, dwFlags=0x0) returned 1
	[0119.084] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e303c*, pdwDataLen=0x593f2d4*=0x12160, dwBufLen=0x12160 | out: pbData=0x26e303c*, pdwDataLen=0x593f2d4*=0x12160) returned 1
	[0119.084] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f51a8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26f51a8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0119.084] CryptDestroyKey (hKey=0x82b540) returned 1
	[0119.084] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.084] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0119.084] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-GB\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0119.084] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0119.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0119.086] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d
	[0119.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0119.086] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26f565c | out: lpFileInformation=0x26f565c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0)) returned 1
	[0119.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0120.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.932] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.943] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.946] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0120.989] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.073] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.085] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.177] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.255] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.286] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.287] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.368] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.381] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.388] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.389] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.391] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0121.406] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.469] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.492] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.539] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.543] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.551] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.608] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.652] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.662] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.686] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.706] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.743] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.748] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.757] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.836] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.850] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.850] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.851] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.851] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.878] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.882] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.914] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.940] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.950] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.951] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.965] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.966] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.966] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.968] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.968] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.969] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.969] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0122.969] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.003] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.005] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.006] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.014] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0123.025] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", lpFilePart=0x0) returned 0x40
	[0123.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.025] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.005.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.025] GetFileType (hFile=0x5dc) returned 0x1
	[0123.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.025] GetFileType (hFile=0x5dc) returned 0x1
	[0123.025] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1000
	[0123.025] ReadFile (in: hFile=0x5dc, lpBuffer=0x27249dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27249dc*, lpNumberOfBytesRead=0x593f2cc*=0x1000, lpOverlapped=0x0) returned 1
	[0123.027] CloseHandle (hObject=0x5dc) returned 1
	[0123.027] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0123.027] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.027] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2725a78, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0123.027] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.027] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.027] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0123.028] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.028] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2725b30*=0x1, dwFlags=0x0) returned 1
	[0123.028] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2725afc, dwFlags=0x0) returned 1
	[0123.028] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2725b40*, pdwDataLen=0x593f2d4*=0x1010, dwBufLen=0x1010 | out: pbData=0x2725b40*, pdwDataLen=0x593f2d4*=0x1010) returned 1
	[0123.028] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2726b5c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2726b5c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.028] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0123.028] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.028] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.028] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", lpFilePart=0x0) returned 0x40
	[0123.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.028] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.005.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.029] GetFileType (hFile=0x5dc) returned 0x1
	[0123.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.029] GetFileType (hFile=0x5dc) returned 0x1
	[0123.029] WriteFile (in: hFile=0x5dc, lpBuffer=0x2725b40*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2725b40*, lpNumberOfBytesWritten=0x593f2c0*=0x1010, lpOverlapped=0x0) returned 1
	[0123.031] CloseHandle (hObject=0x5dc) returned 1
	[0123.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", lpFilePart=0x0) returned 0x40
	[0123.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.031] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.005.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x60de6047, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x83aa796d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1010)) returned 1
	[0123.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.031] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.005.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.005.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", lpFilePart=0x0) returned 0x40
	[0123.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.036] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.006.etl"), fInfoLevelId=0x0, lpFileInformation=0x2726fd4 | out: lpFileInformation=0x2726fd4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa72ae253, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xcb3f3780, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", lpFilePart=0x0) returned 0x40
	[0123.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.036] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.006.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.036] GetFileType (hFile=0x5dc) returned 0x1
	[0123.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.036] GetFileType (hFile=0x5dc) returned 0x1
	[0123.037] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2000
	[0123.037] ReadFile (in: hFile=0x5dc, lpBuffer=0x2727274, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2727274*, lpNumberOfBytesRead=0x593f2cc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.038] CloseHandle (hObject=0x5dc) returned 1
	[0123.038] CryptDestroyKey (hKey=0x82b300) returned 1
	[0123.038] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.038] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2729310, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0123.039] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.039] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.039] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0123.039] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.039] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27293c8*=0x1, dwFlags=0x0) returned 1
	[0123.039] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2729394, dwFlags=0x0) returned 1
	[0123.039] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27293d8*, pdwDataLen=0x593f2d4*=0x2010, dwBufLen=0x2010 | out: pbData=0x27293d8*, pdwDataLen=0x593f2d4*=0x2010) returned 1
	[0123.039] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272b3f4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x272b3f4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.039] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0123.039] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.039] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", lpFilePart=0x0) returned 0x40
	[0123.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.039] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.006.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.041] GetFileType (hFile=0x5dc) returned 0x1
	[0123.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.041] GetFileType (hFile=0x5dc) returned 0x1
	[0123.041] WriteFile (in: hFile=0x5dc, lpBuffer=0x27293d8*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27293d8*, lpNumberOfBytesWritten=0x593f2c0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.042] CloseHandle (hObject=0x5dc) returned 1
	[0123.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", lpFilePart=0x0) returned 0x40
	[0123.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.043] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.006.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa72ae253, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x83aa796d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.043] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.006.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.006.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.044] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", lpFilePart=0x0) returned 0x40
	[0123.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.044] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.007.etl"), fInfoLevelId=0x0, lpFileInformation=0x272b86c | out: lpFileInformation=0x272b86c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x5ca8efbc, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x8784f695, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1
	[0123.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.044] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", lpFilePart=0x0) returned 0x40
	[0123.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.044] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.007.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.045] GetFileType (hFile=0x5dc) returned 0x1
	[0123.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.045] GetFileType (hFile=0x5dc) returned 0x1
	[0123.045] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3000
	[0123.045] ReadFile (in: hFile=0x5dc, lpBuffer=0x272bb0c, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x272bb0c*, lpNumberOfBytesRead=0x593f2cc*=0x3000, lpOverlapped=0x0) returned 1
	[0123.061] CloseHandle (hObject=0x5dc) returned 1
	[0123.061] CryptDestroyKey (hKey=0x82b540) returned 1
	[0123.061] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.061] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272eba8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0123.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.061] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0123.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.061] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x272ec60*=0x1, dwFlags=0x0) returned 1
	[0123.061] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x272ec2c, dwFlags=0x0) returned 1
	[0123.062] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272ec70*, pdwDataLen=0x593f2d4*=0x3010, dwBufLen=0x3010 | out: pbData=0x272ec70*, pdwDataLen=0x593f2d4*=0x3010) returned 1
	[0123.062] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2731c8c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2731c8c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.062] CryptDestroyKey (hKey=0x82b340) returned 1
	[0123.062] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.062] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.062] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", lpFilePart=0x0) returned 0x40
	[0123.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.062] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.007.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.063] GetFileType (hFile=0x5dc) returned 0x1
	[0123.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.064] GetFileType (hFile=0x5dc) returned 0x1
	[0123.064] WriteFile (in: hFile=0x5dc, lpBuffer=0x272ec70*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x272ec70*, lpNumberOfBytesWritten=0x593f2c0*=0x3010, lpOverlapped=0x0) returned 1
	[0123.065] CloseHandle (hObject=0x5dc) returned 1
	[0123.065] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", lpFilePart=0x0) returned 0x40
	[0123.065] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.065] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.007.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x5ca8efbc, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x83af3fe6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1
	[0123.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.066] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.007.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.007.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.067] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", lpFilePart=0x0) returned 0x40
	[0123.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.067] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.008.etl"), fInfoLevelId=0x0, lpFileInformation=0x2732104 | out: lpFileInformation=0x2732104*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4346f4fe, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4346f4fe, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.067] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", lpFilePart=0x0) returned 0x40
	[0123.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.067] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.008.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.068] GetFileType (hFile=0x5dc) returned 0x1
	[0123.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.068] GetFileType (hFile=0x5dc) returned 0x1
	[0123.068] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2000
	[0123.068] ReadFile (in: hFile=0x5dc, lpBuffer=0x27323a4, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27323a4*, lpNumberOfBytesRead=0x593f2cc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.069] CloseHandle (hObject=0x5dc) returned 1
	[0123.069] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0123.070] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.070] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2734440, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0123.070] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.070] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.070] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b000) returned 1
	[0123.070] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.070] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x27344f8*=0x1, dwFlags=0x0) returned 1
	[0123.070] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x27344c4, dwFlags=0x0) returned 1
	[0123.070] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2734508*, pdwDataLen=0x593f2d4*=0x2010, dwBufLen=0x2010 | out: pbData=0x2734508*, pdwDataLen=0x593f2d4*=0x2010) returned 1
	[0123.070] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2736524*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2736524*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.070] CryptDestroyKey (hKey=0x82b000) returned 1
	[0123.070] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.070] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.071] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", lpFilePart=0x0) returned 0x40
	[0123.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.071] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.008.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.072] GetFileType (hFile=0x5dc) returned 0x1
	[0123.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.072] GetFileType (hFile=0x5dc) returned 0x1
	[0123.072] WriteFile (in: hFile=0x5dc, lpBuffer=0x2734508*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2734508*, lpNumberOfBytesWritten=0x593f2c0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.073] CloseHandle (hObject=0x5dc) returned 1
	[0123.073] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", lpFilePart=0x0) returned 0x40
	[0123.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.074] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.008.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4346f4fe, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x83af3fe6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.074] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.008.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.008.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", lpFilePart=0x0) returned 0x40
	[0123.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.075] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.009.etl"), fInfoLevelId=0x0, lpFileInformation=0x273699c | out: lpFileInformation=0x273699c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x745a10f, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0x318cac0d, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1
	[0123.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", lpFilePart=0x0) returned 0x40
	[0123.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.076] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.009.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.076] GetFileType (hFile=0x5dc) returned 0x1
	[0123.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.076] GetFileType (hFile=0x5dc) returned 0x1
	[0123.076] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3000
	[0123.076] ReadFile (in: hFile=0x5dc, lpBuffer=0x2736c3c, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2736c3c*, lpNumberOfBytesRead=0x593f2cc*=0x3000, lpOverlapped=0x0) returned 1
	[0123.080] CloseHandle (hObject=0x5dc) returned 1
	[0123.080] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0123.080] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.080] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2739cd8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0123.080] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.080] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.080] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b2c0) returned 1
	[0123.081] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.081] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2739d90*=0x1, dwFlags=0x0) returned 1
	[0123.081] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2739d5c, dwFlags=0x0) returned 1
	[0123.081] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2739da0*, pdwDataLen=0x593f2d4*=0x3010, dwBufLen=0x3010 | out: pbData=0x2739da0*, pdwDataLen=0x593f2d4*=0x3010) returned 1
	[0123.081] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273cdbc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x273cdbc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.081] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0123.081] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.081] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.081] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", lpFilePart=0x0) returned 0x40
	[0123.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.081] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.009.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.083] GetFileType (hFile=0x5dc) returned 0x1
	[0123.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.083] GetFileType (hFile=0x5dc) returned 0x1
	[0123.083] WriteFile (in: hFile=0x5dc, lpBuffer=0x2739da0*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2739da0*, lpNumberOfBytesWritten=0x593f2c0*=0x3010, lpOverlapped=0x0) returned 1
	[0123.084] CloseHandle (hObject=0x5dc) returned 1
	[0123.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", lpFilePart=0x0) returned 0x40
	[0123.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.085] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.009.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x745a10f, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0x83b1a114, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1
	[0123.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.085] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.009.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.009.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.086] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", lpFilePart=0x0) returned 0x40
	[0123.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.086] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.010.etl"), fInfoLevelId=0x0, lpFileInformation=0x273d234 | out: lpFileInformation=0x273d234*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd59be406, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xd59be406, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0123.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.086] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", lpFilePart=0x0) returned 0x40
	[0123.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.087] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.010.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.087] GetFileType (hFile=0x5dc) returned 0x1
	[0123.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.087] GetFileType (hFile=0x5dc) returned 0x1
	[0123.087] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1000
	[0123.087] ReadFile (in: hFile=0x5dc, lpBuffer=0x273d4d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x273d4d4*, lpNumberOfBytesRead=0x593f2cc*=0x1000, lpOverlapped=0x0) returned 1
	[0123.096] CloseHandle (hObject=0x5dc) returned 1
	[0123.096] CryptDestroyKey (hKey=0x82b540) returned 1
	[0123.096] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.096] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273e570, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0123.096] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.096] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.096] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0123.096] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.096] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x273e628*=0x1, dwFlags=0x0) returned 1
	[0123.096] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x273e5f4, dwFlags=0x0) returned 1
	[0123.096] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273e638*, pdwDataLen=0x593f2d4*=0x1010, dwBufLen=0x1010 | out: pbData=0x273e638*, pdwDataLen=0x593f2d4*=0x1010) returned 1
	[0123.097] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273f654*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x273f654*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.097] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0123.097] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.097] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.097] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", lpFilePart=0x0) returned 0x40
	[0123.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.097] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.010.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.098] GetFileType (hFile=0x5dc) returned 0x1
	[0123.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.098] GetFileType (hFile=0x5dc) returned 0x1
	[0123.098] WriteFile (in: hFile=0x5dc, lpBuffer=0x273e638*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x273e638*, lpNumberOfBytesWritten=0x593f2c0*=0x1010, lpOverlapped=0x0) returned 1
	[0123.099] CloseHandle (hObject=0x5dc) returned 1
	[0123.100] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", lpFilePart=0x0) returned 0x40
	[0123.100] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.100] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.010.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd59be406, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x83b4033c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1010)) returned 1
	[0123.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.100] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.010.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.010.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.102] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", lpFilePart=0x0) returned 0x40
	[0123.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.102] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.011.etl"), fInfoLevelId=0x0, lpFileInformation=0x273facc | out: lpFileInformation=0x273facc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x198319d2, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3f449663, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.103] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", lpFilePart=0x0) returned 0x40
	[0123.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.103] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.011.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.103] GetFileType (hFile=0x5dc) returned 0x1
	[0123.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.103] GetFileType (hFile=0x5dc) returned 0x1
	[0123.103] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2000
	[0123.103] ReadFile (in: hFile=0x5dc, lpBuffer=0x273fd6c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x273fd6c*, lpNumberOfBytesRead=0x593f2cc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.113] CloseHandle (hObject=0x5dc) returned 1
	[0123.114] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0123.114] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.114] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2741e08, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b200) returned 1
	[0123.114] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.114] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.114] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0123.114] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.114] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2741ec0*=0x1, dwFlags=0x0) returned 1
	[0123.114] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2741e8c, dwFlags=0x0) returned 1
	[0123.114] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2741ed0*, pdwDataLen=0x593f2d4*=0x2010, dwBufLen=0x2010 | out: pbData=0x2741ed0*, pdwDataLen=0x593f2d4*=0x2010) returned 1
	[0123.114] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2743eec*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2743eec*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.114] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0123.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.115] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", lpFilePart=0x0) returned 0x40
	[0123.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.115] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.011.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.116] GetFileType (hFile=0x5dc) returned 0x1
	[0123.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.116] GetFileType (hFile=0x5dc) returned 0x1
	[0123.116] WriteFile (in: hFile=0x5dc, lpBuffer=0x2741ed0*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2741ed0*, lpNumberOfBytesWritten=0x593f2c0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.118] CloseHandle (hObject=0x5dc) returned 1
	[0123.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", lpFilePart=0x0) returned 0x40
	[0123.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.118] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.011.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x198319d2, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x83b665e8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.118] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.011.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.011.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.119] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", lpFilePart=0x0) returned 0x40
	[0123.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.119] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.012.etl"), fInfoLevelId=0x0, lpFileInformation=0x2744364 | out: lpFileInformation=0x2744364*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1c505b8c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x58b60423, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1
	[0123.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", lpFilePart=0x0) returned 0x40
	[0123.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.120] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.012.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.120] GetFileType (hFile=0x5dc) returned 0x1
	[0123.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.120] GetFileType (hFile=0x5dc) returned 0x1
	[0123.120] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3000
	[0123.120] ReadFile (in: hFile=0x5dc, lpBuffer=0x2744604, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2744604*, lpNumberOfBytesRead=0x593f2cc*=0x3000, lpOverlapped=0x0) returned 1
	[0123.127] CloseHandle (hObject=0x5dc) returned 1
	[0123.127] CryptDestroyKey (hKey=0x82b200) returned 1
	[0123.127] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.127] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27476a0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b080) returned 1
	[0123.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.128] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0123.128] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.128] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2747758*=0x1, dwFlags=0x0) returned 1
	[0123.128] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2747724, dwFlags=0x0) returned 1
	[0123.128] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2747768*, pdwDataLen=0x593f2d4*=0x3010, dwBufLen=0x3010 | out: pbData=0x2747768*, pdwDataLen=0x593f2d4*=0x3010) returned 1
	[0123.128] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274a784*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x274a784*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.128] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0123.128] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.128] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.128] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", lpFilePart=0x0) returned 0x40
	[0123.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.128] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.012.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.130] GetFileType (hFile=0x5dc) returned 0x1
	[0123.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.130] GetFileType (hFile=0x5dc) returned 0x1
	[0123.130] WriteFile (in: hFile=0x5dc, lpBuffer=0x2747768*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2747768*, lpNumberOfBytesWritten=0x593f2c0*=0x3010, lpOverlapped=0x0) returned 1
	[0123.131] CloseHandle (hObject=0x5dc) returned 1
	[0123.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", lpFilePart=0x0) returned 0x40
	[0123.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.132] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.012.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1c505b8c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83b8c7bb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1
	[0123.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.132] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.012.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.012.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.133] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", lpFilePart=0x0) returned 0x40
	[0123.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.133] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.013.etl"), fInfoLevelId=0x0, lpFileInformation=0x274abfc | out: lpFileInformation=0x274abfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdaf93ab4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x87be9f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1
	[0123.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.134] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", lpFilePart=0x0) returned 0x40
	[0123.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.134] ReadFile (in: hFile=0x5dc, lpBuffer=0x274ae9c, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x274ae9c*, lpNumberOfBytesRead=0x593f2cc*=0x3000, lpOverlapped=0x0) returned 1
	[0123.210] CryptDestroyKey (hKey=0x82b080) returned 1
	[0123.210] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.210] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274df38, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0123.211] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.211] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.211] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b200) returned 1
	[0123.211] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.211] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x274dff0*=0x1, dwFlags=0x0) returned 1
	[0123.211] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x274dfbc, dwFlags=0x0) returned 1
	[0123.211] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274e000*, pdwDataLen=0x593f2d4*=0x3010, dwBufLen=0x3010 | out: pbData=0x274e000*, pdwDataLen=0x593f2d4*=0x3010) returned 1
	[0123.211] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275101c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x275101c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.211] CryptDestroyKey (hKey=0x82b200) returned 1
	[0123.211] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.211] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", lpFilePart=0x0) returned 0x40
	[0123.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.211] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.013.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.213] GetFileType (hFile=0x5dc) returned 0x1
	[0123.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.213] GetFileType (hFile=0x5dc) returned 0x1
	[0123.213] WriteFile (in: hFile=0x5dc, lpBuffer=0x274e000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x274e000*, lpNumberOfBytesWritten=0x593f2c0*=0x3010, lpOverlapped=0x0) returned 1
	[0123.214] CloseHandle (hObject=0x5dc) returned 1
	[0123.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", lpFilePart=0x0) returned 0x40
	[0123.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.214] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.013.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdaf93ab4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x83c5cda5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1
	[0123.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.214] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.013.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.013.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.215] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", lpFilePart=0x0) returned 0x40
	[0123.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.215] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.014.etl"), fInfoLevelId=0x0, lpFileInformation=0x2751494 | out: lpFileInformation=0x2751494*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1977635c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1977635c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.221] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", lpFilePart=0x0) returned 0x40
	[0123.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.221] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.014.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.221] GetFileType (hFile=0x5dc) returned 0x1
	[0123.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.221] GetFileType (hFile=0x5dc) returned 0x1
	[0123.221] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2000
	[0123.222] ReadFile (in: hFile=0x5dc, lpBuffer=0x2751734, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2751734*, lpNumberOfBytesRead=0x593f2cc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.237] CloseHandle (hObject=0x5dc) returned 1
	[0123.237] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0123.237] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.237] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27537d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0123.237] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.237] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.237] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0123.237] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.237] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2753888*=0x1, dwFlags=0x0) returned 1
	[0123.238] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2753854, dwFlags=0x0) returned 1
	[0123.238] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2753898*, pdwDataLen=0x593f2d4*=0x2010, dwBufLen=0x2010 | out: pbData=0x2753898*, pdwDataLen=0x593f2d4*=0x2010) returned 1
	[0123.238] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27558b4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27558b4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.238] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0123.238] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.238] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.238] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", lpFilePart=0x0) returned 0x40
	[0123.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.238] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.014.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.239] GetFileType (hFile=0x5dc) returned 0x1
	[0123.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.240] GetFileType (hFile=0x5dc) returned 0x1
	[0123.240] WriteFile (in: hFile=0x5dc, lpBuffer=0x2753898*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2753898*, lpNumberOfBytesWritten=0x593f2c0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.241] CloseHandle (hObject=0x5dc) returned 1
	[0123.241] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", lpFilePart=0x0) returned 0x40
	[0123.241] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.241] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.014.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1977635c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x83c97865, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.241] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.014.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.014.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.242] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", lpFilePart=0x0) returned 0x40
	[0123.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.242] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.015.etl"), fInfoLevelId=0x0, lpFileInformation=0x2755d2c | out: lpFileInformation=0x2755d2c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfc820227, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0x2521b8a4, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1
	[0123.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.243] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", lpFilePart=0x0) returned 0x40
	[0123.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.243] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.015.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.243] GetFileType (hFile=0x5dc) returned 0x1
	[0123.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.243] GetFileType (hFile=0x5dc) returned 0x1
	[0123.243] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3000
	[0123.243] ReadFile (in: hFile=0x5dc, lpBuffer=0x2755fcc, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2755fcc*, lpNumberOfBytesRead=0x593f2cc*=0x3000, lpOverlapped=0x0) returned 1
	[0123.259] CloseHandle (hObject=0x5dc) returned 1
	[0123.260] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0123.260] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.260] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2759068, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0123.260] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.260] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.260] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0123.260] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.260] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2759120*=0x1, dwFlags=0x0) returned 1
	[0123.260] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27590ec, dwFlags=0x0) returned 1
	[0123.260] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2759130*, pdwDataLen=0x593f2d4*=0x3010, dwBufLen=0x3010 | out: pbData=0x2759130*, pdwDataLen=0x593f2d4*=0x3010) returned 1
	[0123.260] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275c14c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x275c14c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.261] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0123.261] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.261] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", lpFilePart=0x0) returned 0x40
	[0123.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.261] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.015.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.262] GetFileType (hFile=0x5dc) returned 0x1
	[0123.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.262] GetFileType (hFile=0x5dc) returned 0x1
	[0123.262] WriteFile (in: hFile=0x5dc, lpBuffer=0x2759130*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2759130*, lpNumberOfBytesWritten=0x593f2c0*=0x3010, lpOverlapped=0x0) returned 1
	[0123.264] CloseHandle (hObject=0x5dc) returned 1
	[0123.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", lpFilePart=0x0) returned 0x40
	[0123.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.264] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.015.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfc820227, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0x83cbdb11, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1
	[0123.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.265] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.015.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.015.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", lpFilePart=0x0) returned 0x40
	[0123.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.266] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.016.etl"), fInfoLevelId=0x0, lpFileInformation=0x275c5c4 | out: lpFileInformation=0x275c5c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd9caf15, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfd9caf15, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0123.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.268] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", lpFilePart=0x0) returned 0x40
	[0123.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.268] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.016.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.269] GetFileType (hFile=0x5dc) returned 0x1
	[0123.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.269] GetFileType (hFile=0x5dc) returned 0x1
	[0123.269] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1000
	[0123.269] ReadFile (in: hFile=0x5dc, lpBuffer=0x275c864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x275c864*, lpNumberOfBytesRead=0x593f2cc*=0x1000, lpOverlapped=0x0) returned 1
	[0123.287] CloseHandle (hObject=0x5dc) returned 1
	[0123.288] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0123.288] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.288] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275d900, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0123.288] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.288] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.288] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b2c0) returned 1
	[0123.288] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.288] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x275d9b8*=0x1, dwFlags=0x0) returned 1
	[0123.288] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x275d984, dwFlags=0x0) returned 1
	[0123.288] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275d9c8*, pdwDataLen=0x593f2d4*=0x1010, dwBufLen=0x1010 | out: pbData=0x275d9c8*, pdwDataLen=0x593f2d4*=0x1010) returned 1
	[0123.288] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275e9e4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x275e9e4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.288] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0123.288] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.289] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.289] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", lpFilePart=0x0) returned 0x40
	[0123.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.289] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.016.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.290] GetFileType (hFile=0x5dc) returned 0x1
	[0123.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.290] GetFileType (hFile=0x5dc) returned 0x1
	[0123.290] WriteFile (in: hFile=0x5dc, lpBuffer=0x275d9c8*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x275d9c8*, lpNumberOfBytesWritten=0x593f2c0*=0x1010, lpOverlapped=0x0) returned 1
	[0123.291] CloseHandle (hObject=0x5dc) returned 1
	[0123.292] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", lpFilePart=0x0) returned 0x40
	[0123.292] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.292] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.016.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd9caf15, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0x83d09f2e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1010)) returned 1
	[0123.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.292] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.016.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.016.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", lpFilePart=0x0) returned 0x40
	[0123.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.293] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.017.etl"), fInfoLevelId=0x0, lpFileInformation=0x275ee5c | out: lpFileInformation=0x275ee5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda210f79, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xb10a27a8, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x5000)) returned 1
	[0123.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", lpFilePart=0x0) returned 0x40
	[0123.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.294] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.017.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.294] GetFileType (hFile=0x5dc) returned 0x1
	[0123.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.294] GetFileType (hFile=0x5dc) returned 0x1
	[0123.294] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x5000
	[0123.294] ReadFile (in: hFile=0x5dc, lpBuffer=0x275f0fc, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x275f0fc*, lpNumberOfBytesRead=0x593f2cc*=0x5000, lpOverlapped=0x0) returned 1
	[0123.333] CloseHandle (hObject=0x5dc) returned 1
	[0123.333] CryptDestroyKey (hKey=0x82b280) returned 1
	[0123.333] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.333] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2764198, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b100) returned 1
	[0123.333] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.333] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.334] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0123.334] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.334] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2764250*=0x1, dwFlags=0x0) returned 1
	[0123.334] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x276421c, dwFlags=0x0) returned 1
	[0123.334] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2764260*, pdwDataLen=0x593f2d4*=0x5010, dwBufLen=0x5010 | out: pbData=0x2764260*, pdwDataLen=0x593f2d4*=0x5010) returned 1
	[0123.334] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276927c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x276927c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.334] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0123.334] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.334] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.334] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", lpFilePart=0x0) returned 0x40
	[0123.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.334] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.017.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.336] GetFileType (hFile=0x5dc) returned 0x1
	[0123.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.336] GetFileType (hFile=0x5dc) returned 0x1
	[0123.336] WriteFile (in: hFile=0x5dc, lpBuffer=0x2764260*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2764260*, lpNumberOfBytesWritten=0x593f2c0*=0x5010, lpOverlapped=0x0) returned 1
	[0123.338] CloseHandle (hObject=0x5dc) returned 1
	[0123.338] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", lpFilePart=0x0) returned 0x40
	[0123.338] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.338] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.017.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda210f79, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x83d7c58e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5010)) returned 1
	[0123.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.338] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.017.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.017.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.339] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", lpFilePart=0x0) returned 0x40
	[0123.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.339] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.018.etl"), fInfoLevelId=0x0, lpFileInformation=0x27696f4 | out: lpFileInformation=0x27696f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe0798fd2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x79d33ce, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.340] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", lpFilePart=0x0) returned 0x40
	[0123.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.340] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.018.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.340] GetFileType (hFile=0x5dc) returned 0x1
	[0123.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.340] GetFileType (hFile=0x5dc) returned 0x1
	[0123.340] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2000
	[0123.340] ReadFile (in: hFile=0x5dc, lpBuffer=0x2769994, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2769994*, lpNumberOfBytesRead=0x593f2cc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.423] CloseHandle (hObject=0x5dc) returned 1
	[0123.423] CryptDestroyKey (hKey=0x82b100) returned 1
	[0123.423] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.423] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276ba30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b480) returned 1
	[0123.423] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.423] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.423] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0123.423] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.423] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x276bae8*=0x1, dwFlags=0x0) returned 1
	[0123.423] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x276bab4, dwFlags=0x0) returned 1
	[0123.423] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276baf8*, pdwDataLen=0x593f2d4*=0x2010, dwBufLen=0x2010 | out: pbData=0x276baf8*, pdwDataLen=0x593f2d4*=0x2010) returned 1
	[0123.424] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276db14*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x276db14*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.424] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0123.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.424] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", lpFilePart=0x0) returned 0x40
	[0123.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.424] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.018.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.425] GetFileType (hFile=0x5dc) returned 0x1
	[0123.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.425] GetFileType (hFile=0x5dc) returned 0x1
	[0123.425] WriteFile (in: hFile=0x5dc, lpBuffer=0x276baf8*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x276baf8*, lpNumberOfBytesWritten=0x593f2c0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.427] CloseHandle (hObject=0x5dc) returned 1
	[0123.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", lpFilePart=0x0) returned 0x40
	[0123.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.427] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.018.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe0798fd2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x83e6142f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.427] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.018.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.018.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.428] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", lpFilePart=0x0) returned 0x40
	[0123.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.428] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.019.etl"), fInfoLevelId=0x0, lpFileInformation=0x276df8c | out: lpFileInformation=0x276df8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7a24386, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x56762f51, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
	[0123.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", lpFilePart=0x0) returned 0x40
	[0123.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.429] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.019.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.429] GetFileType (hFile=0x5dc) returned 0x1
	[0123.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.429] GetFileType (hFile=0x5dc) returned 0x1
	[0123.430] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4000
	[0123.430] ReadFile (in: hFile=0x5dc, lpBuffer=0x276e22c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x276e22c*, lpNumberOfBytesRead=0x593f2cc*=0x4000, lpOverlapped=0x0) returned 1
	[0123.445] CloseHandle (hObject=0x5dc) returned 1
	[0123.445] CryptDestroyKey (hKey=0x82b480) returned 1
	[0123.445] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.446] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27722c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0123.446] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.446] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.446] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0123.446] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.446] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2772380*=0x1, dwFlags=0x0) returned 1
	[0123.446] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x277234c, dwFlags=0x0) returned 1
	[0123.446] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2772390*, pdwDataLen=0x593f2d4*=0x4010, dwBufLen=0x4010 | out: pbData=0x2772390*, pdwDataLen=0x593f2d4*=0x4010) returned 1
	[0123.446] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27763ac*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27763ac*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.446] CryptDestroyKey (hKey=0x82b380) returned 1
	[0123.446] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.446] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.446] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", lpFilePart=0x0) returned 0x40
	[0123.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.447] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.019.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.448] GetFileType (hFile=0x5dc) returned 0x1
	[0123.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.448] GetFileType (hFile=0x5dc) returned 0x1
	[0123.448] WriteFile (in: hFile=0x5dc, lpBuffer=0x2772390*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2772390*, lpNumberOfBytesWritten=0x593f2c0*=0x4010, lpOverlapped=0x0) returned 1
	[0123.449] CloseHandle (hObject=0x5dc) returned 1
	[0123.450] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", lpFilePart=0x0) returned 0x40
	[0123.450] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.450] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.019.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7a24386, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x83e876d6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4010)) returned 1
	[0123.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.450] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.019.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.019.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.451] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", lpFilePart=0x0) returned 0x40
	[0123.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.451] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.020.etl"), fInfoLevelId=0x0, lpFileInformation=0x2776824 | out: lpFileInformation=0x2776824*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1fc4717b, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x46bc7f04, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.452] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", lpFilePart=0x0) returned 0x40
	[0123.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.452] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.020.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.452] GetFileType (hFile=0x5dc) returned 0x1
	[0123.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.452] GetFileType (hFile=0x5dc) returned 0x1
	[0123.452] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2000
	[0123.452] ReadFile (in: hFile=0x5dc, lpBuffer=0x2776ac4, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2776ac4*, lpNumberOfBytesRead=0x593f2cc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.462] CloseHandle (hObject=0x5dc) returned 1
	[0123.462] CryptDestroyKey (hKey=0x82b340) returned 1
	[0123.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.462] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2778b60, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0123.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.462] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0123.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.463] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2778c18*=0x1, dwFlags=0x0) returned 1
	[0123.463] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2778be4, dwFlags=0x0) returned 1
	[0123.463] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2778c28*, pdwDataLen=0x593f2d4*=0x2010, dwBufLen=0x2010 | out: pbData=0x2778c28*, pdwDataLen=0x593f2d4*=0x2010) returned 1
	[0123.463] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277ac44*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x277ac44*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.463] CryptDestroyKey (hKey=0x82b380) returned 1
	[0123.463] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.463] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.463] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", lpFilePart=0x0) returned 0x40
	[0123.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.463] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.020.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.465] GetFileType (hFile=0x5dc) returned 0x1
	[0123.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.465] GetFileType (hFile=0x5dc) returned 0x1
	[0123.465] WriteFile (in: hFile=0x5dc, lpBuffer=0x2778c28*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2778c28*, lpNumberOfBytesWritten=0x593f2c0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.466] CloseHandle (hObject=0x5dc) returned 1
	[0123.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", lpFilePart=0x0) returned 0x40
	[0123.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.466] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.020.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1fc4717b, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x83ead95d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.467] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.020.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.020.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", lpFilePart=0x0) returned 0x40
	[0123.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.468] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.021.etl"), fInfoLevelId=0x0, lpFileInformation=0x277b0bc | out: lpFileInformation=0x277b0bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x22cb9437, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x911dff9b, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1
	[0123.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", lpFilePart=0x0) returned 0x40
	[0123.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.469] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.021.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.469] GetFileType (hFile=0x5dc) returned 0x1
	[0123.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.469] GetFileType (hFile=0x5dc) returned 0x1
	[0123.469] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3000
	[0123.469] ReadFile (in: hFile=0x5dc, lpBuffer=0x277b35c, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x277b35c*, lpNumberOfBytesRead=0x593f2cc*=0x3000, lpOverlapped=0x0) returned 1
	[0123.478] CloseHandle (hObject=0x5dc) returned 1
	[0123.478] CryptDestroyKey (hKey=0x82b280) returned 1
	[0123.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.478] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277e3f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0123.478] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.478] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.478] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0123.478] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.478] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x277e4b0*=0x1, dwFlags=0x0) returned 1
	[0123.478] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x277e47c, dwFlags=0x0) returned 1
	[0123.478] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277e4c0*, pdwDataLen=0x593f2d4*=0x3010, dwBufLen=0x3010 | out: pbData=0x277e4c0*, pdwDataLen=0x593f2d4*=0x3010) returned 1
	[0123.479] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27814dc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27814dc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.479] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0123.479] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.479] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.479] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", lpFilePart=0x0) returned 0x40
	[0123.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.479] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.021.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.480] GetFileType (hFile=0x5dc) returned 0x1
	[0123.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.480] GetFileType (hFile=0x5dc) returned 0x1
	[0123.480] WriteFile (in: hFile=0x5dc, lpBuffer=0x277e4c0*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x277e4c0*, lpNumberOfBytesWritten=0x593f2c0*=0x3010, lpOverlapped=0x0) returned 1
	[0123.482] CloseHandle (hObject=0x5dc) returned 1
	[0123.482] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", lpFilePart=0x0) returned 0x40
	[0123.482] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.482] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.021.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x22cb9437, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x83ed3c58, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1
	[0123.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.483] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.021.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.021.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", lpFilePart=0x0) returned 0x40
	[0123.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.484] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.022.etl"), fInfoLevelId=0x0, lpFileInformation=0x2781954 | out: lpFileInformation=0x2781954*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8f4581c2, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0xb62eafb0, ftLastWriteTime.dwHighDateTime=0x1d327b9, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.484] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", lpFilePart=0x0) returned 0x40
	[0123.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.484] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.022.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.484] GetFileType (hFile=0x5dc) returned 0x1
	[0123.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.485] GetFileType (hFile=0x5dc) returned 0x1
	[0123.485] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2000
	[0123.485] ReadFile (in: hFile=0x5dc, lpBuffer=0x2781bf4, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2781bf4*, lpNumberOfBytesRead=0x593f2cc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.500] CloseHandle (hObject=0x5dc) returned 1
	[0123.500] CryptDestroyKey (hKey=0x82b540) returned 1
	[0123.500] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.500] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2783c90, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0123.500] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.501] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.501] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0123.501] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.501] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2783d48*=0x1, dwFlags=0x0) returned 1
	[0123.501] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2783d14, dwFlags=0x0) returned 1
	[0123.501] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2783d58*, pdwDataLen=0x593f2d4*=0x2010, dwBufLen=0x2010 | out: pbData=0x2783d58*, pdwDataLen=0x593f2d4*=0x2010) returned 1
	[0123.501] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2785d74*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2785d74*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.501] CryptDestroyKey (hKey=0x82b280) returned 1
	[0123.501] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.501] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.501] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", lpFilePart=0x0) returned 0x40
	[0123.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.501] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.022.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.503] GetFileType (hFile=0x5dc) returned 0x1
	[0123.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.503] GetFileType (hFile=0x5dc) returned 0x1
	[0123.503] WriteFile (in: hFile=0x5dc, lpBuffer=0x2783d58*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2783d58*, lpNumberOfBytesWritten=0x593f2c0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.504] CloseHandle (hObject=0x5dc) returned 1
	[0123.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", lpFilePart=0x0) returned 0x40
	[0123.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.505] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.022.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8f4581c2, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0x83f20049, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.505] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.022.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.022.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.506] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", lpFilePart=0x0) returned 0x40
	[0123.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.506] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.023.etl"), fInfoLevelId=0x0, lpFileInformation=0x27861ec | out: lpFileInformation=0x27861ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f83b96b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x82808de1, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.507] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", lpFilePart=0x0) returned 0x40
	[0123.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.507] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.023.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.507] GetFileType (hFile=0x5dc) returned 0x1
	[0123.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.507] GetFileType (hFile=0x5dc) returned 0x1
	[0123.507] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2000
	[0123.507] ReadFile (in: hFile=0x5dc, lpBuffer=0x278648c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x278648c*, lpNumberOfBytesRead=0x593f2cc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.509] CloseHandle (hObject=0x5dc) returned 1
	[0123.509] CryptDestroyKey (hKey=0x82b300) returned 1
	[0123.509] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.509] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2788528, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0123.509] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.509] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.509] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b300) returned 1
	[0123.509] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.509] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27885e0*=0x1, dwFlags=0x0) returned 1
	[0123.510] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27885ac, dwFlags=0x0) returned 1
	[0123.510] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27885f0*, pdwDataLen=0x593f2d4*=0x2010, dwBufLen=0x2010 | out: pbData=0x27885f0*, pdwDataLen=0x593f2d4*=0x2010) returned 1
	[0123.510] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278a60c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x278a60c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.510] CryptDestroyKey (hKey=0x82b300) returned 1
	[0123.510] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.510] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.510] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", lpFilePart=0x0) returned 0x40
	[0123.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.510] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.023.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.511] GetFileType (hFile=0x5dc) returned 0x1
	[0123.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.512] GetFileType (hFile=0x5dc) returned 0x1
	[0123.512] WriteFile (in: hFile=0x5dc, lpBuffer=0x27885f0*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27885f0*, lpNumberOfBytesWritten=0x593f2c0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.513] CloseHandle (hObject=0x5dc) returned 1
	[0123.513] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", lpFilePart=0x0) returned 0x40
	[0123.513] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.513] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.023.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f83b96b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x83f20049, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.514] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.023.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.023.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", lpFilePart=0x0) returned 0x40
	[0123.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.515] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.024.etl"), fInfoLevelId=0x0, lpFileInformation=0x278aa84 | out: lpFileInformation=0x278aa84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcae2810e, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xf21e09d1, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", lpFilePart=0x0) returned 0x40
	[0123.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.515] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.024.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.516] GetFileType (hFile=0x5dc) returned 0x1
	[0123.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.516] GetFileType (hFile=0x5dc) returned 0x1
	[0123.516] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2000
	[0123.516] ReadFile (in: hFile=0x5dc, lpBuffer=0x278ad24, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x278ad24*, lpNumberOfBytesRead=0x593f2cc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.520] CloseHandle (hObject=0x5dc) returned 1
	[0123.520] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0123.520] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.520] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278cdc0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b380) returned 1
	[0123.520] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.520] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.520] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0123.520] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.520] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x278ce78*=0x1, dwFlags=0x0) returned 1
	[0123.521] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x278ce44, dwFlags=0x0) returned 1
	[0123.521] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278ce88*, pdwDataLen=0x593f2d4*=0x2010, dwBufLen=0x2010 | out: pbData=0x278ce88*, pdwDataLen=0x593f2d4*=0x2010) returned 1
	[0123.521] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278eea4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x278eea4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.521] CryptDestroyKey (hKey=0x82b280) returned 1
	[0123.521] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.521] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", lpFilePart=0x0) returned 0x40
	[0123.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.521] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.024.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.522] GetFileType (hFile=0x5dc) returned 0x1
	[0123.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.523] GetFileType (hFile=0x5dc) returned 0x1
	[0123.523] WriteFile (in: hFile=0x5dc, lpBuffer=0x278ce88*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x278ce88*, lpNumberOfBytesWritten=0x593f2c0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.524] CloseHandle (hObject=0x5dc) returned 1
	[0123.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", lpFilePart=0x0) returned 0x40
	[0123.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.524] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.024.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcae2810e, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x83f4628e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.525] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.024.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.024.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.525] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", lpFilePart=0x0) returned 0x40
	[0123.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.526] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.025.etl"), fInfoLevelId=0x0, lpFileInformation=0x278f31c | out: lpFileInformation=0x278f31c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcd491119, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x2e5f9ec7, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
	[0123.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.526] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", lpFilePart=0x0) returned 0x40
	[0123.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.526] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.025.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.526] GetFileType (hFile=0x5dc) returned 0x1
	[0123.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.526] GetFileType (hFile=0x5dc) returned 0x1
	[0123.526] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4000
	[0123.527] ReadFile (in: hFile=0x5dc, lpBuffer=0x278f5bc, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x278f5bc*, lpNumberOfBytesRead=0x593f2cc*=0x4000, lpOverlapped=0x0) returned 1
	[0123.532] CloseHandle (hObject=0x5dc) returned 1
	[0123.532] CryptDestroyKey (hKey=0x82b380) returned 1
	[0123.533] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.533] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2793658, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0123.533] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.533] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.533] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0123.533] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.533] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2793710*=0x1, dwFlags=0x0) returned 1
	[0123.533] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27936dc, dwFlags=0x0) returned 1
	[0123.533] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2793720*, pdwDataLen=0x593f2d4*=0x4010, dwBufLen=0x4010 | out: pbData=0x2793720*, pdwDataLen=0x593f2d4*=0x4010) returned 1
	[0123.533] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279773c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x279773c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.533] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0123.533] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.533] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.534] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", lpFilePart=0x0) returned 0x40
	[0123.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.534] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.025.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.535] GetFileType (hFile=0x5dc) returned 0x1
	[0123.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.535] GetFileType (hFile=0x5dc) returned 0x1
	[0123.535] WriteFile (in: hFile=0x5dc, lpBuffer=0x2793720*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2793720*, lpNumberOfBytesWritten=0x593f2c0*=0x4010, lpOverlapped=0x0) returned 1
	[0123.537] CloseHandle (hObject=0x5dc) returned 1
	[0123.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", lpFilePart=0x0) returned 0x40
	[0123.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.537] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.025.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcd491119, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x83f6c514, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4010)) returned 1
	[0123.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.537] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.025.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.025.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.538] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", lpFilePart=0x0) returned 0x40
	[0123.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.538] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.026.etl"), fInfoLevelId=0x0, lpFileInformation=0x2797bb4 | out: lpFileInformation=0x2797bb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb30910b4, ftLastAccessTime.dwHighDateTime=0x1d3278b, ftLastWriteTime.dwLowDateTime=0xe1a1828d, ftLastWriteTime.dwHighDateTime=0x1d3278b, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
	[0123.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.539] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", lpFilePart=0x0) returned 0x40
	[0123.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.539] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.026.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.539] GetFileType (hFile=0x5dc) returned 0x1
	[0123.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.539] GetFileType (hFile=0x5dc) returned 0x1
	[0123.539] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4000
	[0123.540] ReadFile (in: hFile=0x5dc, lpBuffer=0x2797e54, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2797e54*, lpNumberOfBytesRead=0x593f2cc*=0x4000, lpOverlapped=0x0) returned 1
	[0123.578] CloseHandle (hObject=0x5dc) returned 1
	[0123.578] CryptDestroyKey (hKey=0x82b340) returned 1
	[0123.578] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.578] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279bef0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0123.578] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.578] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.578] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0123.579] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.579] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x279bfa8*=0x1, dwFlags=0x0) returned 1
	[0123.579] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x279bf74, dwFlags=0x0) returned 1
	[0123.579] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279bfb8*, pdwDataLen=0x593f2d4*=0x4010, dwBufLen=0x4010 | out: pbData=0x279bfb8*, pdwDataLen=0x593f2d4*=0x4010) returned 1
	[0123.579] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279ffd4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x279ffd4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.579] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0123.579] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.579] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.579] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", lpFilePart=0x0) returned 0x40
	[0123.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.579] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.026.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.581] GetFileType (hFile=0x5dc) returned 0x1
	[0123.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.581] GetFileType (hFile=0x5dc) returned 0x1
	[0123.581] WriteFile (in: hFile=0x5dc, lpBuffer=0x279bfb8*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x279bfb8*, lpNumberOfBytesWritten=0x593f2c0*=0x4010, lpOverlapped=0x0) returned 1
	[0123.582] CloseHandle (hObject=0x5dc) returned 1
	[0123.582] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", lpFilePart=0x0) returned 0x40
	[0123.582] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.583] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.026.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb30910b4, ftLastAccessTime.dwHighDateTime=0x1d3278b, ftLastWriteTime.dwLowDateTime=0x83fdec62, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4010)) returned 1
	[0123.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.583] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.026.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.026.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.584] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", lpFilePart=0x0) returned 0x40
	[0123.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.584] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.027.etl"), fInfoLevelId=0x0, lpFileInformation=0x27a044c | out: lpFileInformation=0x27a044c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbda7099b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xe19a12b7, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.584] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", lpFilePart=0x0) returned 0x40
	[0123.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.585] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.027.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.585] GetFileType (hFile=0x5dc) returned 0x1
	[0123.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.585] GetFileType (hFile=0x5dc) returned 0x1
	[0123.585] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2000
	[0123.585] ReadFile (in: hFile=0x5dc, lpBuffer=0x27a06ec, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27a06ec*, lpNumberOfBytesRead=0x593f2cc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.593] CloseHandle (hObject=0x5dc) returned 1
	[0123.593] CryptDestroyKey (hKey=0x82b400) returned 1
	[0123.593] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.593] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a2788, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b200) returned 1
	[0123.594] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.594] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.594] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b040) returned 1
	[0123.594] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.594] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x27a2840*=0x1, dwFlags=0x0) returned 1
	[0123.594] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x27a280c, dwFlags=0x0) returned 1
	[0123.594] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a2850*, pdwDataLen=0x593f2d4*=0x2010, dwBufLen=0x2010 | out: pbData=0x27a2850*, pdwDataLen=0x593f2d4*=0x2010) returned 1
	[0123.594] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a486c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27a486c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.594] CryptDestroyKey (hKey=0x82b040) returned 1
	[0123.594] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.594] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", lpFilePart=0x0) returned 0x40
	[0123.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.594] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.027.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.596] GetFileType (hFile=0x5dc) returned 0x1
	[0123.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.596] GetFileType (hFile=0x5dc) returned 0x1
	[0123.596] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a2850*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27a2850*, lpNumberOfBytesWritten=0x593f2c0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.597] CloseHandle (hObject=0x5dc) returned 1
	[0123.597] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", lpFilePart=0x0) returned 0x40
	[0123.597] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.598] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.027.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbda7099b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x84004cdc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.598] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.027.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.027.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.599] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", lpFilePart=0x0) returned 0x40
	[0123.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.599] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.028.etl"), fInfoLevelId=0x0, lpFileInformation=0x27a4ce4 | out: lpFileInformation=0x27a4ce4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa972a1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x266bdfb9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.599] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", lpFilePart=0x0) returned 0x40
	[0123.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.599] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.028.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.600] GetFileType (hFile=0x5dc) returned 0x1
	[0123.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.600] GetFileType (hFile=0x5dc) returned 0x1
	[0123.600] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2000
	[0123.600] ReadFile (in: hFile=0x5dc, lpBuffer=0x27a4f84, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27a4f84*, lpNumberOfBytesRead=0x593f2cc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.601] CloseHandle (hObject=0x5dc) returned 1
	[0123.602] CryptDestroyKey (hKey=0x82b200) returned 1
	[0123.602] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.602] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a7020, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0123.602] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.602] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.602] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0123.602] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.602] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27a70d8*=0x1, dwFlags=0x0) returned 1
	[0123.602] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27a70a4, dwFlags=0x0) returned 1
	[0123.602] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a70e8*, pdwDataLen=0x593f2d4*=0x2010, dwBufLen=0x2010 | out: pbData=0x27a70e8*, pdwDataLen=0x593f2d4*=0x2010) returned 1
	[0123.602] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a9104*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27a9104*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.602] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0123.603] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.603] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.603] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", lpFilePart=0x0) returned 0x40
	[0123.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.603] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.028.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.604] GetFileType (hFile=0x5dc) returned 0x1
	[0123.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.604] GetFileType (hFile=0x5dc) returned 0x1
	[0123.604] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a70e8*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27a70e8*, lpNumberOfBytesWritten=0x593f2c0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.605] CloseHandle (hObject=0x5dc) returned 1
	[0123.606] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", lpFilePart=0x0) returned 0x40
	[0123.606] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6f
	[0123.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.606] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.028.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa972a1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x84004cdc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.606] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.028.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.028.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.607] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl", lpFilePart=0x0) returned 0x2e
	[0123.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.607] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.001.etl"), fInfoLevelId=0x0, lpFileInformation=0x27a957c | out: lpFileInformation=0x27a957c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x8243765a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x889a9e61, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0123.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.607] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl", lpFilePart=0x0) returned 0x2e
	[0123.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.608] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.001.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.608] GetFileType (hFile=0x5dc) returned 0x1
	[0123.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.608] GetFileType (hFile=0x5dc) returned 0x1
	[0123.608] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2000
	[0123.608] ReadFile (in: hFile=0x5dc, lpBuffer=0x27a978c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27a978c*, lpNumberOfBytesRead=0x593f2cc*=0x2000, lpOverlapped=0x0) returned 1
	[0123.616] CloseHandle (hObject=0x5dc) returned 1
	[0123.617] CryptDestroyKey (hKey=0x82b540) returned 1
	[0123.617] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.617] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ab828, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0123.617] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.617] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.617] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0123.617] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.617] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27ab8e0*=0x1, dwFlags=0x0) returned 1
	[0123.617] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27ab8ac, dwFlags=0x0) returned 1
	[0123.617] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ab8f0*, pdwDataLen=0x593f2d4*=0x2010, dwBufLen=0x2010 | out: pbData=0x27ab8f0*, pdwDataLen=0x593f2d4*=0x2010) returned 1
	[0123.617] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ad90c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27ad90c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.618] CryptDestroyKey (hKey=0x82b280) returned 1
	[0123.618] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.618] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.618] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl", lpFilePart=0x0) returned 0x2e
	[0123.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.618] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.001.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.619] GetFileType (hFile=0x5dc) returned 0x1
	[0123.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.619] GetFileType (hFile=0x5dc) returned 0x1
	[0123.619] WriteFile (in: hFile=0x5dc, lpBuffer=0x27ab8f0*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27ab8f0*, lpNumberOfBytesWritten=0x593f2c0*=0x2010, lpOverlapped=0x0) returned 1
	[0123.620] CloseHandle (hObject=0x5dc) returned 1
	[0123.621] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl", lpFilePart=0x0) returned 0x2e
	[0123.621] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0123.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.621] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.001.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x8243765a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x8402b13a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1
	[0123.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.621] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.001.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.001.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.622] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl", lpFilePart=0x0) returned 0x2e
	[0123.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.622] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.002.etl"), fInfoLevelId=0x0, lpFileInformation=0x27adcac | out: lpFileInformation=0x27adcac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x6fa4f40f, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x7e0bea63, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1
	[0123.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.623] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl", lpFilePart=0x0) returned 0x2e
	[0123.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.623] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.002.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.650] GetFileType (hFile=0x5dc) returned 0x1
	[0123.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.650] GetFileType (hFile=0x5dc) returned 0x1
	[0123.650] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3000
	[0123.650] ReadFile (in: hFile=0x5dc, lpBuffer=0x27adebc, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27adebc*, lpNumberOfBytesRead=0x593f2cc*=0x3000, lpOverlapped=0x0) returned 1
	[0123.657] CloseHandle (hObject=0x5dc) returned 1
	[0123.657] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0123.657] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.657] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b0f58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0123.657] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.657] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.657] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0123.657] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.657] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27b1010*=0x1, dwFlags=0x0) returned 1
	[0123.658] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27b0fdc, dwFlags=0x0) returned 1
	[0123.658] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b1020*, pdwDataLen=0x593f2d4*=0x3010, dwBufLen=0x3010 | out: pbData=0x27b1020*, pdwDataLen=0x593f2d4*=0x3010) returned 1
	[0123.658] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b403c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27b403c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.658] CryptDestroyKey (hKey=0x82b540) returned 1
	[0123.658] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.658] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.658] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl", lpFilePart=0x0) returned 0x2e
	[0123.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.658] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.002.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.659] GetFileType (hFile=0x5dc) returned 0x1
	[0123.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.660] GetFileType (hFile=0x5dc) returned 0x1
	[0123.660] WriteFile (in: hFile=0x5dc, lpBuffer=0x27b1020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27b1020*, lpNumberOfBytesWritten=0x593f2c0*=0x3010, lpOverlapped=0x0) returned 1
	[0123.661] CloseHandle (hObject=0x5dc) returned 1
	[0123.661] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl", lpFilePart=0x0) returned 0x2e
	[0123.661] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0123.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.661] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.002.etl"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x6fa4f40f, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x8409d844, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1
	[0123.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.662] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.002.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.002.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.663] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", lpFilePart=0x0) returned 0x81
	[0123.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.663] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), fInfoLevelId=0x0, lpFileInformation=0x27b43dc | out: lpFileInformation=0x27b43dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.664] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", lpFilePart=0x0) returned 0x7d
	[0123.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), fInfoLevelId=0x0, lpFileInformation=0x27b49c0 | out: lpFileInformation=0x27b49c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.666] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", lpFilePart=0x0) returned 0x80
	[0123.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.666] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), fInfoLevelId=0x0, lpFileInformation=0x27b501c | out: lpFileInformation=0x27b501c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.668] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", lpFilePart=0x0) returned 0x61
	[0123.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.668] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), fInfoLevelId=0x0, lpFileInformation=0x27b5524 | out: lpFileInformation=0x27b5524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0123.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x27b5974 | out: lpFileInformation=0x27b5974*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c)) returned 1
	[0123.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0123.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.671] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.671] GetFileType (hFile=0x5dc) returned 0x1
	[0123.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.671] GetFileType (hFile=0x5dc) returned 0x1
	[0123.671] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x19c
	[0123.671] ReadFile (in: hFile=0x5dc, lpBuffer=0x27b5cec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27b5cec*, lpNumberOfBytesRead=0x593f2cc*=0x19c, lpOverlapped=0x0) returned 1
	[0123.672] CloseHandle (hObject=0x5dc) returned 1
	[0123.672] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0123.672] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.673] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b6d88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b440) returned 1
	[0123.673] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.673] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.673] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b2c0) returned 1
	[0123.673] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.673] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x27b6e40*=0x1, dwFlags=0x0) returned 1
	[0123.673] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x27b6e0c, dwFlags=0x0) returned 1
	[0123.673] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b6e50*, pdwDataLen=0x593f2d4*=0x1a0, dwBufLen=0x1a0 | out: pbData=0x27b6e50*, pdwDataLen=0x593f2d4*=0x1a0) returned 1
	[0123.673] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b6ffc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27b6ffc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.673] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0123.673] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.673] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.673] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0123.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.674] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0123.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0123.676] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg", lpFilePart=0x0) returned 0x20
	[0123.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.676] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\-fd4.jpg"), fInfoLevelId=0x0, lpFileInformation=0x27b74e4 | out: lpFileInformation=0x27b74e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff0f2840, ftCreationTime.dwHighDateTime=0x1d4ce61, ftLastAccessTime.dwLowDateTime=0x24e06720, ftLastAccessTime.dwHighDateTime=0x1d4c695, ftLastWriteTime.dwLowDateTime=0x24e06720, ftLastWriteTime.dwHighDateTime=0x1d4c695, nFileSizeHigh=0x0, nFileSizeLow=0x13fce)) returned 1
	[0123.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.676] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg", lpFilePart=0x0) returned 0x20
	[0123.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.676] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\-fd4.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.677] GetFileType (hFile=0x5dc) returned 0x1
	[0123.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.677] GetFileType (hFile=0x5dc) returned 0x1
	[0123.677] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x13fce
	[0123.677] ReadFile (in: hFile=0x5dc, lpBuffer=0x27b769c, nNumberOfBytesToRead=0x13fce, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27b769c*, lpNumberOfBytesRead=0x593f2cc*=0x13fce, lpOverlapped=0x0) returned 1
	[0123.678] CloseHandle (hObject=0x5dc) returned 1
	[0123.678] CryptDestroyKey (hKey=0x82b440) returned 1
	[0123.678] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.678] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27cb708, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b440) returned 1
	[0123.678] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.678] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.679] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0123.679] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.679] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27cb7c0*=0x1, dwFlags=0x0) returned 1
	[0123.679] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27cb78c, dwFlags=0x0) returned 1
	[0123.679] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27cb7d0*, pdwDataLen=0x593f2d4*=0x13fd0, dwBufLen=0x13fd0 | out: pbData=0x27cb7d0*, pdwDataLen=0x593f2d4*=0x13fd0) returned 1
	[0123.679] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27df7ac*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27df7ac*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.679] CryptDestroyKey (hKey=0x82b340) returned 1
	[0123.679] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.679] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.679] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg", lpFilePart=0x0) returned 0x20
	[0123.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.679] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\-fd4.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.681] GetFileType (hFile=0x5dc) returned 0x1
	[0123.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.681] GetFileType (hFile=0x5dc) returned 0x1
	[0123.681] WriteFile (in: hFile=0x5dc, lpBuffer=0x27cb7d0*, nNumberOfBytesToWrite=0x13fd0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27cb7d0*, lpNumberOfBytesWritten=0x593f2c0*=0x13fd0, lpOverlapped=0x0) returned 1
	[0123.684] CloseHandle (hObject=0x5dc) returned 1
	[0123.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg", lpFilePart=0x0) returned 0x20
	[0123.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x4f
	[0123.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.684] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\-fd4.jpg"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff0f2840, ftCreationTime.dwHighDateTime=0x1d4ce61, ftLastAccessTime.dwLowDateTime=0x24e06720, ftLastAccessTime.dwHighDateTime=0x1d4c695, ftLastWriteTime.dwLowDateTime=0x840c3b15, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13fd0)) returned 1
	[0123.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.684] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\-fd4.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-Fd4.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\-fd4.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.685] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp", lpFilePart=0x0) returned 0x2c
	[0123.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.685] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\1jyycyb1j0us8yyh.odp"), fInfoLevelId=0x0, lpFileInformation=0x27dfab0 | out: lpFileInformation=0x27dfab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c226fc0, ftCreationTime.dwHighDateTime=0x1d4c587, ftLastAccessTime.dwLowDateTime=0xc6458b00, ftLastAccessTime.dwHighDateTime=0x1d4c6df, ftLastWriteTime.dwLowDateTime=0xc6458b00, ftLastWriteTime.dwHighDateTime=0x1d4c6df, nFileSizeHigh=0x0, nFileSizeLow=0x7936)) returned 1
	[0123.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.686] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp", lpFilePart=0x0) returned 0x2c
	[0123.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.686] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\1jyycyb1j0us8yyh.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.686] GetFileType (hFile=0x5dc) returned 0x1
	[0123.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.686] GetFileType (hFile=0x5dc) returned 0x1
	[0123.686] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x7936
	[0123.687] ReadFile (in: hFile=0x5dc, lpBuffer=0x27dfcc8, nNumberOfBytesToRead=0x7936, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27dfcc8*, lpNumberOfBytesRead=0x593f2cc*=0x7936, lpOverlapped=0x0) returned 1
	[0123.688] CloseHandle (hObject=0x5dc) returned 1
	[0123.688] CryptDestroyKey (hKey=0x82b440) returned 1
	[0123.688] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.688] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e769c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0123.688] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.688] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.688] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0123.688] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.688] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27e7754*=0x1, dwFlags=0x0) returned 1
	[0123.688] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27e7720, dwFlags=0x0) returned 1
	[0123.688] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e7764*, pdwDataLen=0x593f2d4*=0x7940, dwBufLen=0x7940 | out: pbData=0x27e7764*, pdwDataLen=0x593f2d4*=0x7940) returned 1
	[0123.688] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ef0b0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27ef0b0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.689] CryptDestroyKey (hKey=0x82b380) returned 1
	[0123.689] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.689] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.689] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp", lpFilePart=0x0) returned 0x2c
	[0123.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.689] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\1jyycyb1j0us8yyh.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.690] GetFileType (hFile=0x5dc) returned 0x1
	[0123.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.690] GetFileType (hFile=0x5dc) returned 0x1
	[0123.691] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e7764*, nNumberOfBytesToWrite=0x7940, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27e7764*, lpNumberOfBytesWritten=0x593f2c0*=0x7940, lpOverlapped=0x0) returned 1
	[0123.692] CloseHandle (hObject=0x5dc) returned 1
	[0123.692] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp", lpFilePart=0x0) returned 0x2c
	[0123.692] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0123.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.692] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\1jyycyb1j0us8yyh.odp"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c226fc0, ftCreationTime.dwHighDateTime=0x1d4c587, ftLastAccessTime.dwLowDateTime=0xc6458b00, ftLastAccessTime.dwHighDateTime=0x1d4c6df, ftLastWriteTime.dwLowDateTime=0x840e9d3d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7940)) returned 1
	[0123.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.693] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\1jyycyb1j0us8yyh.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\1jyyCyb1J0US8YYH.odp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\1jyycyb1j0us8yyh.odp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.697] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf", lpFilePart=0x0) returned 0x2f
	[0123.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.697] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\3arfqccqffvv7a3vj_l.pdf"), fInfoLevelId=0x0, lpFileInformation=0x27ef444 | out: lpFileInformation=0x27ef444*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f519bf0, ftCreationTime.dwHighDateTime=0x1d4cfae, ftLastAccessTime.dwLowDateTime=0xdeef630, ftLastAccessTime.dwHighDateTime=0x1d4cb9f, ftLastWriteTime.dwLowDateTime=0xdeef630, ftLastWriteTime.dwHighDateTime=0x1d4cb9f, nFileSizeHigh=0x0, nFileSizeLow=0xdda7)) returned 1
	[0123.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf", lpFilePart=0x0) returned 0x2f
	[0123.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.698] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\3arfqccqffvv7a3vj_l.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.698] GetFileType (hFile=0x5dc) returned 0x1
	[0123.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.698] GetFileType (hFile=0x5dc) returned 0x1
	[0123.698] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xdda7
	[0123.699] ReadFile (in: hFile=0x5dc, lpBuffer=0x27ef66c, nNumberOfBytesToRead=0xdda7, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27ef66c*, lpNumberOfBytesRead=0x593f2cc*=0xdda7, lpOverlapped=0x0) returned 1
	[0123.700] CloseHandle (hObject=0x5dc) returned 1
	[0123.700] CryptDestroyKey (hKey=0x82b340) returned 1
	[0123.700] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.700] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fd4b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b440) returned 1
	[0123.700] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.700] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.700] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0123.700] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.700] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27fd568*=0x1, dwFlags=0x0) returned 1
	[0123.700] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27fd534, dwFlags=0x0) returned 1
	[0123.701] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27fd578*, pdwDataLen=0x593f2d4*=0xddb0, dwBufLen=0xddb0 | out: pbData=0x27fd578*, pdwDataLen=0x593f2d4*=0xddb0) returned 1
	[0123.701] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x280b334*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x280b334*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.701] CryptDestroyKey (hKey=0x82b340) returned 1
	[0123.701] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.701] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.701] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf", lpFilePart=0x0) returned 0x2f
	[0123.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.701] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\3arfqccqffvv7a3vj_l.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.764] GetFileType (hFile=0x5dc) returned 0x1
	[0123.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.764] GetFileType (hFile=0x5dc) returned 0x1
	[0123.764] WriteFile (in: hFile=0x5dc, lpBuffer=0x27fd578*, nNumberOfBytesToWrite=0xddb0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27fd578*, lpNumberOfBytesWritten=0x593f2c0*=0xddb0, lpOverlapped=0x0) returned 1
	[0123.766] CloseHandle (hObject=0x5dc) returned 1
	[0123.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf", lpFilePart=0x0) returned 0x2f
	[0123.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0123.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.768] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\3arfqccqffvv7a3vj_l.pdf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f519bf0, ftCreationTime.dwHighDateTime=0x1d4cfae, ftLastAccessTime.dwLowDateTime=0xdeef630, ftLastAccessTime.dwHighDateTime=0x1d4cb9f, ftLastWriteTime.dwLowDateTime=0x841a8820, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xddb0)) returned 1
	[0123.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.768] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\3arfqccqffvv7a3vj_l.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\3aRfQcCqfFVV7a3Vj_l.pdf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\3arfqccqffvv7a3vj_l.pdf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp", lpFilePart=0x0) returned 0x20
	[0123.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.770] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\4t98.bmp"), fInfoLevelId=0x0, lpFileInformation=0x280b6ec | out: lpFileInformation=0x280b6ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914ea0c0, ftCreationTime.dwHighDateTime=0x1d4ca0a, ftLastAccessTime.dwLowDateTime=0xe59de980, ftLastAccessTime.dwHighDateTime=0x1d4cdf5, ftLastWriteTime.dwLowDateTime=0xe59de980, ftLastWriteTime.dwHighDateTime=0x1d4cdf5, nFileSizeHigh=0x0, nFileSizeLow=0x2cf2)) returned 1
	[0123.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp", lpFilePart=0x0) returned 0x20
	[0123.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.771] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\4t98.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.771] GetFileType (hFile=0x5dc) returned 0x1
	[0123.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.771] GetFileType (hFile=0x5dc) returned 0x1
	[0123.771] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2cf2
	[0123.771] ReadFile (in: hFile=0x5dc, lpBuffer=0x280b8a4, nNumberOfBytesToRead=0x2cf2, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x280b8a4*, lpNumberOfBytesRead=0x593f2cc*=0x2cf2, lpOverlapped=0x0) returned 1
	[0123.772] CloseHandle (hObject=0x5dc) returned 1
	[0123.772] CryptDestroyKey (hKey=0x82b440) returned 1
	[0123.772] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.772] CryptImportKey (in: hProv=0x7f93c0, pbData=0x280e634, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0123.773] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.773] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.773] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0123.773] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.773] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x280e6ec*=0x1, dwFlags=0x0) returned 1
	[0123.773] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x280e6b8, dwFlags=0x0) returned 1
	[0123.773] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x280e6fc*, pdwDataLen=0x593f2d4*=0x2d00, dwBufLen=0x2d00 | out: pbData=0x280e6fc*, pdwDataLen=0x593f2d4*=0x2d00) returned 1
	[0123.773] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2811408*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2811408*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.773] CryptDestroyKey (hKey=0x82b540) returned 1
	[0123.773] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.773] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.773] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp", lpFilePart=0x0) returned 0x20
	[0123.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.774] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\4t98.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.776] GetFileType (hFile=0x5dc) returned 0x1
	[0123.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.776] GetFileType (hFile=0x5dc) returned 0x1
	[0123.776] WriteFile (in: hFile=0x5dc, lpBuffer=0x280e6fc*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x280e6fc*, lpNumberOfBytesWritten=0x593f2c0*=0x2d00, lpOverlapped=0x0) returned 1
	[0123.777] CloseHandle (hObject=0x5dc) returned 1
	[0123.778] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp", lpFilePart=0x0) returned 0x20
	[0123.778] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x4f
	[0123.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.778] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\4t98.bmp"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914ea0c0, ftCreationTime.dwHighDateTime=0x1d4ca0a, ftLastAccessTime.dwLowDateTime=0xe59de980, ftLastAccessTime.dwHighDateTime=0x1d4cdf5, ftLastWriteTime.dwLowDateTime=0x841a8820, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d00)) returned 1
	[0123.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.779] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\4t98.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\4T98.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\4t98.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.780] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3", lpFilePart=0x0) returned 0x27
	[0123.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\5k9won_0uoz.mp3"), fInfoLevelId=0x0, lpFileInformation=0x281170c | out: lpFileInformation=0x281170c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4499fe0, ftCreationTime.dwHighDateTime=0x1d4cc01, ftLastAccessTime.dwLowDateTime=0xc452dc20, ftLastAccessTime.dwHighDateTime=0x1d4cec9, ftLastWriteTime.dwLowDateTime=0xc452dc20, ftLastWriteTime.dwHighDateTime=0x1d4cec9, nFileSizeHigh=0x0, nFileSizeLow=0xed63)) returned 1
	[0123.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.781] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3", lpFilePart=0x0) returned 0x27
	[0123.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.781] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\5k9won_0uoz.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.781] GetFileType (hFile=0x5dc) returned 0x1
	[0123.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.781] GetFileType (hFile=0x5dc) returned 0x1
	[0123.781] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xed63
	[0123.781] ReadFile (in: hFile=0x5dc, lpBuffer=0x28118f4, nNumberOfBytesToRead=0xed63, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x28118f4*, lpNumberOfBytesRead=0x593f2cc*=0xed63, lpOverlapped=0x0) returned 1
	[0123.782] CloseHandle (hObject=0x5dc) returned 1
	[0123.783] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0123.783] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.783] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28206f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b080) returned 1
	[0123.783] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.783] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.783] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0123.783] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.783] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x28207ac*=0x1, dwFlags=0x0) returned 1
	[0123.783] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2820778, dwFlags=0x0) returned 1
	[0123.783] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28207bc*, pdwDataLen=0x593f2d4*=0xed70, dwBufLen=0xed70 | out: pbData=0x28207bc*, pdwDataLen=0x593f2d4*=0xed70) returned 1
	[0123.783] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x282f538*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x282f538*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.783] CryptDestroyKey (hKey=0x82b280) returned 1
	[0123.783] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.784] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.784] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3", lpFilePart=0x0) returned 0x27
	[0123.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.784] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\5k9won_0uoz.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.793] GetFileType (hFile=0x5dc) returned 0x1
	[0123.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.794] GetFileType (hFile=0x5dc) returned 0x1
	[0123.794] WriteFile (in: hFile=0x5dc, lpBuffer=0x28207bc*, nNumberOfBytesToWrite=0xed70, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x28207bc*, lpNumberOfBytesWritten=0x593f2c0*=0xed70, lpOverlapped=0x0) returned 1
	[0123.796] CloseHandle (hObject=0x5dc) returned 1
	[0123.802] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3", lpFilePart=0x0) returned 0x27
	[0123.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0123.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.806] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\5k9won_0uoz.mp3"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4499fe0, ftCreationTime.dwHighDateTime=0x1d4cc01, ftLastAccessTime.dwLowDateTime=0xc452dc20, ftLastAccessTime.dwHighDateTime=0x1d4cec9, ftLastWriteTime.dwLowDateTime=0x841f4f1e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xed70)) returned 1
	[0123.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.806] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\5k9won_0uoz.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\5k9Won_0Uoz.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\5k9won_0uoz.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.814] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv", lpFilePart=0x0) returned 0x22
	[0123.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.814] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\6khbqv.mkv"), fInfoLevelId=0x0, lpFileInformation=0x264a608 | out: lpFileInformation=0x264a608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe836fc60, ftCreationTime.dwHighDateTime=0x1d4cbaf, ftLastAccessTime.dwLowDateTime=0xee7816b0, ftLastAccessTime.dwHighDateTime=0x1d4ca7c, ftLastWriteTime.dwLowDateTime=0xee7816b0, ftLastWriteTime.dwHighDateTime=0x1d4ca7c, nFileSizeHigh=0x0, nFileSizeLow=0x98f7)) returned 1
	[0123.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv", lpFilePart=0x0) returned 0x22
	[0123.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.815] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\6khbqv.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.815] GetFileType (hFile=0x5dc) returned 0x1
	[0123.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.815] GetFileType (hFile=0x5dc) returned 0x1
	[0123.815] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x98f7
	[0123.815] ReadFile (in: hFile=0x5dc, lpBuffer=0x264a7d0, nNumberOfBytesToRead=0x98f7, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x264a7d0*, lpNumberOfBytesRead=0x593f2cc*=0x98f7, lpOverlapped=0x0) returned 1
	[0123.816] CloseHandle (hObject=0x5dc) returned 1
	[0123.817] CryptDestroyKey (hKey=0x82b080) returned 1
	[0123.817] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.817] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2654164, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0123.817] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.817] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.817] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b100) returned 1
	[0123.817] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.817] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x265421c*=0x1, dwFlags=0x0) returned 1
	[0123.817] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x26541e8, dwFlags=0x0) returned 1
	[0123.817] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265422c*, pdwDataLen=0x593f2d4*=0x9900, dwBufLen=0x9900 | out: pbData=0x265422c*, pdwDataLen=0x593f2d4*=0x9900) returned 1
	[0123.817] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265db38*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x265db38*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.817] CryptDestroyKey (hKey=0x82b100) returned 1
	[0123.818] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.818] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.818] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv", lpFilePart=0x0) returned 0x22
	[0123.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.818] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\6khbqv.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.821] GetFileType (hFile=0x5dc) returned 0x1
	[0123.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.821] GetFileType (hFile=0x5dc) returned 0x1
	[0123.821] WriteFile (in: hFile=0x5dc, lpBuffer=0x265422c*, nNumberOfBytesToWrite=0x9900, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x265422c*, lpNumberOfBytesWritten=0x593f2c0*=0x9900, lpOverlapped=0x0) returned 1
	[0123.823] CloseHandle (hObject=0x5dc) returned 1
	[0123.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv", lpFilePart=0x0) returned 0x22
	[0123.825] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x51
	[0123.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.825] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\6khbqv.mkv"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe836fc60, ftCreationTime.dwHighDateTime=0x1d4cbaf, ftLastAccessTime.dwLowDateTime=0xee7816b0, ftLastAccessTime.dwHighDateTime=0x1d4ca7c, ftLastWriteTime.dwLowDateTime=0x8421af43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9900)) returned 1
	[0123.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.825] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\6khbqv.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6khbqV.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\6khbqv.mkv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.827] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf", lpFilePart=0x0) returned 0x27
	[0123.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.827] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\7jktglhesar.pdf"), fInfoLevelId=0x0, lpFileInformation=0x265de54 | out: lpFileInformation=0x265de54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf7730, ftCreationTime.dwHighDateTime=0x1d4cd38, ftLastAccessTime.dwLowDateTime=0x51cda410, ftLastAccessTime.dwHighDateTime=0x1d4cc48, ftLastWriteTime.dwLowDateTime=0x51cda410, ftLastWriteTime.dwHighDateTime=0x1d4cc48, nFileSizeHigh=0x0, nFileSizeLow=0x108e9)) returned 1
	[0123.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.828] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf", lpFilePart=0x0) returned 0x27
	[0123.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.828] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\7jktglhesar.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.828] GetFileType (hFile=0x5dc) returned 0x1
	[0123.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.828] GetFileType (hFile=0x5dc) returned 0x1
	[0123.828] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x108e9
	[0123.828] ReadFile (in: hFile=0x5dc, lpBuffer=0x265e03c, nNumberOfBytesToRead=0x108e9, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x265e03c*, lpNumberOfBytesRead=0x593f2cc*=0x108e9, lpOverlapped=0x0) returned 1
	[0123.829] CloseHandle (hObject=0x5dc) returned 1
	[0123.829] CryptDestroyKey (hKey=0x82b540) returned 1
	[0123.829] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.829] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266e9c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0123.829] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.830] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.830] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0123.830] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.830] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x266ea7c*=0x1, dwFlags=0x0) returned 1
	[0123.830] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x266ea48, dwFlags=0x0) returned 1
	[0123.830] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266ea8c*, pdwDataLen=0x593f2d4*=0x108f0, dwBufLen=0x108f0 | out: pbData=0x266ea8c*, pdwDataLen=0x593f2d4*=0x108f0) returned 1
	[0123.830] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267f388*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x267f388*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.830] CryptDestroyKey (hKey=0x82b340) returned 1
	[0123.830] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.830] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf", lpFilePart=0x0) returned 0x27
	[0123.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.830] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\7jktglhesar.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.834] GetFileType (hFile=0x5dc) returned 0x1
	[0123.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.834] GetFileType (hFile=0x5dc) returned 0x1
	[0123.834] WriteFile (in: hFile=0x5dc, lpBuffer=0x266ea8c*, nNumberOfBytesToWrite=0x108f0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x266ea8c*, lpNumberOfBytesWritten=0x593f2c0*=0x108f0, lpOverlapped=0x0) returned 1
	[0123.836] CloseHandle (hObject=0x5dc) returned 1
	[0123.837] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf", lpFilePart=0x0) returned 0x27
	[0123.837] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0123.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.838] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\7jktglhesar.pdf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf7730, ftCreationTime.dwHighDateTime=0x1d4cd38, ftLastAccessTime.dwLowDateTime=0x51cda410, ftLastAccessTime.dwHighDateTime=0x1d4cc48, ftLastWriteTime.dwLowDateTime=0x84241193, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x108f0)) returned 1
	[0123.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.838] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\7jktglhesar.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\7jKTglHESAR.pdf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\7jktglhesar.pdf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods", lpFilePart=0x0) returned 0x2b
	[0123.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.844] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\7lu2jgbdhqcis7u.ods"), fInfoLevelId=0x0, lpFileInformation=0x267f6e0 | out: lpFileInformation=0x267f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfdf06c0, ftCreationTime.dwHighDateTime=0x1d4c643, ftLastAccessTime.dwLowDateTime=0xe19e3270, ftLastAccessTime.dwHighDateTime=0x1d4c87f, ftLastWriteTime.dwLowDateTime=0xe19e3270, ftLastWriteTime.dwHighDateTime=0x1d4c87f, nFileSizeHigh=0x0, nFileSizeLow=0xcf41)) returned 1
	[0123.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.845] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods", lpFilePart=0x0) returned 0x2b
	[0123.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.845] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\7lu2jgbdhqcis7u.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.845] GetFileType (hFile=0x5dc) returned 0x1
	[0123.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.845] GetFileType (hFile=0x5dc) returned 0x1
	[0123.845] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xcf41
	[0123.845] ReadFile (in: hFile=0x5dc, lpBuffer=0x267f8e8, nNumberOfBytesToRead=0xcf41, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x267f8e8*, lpNumberOfBytesRead=0x593f2cc*=0xcf41, lpOverlapped=0x0) returned 1
	[0123.846] CloseHandle (hObject=0x5dc) returned 1
	[0123.846] CryptDestroyKey (hKey=0x82b300) returned 1
	[0123.846] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.846] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268c8c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0123.847] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.847] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.847] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0123.847] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.847] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x268c980*=0x1, dwFlags=0x0) returned 1
	[0123.847] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x268c94c, dwFlags=0x0) returned 1
	[0123.847] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268c990*, pdwDataLen=0x593f2d4*=0xcf50, dwBufLen=0xcf50 | out: pbData=0x268c990*, pdwDataLen=0x593f2d4*=0xcf50) returned 1
	[0123.847] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26998ec*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26998ec*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.847] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0123.847] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.847] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods", lpFilePart=0x0) returned 0x2b
	[0123.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.847] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\7lu2jgbdhqcis7u.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.850] GetFileType (hFile=0x5dc) returned 0x1
	[0123.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.850] GetFileType (hFile=0x5dc) returned 0x1
	[0123.850] WriteFile (in: hFile=0x5dc, lpBuffer=0x268c990*, nNumberOfBytesToWrite=0xcf50, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x268c990*, lpNumberOfBytesWritten=0x593f2c0*=0xcf50, lpOverlapped=0x0) returned 1
	[0123.852] CloseHandle (hObject=0x5dc) returned 1
	[0123.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods", lpFilePart=0x0) returned 0x2b
	[0123.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5a
	[0123.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.853] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\7lu2jgbdhqcis7u.ods"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfdf06c0, ftCreationTime.dwHighDateTime=0x1d4c643, ftLastAccessTime.dwLowDateTime=0xe19e3270, ftLastAccessTime.dwHighDateTime=0x1d4c87f, ftLastWriteTime.dwLowDateTime=0x842673ea, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xcf50)) returned 1
	[0123.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.854] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\7lu2jgbdhqcis7u.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\7LU2JGBdHQCis7U.ods id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\7lu2jgbdhqcis7u.ods id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a", lpFilePart=0x0) returned 0x2a
	[0123.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.883] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\96gw8usb htonl.m4a"), fInfoLevelId=0x0, lpFileInformation=0x2699c74 | out: lpFileInformation=0x2699c74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd5753d0, ftCreationTime.dwHighDateTime=0x1d4cba8, ftLastAccessTime.dwLowDateTime=0xeaf29620, ftLastAccessTime.dwHighDateTime=0x1d4d353, ftLastWriteTime.dwLowDateTime=0xeaf29620, ftLastWriteTime.dwHighDateTime=0x1d4d353, nFileSizeHigh=0x0, nFileSizeLow=0x15769)) returned 1
	[0123.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.884] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a", lpFilePart=0x0) returned 0x2a
	[0123.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.884] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\96gw8usb htonl.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.885] GetFileType (hFile=0x5dc) returned 0x1
	[0123.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.885] GetFileType (hFile=0x5dc) returned 0x1
	[0123.885] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x15769
	[0123.885] ReadFile (in: hFile=0x5dc, lpBuffer=0x7769de8, nNumberOfBytesToRead=0x15769, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x7769de8*, lpNumberOfBytesRead=0x593f2cc*=0x15769, lpOverlapped=0x0) returned 1
	[0123.887] CloseHandle (hObject=0x5dc) returned 1
	[0123.888] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0123.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.888] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2699f0c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0123.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.888] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0123.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.888] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2699fc4*=0x1, dwFlags=0x0) returned 1
	[0123.888] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2699f90, dwFlags=0x0) returned 1
	[0123.890] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x777f570*, pdwDataLen=0x593f2d4*=0x15770, dwBufLen=0x15770 | out: pbData=0x777f570*, pdwDataLen=0x593f2d4*=0x15770) returned 1
	[0123.890] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2699fd4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2699fd4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.890] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0123.890] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.890] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a", lpFilePart=0x0) returned 0x2a
	[0123.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.890] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\96gw8usb htonl.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.894] GetFileType (hFile=0x5dc) returned 0x1
	[0123.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.894] GetFileType (hFile=0x5dc) returned 0x1
	[0123.894] WriteFile (in: hFile=0x5dc, lpBuffer=0x777f570*, nNumberOfBytesToWrite=0x15770, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x777f570*, lpNumberOfBytesWritten=0x593f2c0*=0x15770, lpOverlapped=0x0) returned 1
	[0123.896] CloseHandle (hObject=0x5dc) returned 1
	[0123.898] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a", lpFilePart=0x0) returned 0x2a
	[0123.898] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x59
	[0123.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.898] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\96gw8usb htonl.m4a"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd5753d0, ftCreationTime.dwHighDateTime=0x1d4cba8, ftLastAccessTime.dwLowDateTime=0xeaf29620, ftLastAccessTime.dwHighDateTime=0x1d4d353, ftLastWriteTime.dwLowDateTime=0x842d9afa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x15770)) returned 1
	[0123.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.898] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\96gw8usb htonl.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\96gW8USB HTonl.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\96gw8usb htonl.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe", lpFilePart=0x0) returned 0x27
	[0123.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.901] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\consoleapp1.exe"), fInfoLevelId=0x0, lpFileInformation=0x269a350 | out: lpFileInformation=0x269a350*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fd6c00, ftCreationTime.dwHighDateTime=0x1d51a17, ftLastAccessTime.dwLowDateTime=0x39960280, ftLastAccessTime.dwHighDateTime=0x1d51a17, ftLastWriteTime.dwLowDateTime=0x3438b800, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4464)) returned 1
	[0123.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe", lpFilePart=0x0) returned 0x27
	[0123.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\consoleapp1.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.901] GetFileType (hFile=0x5dc) returned 0x1
	[0123.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.902] GetFileType (hFile=0x5dc) returned 0x1
	[0123.902] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4464
	[0123.902] ReadFile (in: hFile=0x5dc, lpBuffer=0x269a538, nNumberOfBytesToRead=0x4464, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x269a538*, lpNumberOfBytesRead=0x593f2cc*=0x4464, lpOverlapped=0x0) returned 1
	[0123.903] CloseHandle (hObject=0x5dc) returned 1
	[0123.903] CryptDestroyKey (hKey=0x82b400) returned 1
	[0123.903] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.903] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269ea38, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0123.903] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.903] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.903] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b2c0) returned 1
	[0123.903] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.903] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x269eaf0*=0x1, dwFlags=0x0) returned 1
	[0123.903] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x269eabc, dwFlags=0x0) returned 1
	[0123.904] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269eb00*, pdwDataLen=0x593f2d4*=0x4470, dwBufLen=0x4470 | out: pbData=0x269eb00*, pdwDataLen=0x593f2d4*=0x4470) returned 1
	[0123.904] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a2f7c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26a2f7c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.904] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0123.904] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.904] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.904] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe", lpFilePart=0x0) returned 0x27
	[0123.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.904] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ConsoleApp1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\consoleapp1.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0123.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0123.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg", lpFilePart=0x0) returned 0x2f
	[0123.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.907] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\cqekamxqktm-svsehda.jpg"), fInfoLevelId=0x0, lpFileInformation=0x26a34e8 | out: lpFileInformation=0x26a34e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49eee6f0, ftCreationTime.dwHighDateTime=0x1d4c7f7, ftLastAccessTime.dwLowDateTime=0xa58cee60, ftLastAccessTime.dwHighDateTime=0x1d4cdad, ftLastWriteTime.dwLowDateTime=0xa58cee60, ftLastWriteTime.dwHighDateTime=0x1d4cdad, nFileSizeHigh=0x0, nFileSizeLow=0x8b2e)) returned 1
	[0123.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.908] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg", lpFilePart=0x0) returned 0x2f
	[0123.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.908] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\cqekamxqktm-svsehda.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.908] GetFileType (hFile=0x5dc) returned 0x1
	[0123.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.908] GetFileType (hFile=0x5dc) returned 0x1
	[0123.908] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x8b2e
	[0123.908] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a3710, nNumberOfBytesToRead=0x8b2e, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26a3710*, lpNumberOfBytesRead=0x593f2cc*=0x8b2e, lpOverlapped=0x0) returned 1
	[0123.909] CloseHandle (hObject=0x5dc) returned 1
	[0123.909] CryptDestroyKey (hKey=0x82b280) returned 1
	[0123.910] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.910] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ac2dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b040) returned 1
	[0123.910] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.910] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.910] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b100) returned 1
	[0123.910] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.910] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26ac394*=0x1, dwFlags=0x0) returned 1
	[0123.910] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x26ac360, dwFlags=0x0) returned 1
	[0123.910] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ac3a4*, pdwDataLen=0x593f2d4*=0x8b30, dwBufLen=0x8b30 | out: pbData=0x26ac3a4*, pdwDataLen=0x593f2d4*=0x8b30) returned 1
	[0123.910] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b4ee0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26b4ee0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.910] CryptDestroyKey (hKey=0x82b100) returned 1
	[0123.910] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.910] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg", lpFilePart=0x0) returned 0x2f
	[0123.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.910] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\cqekamxqktm-svsehda.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.914] GetFileType (hFile=0x5dc) returned 0x1
	[0123.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.914] GetFileType (hFile=0x5dc) returned 0x1
	[0123.914] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ac3a4*, nNumberOfBytesToWrite=0x8b30, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26ac3a4*, lpNumberOfBytesWritten=0x593f2c0*=0x8b30, lpOverlapped=0x0) returned 1
	[0123.915] CloseHandle (hObject=0x5dc) returned 1
	[0123.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg", lpFilePart=0x0) returned 0x2f
	[0123.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0123.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.917] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\cqekamxqktm-svsehda.jpg"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49eee6f0, ftCreationTime.dwHighDateTime=0x1d4c7f7, ftLastAccessTime.dwLowDateTime=0xa58cee60, ftLastAccessTime.dwHighDateTime=0x1d4cdad, ftLastWriteTime.dwLowDateTime=0x842ffd9b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8b30)) returned 1
	[0123.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.917] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\cqekamxqktm-svsehda.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\cQEkAMxQKtM-svsehDa.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\cqekamxqktm-svsehda.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x23
	[0123.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26b5298 | out: lpFileInformation=0x26b5298*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a)) returned 1
	[0123.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x23
	[0123.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.925] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.925] GetFileType (hFile=0x5dc) returned 0x1
	[0123.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.926] GetFileType (hFile=0x5dc) returned 0x1
	[0123.926] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11a
	[0123.926] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b5588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26b5588*, lpNumberOfBytesRead=0x593f2cc*=0x11a, lpOverlapped=0x0) returned 1
	[0123.927] CloseHandle (hObject=0x5dc) returned 1
	[0123.927] CryptDestroyKey (hKey=0x82b040) returned 1
	[0123.927] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.927] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b6624, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0123.927] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.927] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.927] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b480) returned 1
	[0123.927] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.927] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26b66dc*=0x1, dwFlags=0x0) returned 1
	[0123.927] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26b66a8, dwFlags=0x0) returned 1
	[0123.927] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b66ec*, pdwDataLen=0x593f2d4*=0x120, dwBufLen=0x120 | out: pbData=0x26b66ec*, pdwDataLen=0x593f2d4*=0x120) returned 1
	[0123.927] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b6818*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26b6818*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.928] CryptDestroyKey (hKey=0x82b480) returned 1
	[0123.928] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.928] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.928] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x23
	[0123.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.928] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0123.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0123.930] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp", lpFilePart=0x0) returned 0x26
	[0123.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.930] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\fe4gzlngox.bmp"), fInfoLevelId=0x0, lpFileInformation=0x26b6cf4 | out: lpFileInformation=0x26b6cf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb95d5750, ftCreationTime.dwHighDateTime=0x1d4cdd4, ftLastAccessTime.dwLowDateTime=0x78307ba0, ftLastAccessTime.dwHighDateTime=0x1d4cabd, ftLastWriteTime.dwLowDateTime=0x78307ba0, ftLastWriteTime.dwHighDateTime=0x1d4cabd, nFileSizeHigh=0x0, nFileSizeLow=0x7f53)) returned 1
	[0123.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.930] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp", lpFilePart=0x0) returned 0x26
	[0123.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.930] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\fe4gzlngox.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.931] GetFileType (hFile=0x5dc) returned 0x1
	[0123.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.931] GetFileType (hFile=0x5dc) returned 0x1
	[0123.931] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x7f53
	[0123.931] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b6edc, nNumberOfBytesToRead=0x7f53, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26b6edc*, lpNumberOfBytesRead=0x593f2cc*=0x7f53, lpOverlapped=0x0) returned 1
	[0123.932] CloseHandle (hObject=0x5dc) returned 1
	[0123.932] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0123.932] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.932] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26beecc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b0c0) returned 1
	[0123.932] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.932] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.932] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0123.932] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.932] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26bef84*=0x1, dwFlags=0x0) returned 1
	[0123.933] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26bef50, dwFlags=0x0) returned 1
	[0123.933] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bef94*, pdwDataLen=0x593f2d4*=0x7f60, dwBufLen=0x7f60 | out: pbData=0x26bef94*, pdwDataLen=0x593f2d4*=0x7f60) returned 1
	[0123.933] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c6f00*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26c6f00*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.933] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0123.933] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.933] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp", lpFilePart=0x0) returned 0x26
	[0123.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.933] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\fe4gzlngox.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.936] GetFileType (hFile=0x5dc) returned 0x1
	[0123.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.936] GetFileType (hFile=0x5dc) returned 0x1
	[0123.936] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bef94*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26bef94*, lpNumberOfBytesWritten=0x593f2c0*=0x7f60, lpOverlapped=0x0) returned 1
	[0123.938] CloseHandle (hObject=0x5dc) returned 1
	[0123.939] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp", lpFilePart=0x0) returned 0x26
	[0123.939] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0123.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\fe4gzlngox.bmp"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb95d5750, ftCreationTime.dwHighDateTime=0x1d4cdd4, ftLastAccessTime.dwLowDateTime=0x78307ba0, ftLastAccessTime.dwHighDateTime=0x1d4cabd, ftLastWriteTime.dwLowDateTime=0x8434c283, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7f60)) returned 1
	[0123.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.939] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\fe4gzlngox.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Fe4GZlNGOX.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\fe4gzlngox.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.944] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx", lpFilePart=0x0) returned 0x2d
	[0123.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.944] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\frcqwnkhpkegpujm.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x26c724c | out: lpFileInformation=0x26c724c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd714940, ftCreationTime.dwHighDateTime=0x1d4d203, ftLastAccessTime.dwLowDateTime=0xecf5f850, ftLastAccessTime.dwHighDateTime=0x1d4c6ff, ftLastWriteTime.dwLowDateTime=0xecf5f850, ftLastWriteTime.dwHighDateTime=0x1d4c6ff, nFileSizeHigh=0x0, nFileSizeLow=0x11dad)) returned 1
	[0123.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.945] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx", lpFilePart=0x0) returned 0x2d
	[0123.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.945] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\frcqwnkhpkegpujm.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.945] GetFileType (hFile=0x5dc) returned 0x1
	[0123.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.945] GetFileType (hFile=0x5dc) returned 0x1
	[0123.945] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11dad
	[0123.946] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c7464, nNumberOfBytesToRead=0x11dad, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26c7464*, lpNumberOfBytesRead=0x593f2cc*=0x11dad, lpOverlapped=0x0) returned 1
	[0123.947] CloseHandle (hObject=0x5dc) returned 1
	[0123.947] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0123.947] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.947] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d92b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0123.947] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.947] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.947] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b200) returned 1
	[0123.947] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.947] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26d9368*=0x1, dwFlags=0x0) returned 1
	[0123.947] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26d9334, dwFlags=0x0) returned 1
	[0123.947] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d9378*, pdwDataLen=0x593f2d4*=0x11db0, dwBufLen=0x11db0 | out: pbData=0x26d9378*, pdwDataLen=0x593f2d4*=0x11db0) returned 1
	[0123.948] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26eb134*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26eb134*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.948] CryptDestroyKey (hKey=0x82b200) returned 1
	[0123.948] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.948] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.948] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx", lpFilePart=0x0) returned 0x2d
	[0123.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.948] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\frcqwnkhpkegpujm.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.952] GetFileType (hFile=0x5dc) returned 0x1
	[0123.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.952] GetFileType (hFile=0x5dc) returned 0x1
	[0123.952] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d9378*, nNumberOfBytesToWrite=0x11db0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26d9378*, lpNumberOfBytesWritten=0x593f2c0*=0x11db0, lpOverlapped=0x0) returned 1
	[0123.954] CloseHandle (hObject=0x5dc) returned 1
	[0123.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx", lpFilePart=0x0) returned 0x2d
	[0123.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0123.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.956] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\frcqwnkhpkegpujm.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd714940, ftCreationTime.dwHighDateTime=0x1d4d203, ftLastAccessTime.dwLowDateTime=0xecf5f850, ftLastAccessTime.dwHighDateTime=0x1d4c6ff, ftLastWriteTime.dwLowDateTime=0x84372845, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11db0)) returned 1
	[0123.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.956] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\frcqwnkhpkegpujm.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\FrcQWnKHPKeGPUJM.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\frcqwnkhpkegpujm.xlsx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3", lpFilePart=0x0) returned 0x29
	[0123.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.960] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ho2z9_0a6myfb.mp3"), fInfoLevelId=0x0, lpFileInformation=0x26eb4d4 | out: lpFileInformation=0x26eb4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2210740, ftCreationTime.dwHighDateTime=0x1d4cc39, ftLastAccessTime.dwLowDateTime=0x9448d50, ftLastAccessTime.dwHighDateTime=0x1d4d2b8, ftLastWriteTime.dwLowDateTime=0x9448d50, ftLastWriteTime.dwHighDateTime=0x1d4d2b8, nFileSizeHigh=0x0, nFileSizeLow=0x434b)) returned 1
	[0123.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.961] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3", lpFilePart=0x0) returned 0x29
	[0123.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ho2z9_0a6myfb.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.961] GetFileType (hFile=0x5dc) returned 0x1
	[0123.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.961] GetFileType (hFile=0x5dc) returned 0x1
	[0123.961] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x434b
	[0123.961] ReadFile (in: hFile=0x5dc, lpBuffer=0x26eb6cc, nNumberOfBytesToRead=0x434b, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26eb6cc*, lpNumberOfBytesRead=0x593f2cc*=0x434b, lpOverlapped=0x0) returned 1
	[0123.962] CloseHandle (hObject=0x5dc) returned 1
	[0123.962] CryptDestroyKey (hKey=0x82b300) returned 1
	[0123.962] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.963] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26efab4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0123.963] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.963] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.963] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b2c0) returned 1
	[0123.963] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.963] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26efb6c*=0x1, dwFlags=0x0) returned 1
	[0123.963] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26efb38, dwFlags=0x0) returned 1
	[0123.963] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26efb7c*, pdwDataLen=0x593f2d4*=0x4350, dwBufLen=0x4350 | out: pbData=0x26efb7c*, pdwDataLen=0x593f2d4*=0x4350) returned 1
	[0123.963] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f3ed8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26f3ed8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.963] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0123.963] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.963] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.964] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3", lpFilePart=0x0) returned 0x29
	[0123.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.964] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ho2z9_0a6myfb.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.971] GetFileType (hFile=0x5dc) returned 0x1
	[0123.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.971] GetFileType (hFile=0x5dc) returned 0x1
	[0123.971] WriteFile (in: hFile=0x5dc, lpBuffer=0x26efb7c*, nNumberOfBytesToWrite=0x4350, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26efb7c*, lpNumberOfBytesWritten=0x593f2c0*=0x4350, lpOverlapped=0x0) returned 1
	[0123.972] CloseHandle (hObject=0x5dc) returned 1
	[0123.974] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3", lpFilePart=0x0) returned 0x29
	[0123.974] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x58
	[0123.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.974] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ho2z9_0a6myfb.mp3"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2210740, ftCreationTime.dwHighDateTime=0x1d4cc39, ftLastAccessTime.dwLowDateTime=0x9448d50, ftLastAccessTime.dwHighDateTime=0x1d4d2b8, ftLastWriteTime.dwLowDateTime=0x84398715, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4350)) returned 1
	[0123.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.974] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ho2z9_0a6myfb.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\hO2Z9_0A6mYFb.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\ho2z9_0a6myfb.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg", lpFilePart=0x0) returned 0x2d
	[0123.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.977] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\icqk5b2a00f9_zxor.jpg"), fInfoLevelId=0x0, lpFileInformation=0x26f4248 | out: lpFileInformation=0x26f4248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c0bb170, ftCreationTime.dwHighDateTime=0x1d4c772, ftLastAccessTime.dwLowDateTime=0x594775b0, ftLastAccessTime.dwHighDateTime=0x1d4c755, ftLastWriteTime.dwLowDateTime=0x594775b0, ftLastWriteTime.dwHighDateTime=0x1d4c755, nFileSizeHigh=0x0, nFileSizeLow=0x43bf)) returned 1
	[0123.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0123.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg", lpFilePart=0x0) returned 0x2d
	[0123.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0123.977] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\icqk5b2a00f9_zxor.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.977] GetFileType (hFile=0x5dc) returned 0x1
	[0123.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0123.977] GetFileType (hFile=0x5dc) returned 0x1
	[0123.977] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x43bf
	[0123.978] ReadFile (in: hFile=0x5dc, lpBuffer=0x26f4460, nNumberOfBytesToRead=0x43bf, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26f4460*, lpNumberOfBytesRead=0x593f2cc*=0x43bf, lpOverlapped=0x0) returned 1
	[0123.978] CloseHandle (hObject=0x5dc) returned 1
	[0123.979] CryptDestroyKey (hKey=0x82b280) returned 1
	[0123.979] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.979] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f88bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b380) returned 1
	[0123.979] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.979] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.979] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0123.979] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0123.979] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26f8974*=0x1, dwFlags=0x0) returned 1
	[0123.979] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26f8940, dwFlags=0x0) returned 1
	[0123.979] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f8984*, pdwDataLen=0x593f2d4*=0x43c0, dwBufLen=0x43c0 | out: pbData=0x26f8984*, pdwDataLen=0x593f2d4*=0x43c0) returned 1
	[0123.979] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fcd50*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26fcd50*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0123.979] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0123.979] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.979] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0123.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg", lpFilePart=0x0) returned 0x2d
	[0123.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0123.979] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\icqk5b2a00f9_zxor.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0123.986] GetFileType (hFile=0x5dc) returned 0x1
	[0123.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0123.986] GetFileType (hFile=0x5dc) returned 0x1
	[0123.986] WriteFile (in: hFile=0x5dc, lpBuffer=0x26f8984*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26f8984*, lpNumberOfBytesWritten=0x593f2c0*=0x43c0, lpOverlapped=0x0) returned 1
	[0123.987] CloseHandle (hObject=0x5dc) returned 1
	[0123.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg", lpFilePart=0x0) returned 0x2d
	[0123.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0123.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0123.988] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\icqk5b2a00f9_zxor.jpg"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c0bb170, ftCreationTime.dwHighDateTime=0x1d4c772, ftLastAccessTime.dwLowDateTime=0x594775b0, ftLastAccessTime.dwHighDateTime=0x1d4c755, ftLastWriteTime.dwLowDateTime=0x843be924, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x43c0)) returned 1
	[0123.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0123.988] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\icqk5b2a00f9_zxor.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\icQK5B2A00F9_ZXOr.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\icqk5b2a00f9_zxor.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0123.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv", lpFilePart=0x0) returned 0x2d
	[0123.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0123.990] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IV5ALBjbsW7-YByVU.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\iv5albjbsw7-ybyvu.flv"), fInfoLevelId=0x0, lpFileInformation=0x26fd0f0 | out: lpFileInformation=0x26fd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e534060, ftCreationTime.dwHighDateTime=0x1d4d3bb, ftLastAccessTime.dwLowDateTime=0x60d71ac0, ftLastAccessTime.dwHighDateTime=0x1d4d4a1, ftLastWriteTime.dwLowDateTime=0x60d71ac0, ftLastWriteTime.dwHighDateTime=0x1d4d4a1, nFileSizeHigh=0x0, nFileSizeLow=0x702b)) returned 1
	[0123.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.266] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4", lpFilePart=0x0) returned 0x26
	[0124.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.266] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\njevrlfhjt.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.266] GetFileType (hFile=0x5dc) returned 0x1
	[0124.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.266] GetFileType (hFile=0x5dc) returned 0x1
	[0124.266] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4b46
	[0124.266] ReadFile (in: hFile=0x5dc, lpBuffer=0x2782780, nNumberOfBytesToRead=0x4b46, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2782780*, lpNumberOfBytesRead=0x593f2cc*=0x4b46, lpOverlapped=0x0) returned 1
	[0124.267] CloseHandle (hObject=0x5dc) returned 1
	[0124.268] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0124.268] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.268] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2787364, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0124.268] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.268] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.268] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0124.268] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.268] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x278741c*=0x1, dwFlags=0x0) returned 1
	[0124.268] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27873e8, dwFlags=0x0) returned 1
	[0124.268] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278742c*, pdwDataLen=0x593f2d4*=0x4b50, dwBufLen=0x4b50 | out: pbData=0x278742c*, pdwDataLen=0x593f2d4*=0x4b50) returned 1
	[0124.268] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278bf88*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x278bf88*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.268] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0124.268] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.268] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.269] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4", lpFilePart=0x0) returned 0x26
	[0124.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.269] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\njevrlfhjt.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.270] GetFileType (hFile=0x5dc) returned 0x1
	[0124.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.270] GetFileType (hFile=0x5dc) returned 0x1
	[0124.270] WriteFile (in: hFile=0x5dc, lpBuffer=0x278742c*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x278742c*, lpNumberOfBytesWritten=0x593f2c0*=0x4b50, lpOverlapped=0x0) returned 1
	[0124.272] CloseHandle (hObject=0x5dc) returned 1
	[0124.272] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4", lpFilePart=0x0) returned 0x26
	[0124.272] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0124.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.272] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\njevrlfhjt.mp4"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2110e0, ftCreationTime.dwHighDateTime=0x1d4d13f, ftLastAccessTime.dwLowDateTime=0xfc15c000, ftLastAccessTime.dwHighDateTime=0x1d4c91f, ftLastWriteTime.dwLowDateTime=0x8466d371, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4b50)) returned 1
	[0124.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.272] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\njevrlfhjt.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\NJEVRlFHJT.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\njevrlfhjt.mp4 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.273] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4", lpFilePart=0x0) returned 0x30
	[0124.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.273] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\nnds9aiiq6exbau8by6s.mp4"), fInfoLevelId=0x0, lpFileInformation=0x278c2d4 | out: lpFileInformation=0x278c2d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce4d0c0, ftCreationTime.dwHighDateTime=0x1d4cd82, ftLastAccessTime.dwLowDateTime=0xfa99f760, ftLastAccessTime.dwHighDateTime=0x1d4cc3e, ftLastWriteTime.dwLowDateTime=0xfa99f760, ftLastWriteTime.dwHighDateTime=0x1d4cc3e, nFileSizeHigh=0x0, nFileSizeLow=0x18142)) returned 1
	[0124.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.274] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4", lpFilePart=0x0) returned 0x30
	[0124.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.274] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\nnds9aiiq6exbau8by6s.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.274] GetFileType (hFile=0x5dc) returned 0x1
	[0124.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.274] GetFileType (hFile=0x5dc) returned 0x1
	[0124.274] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x18142
	[0124.275] ReadFile (in: hFile=0x5dc, lpBuffer=0x77c3b18, nNumberOfBytesToRead=0x18142, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x77c3b18*, lpNumberOfBytesRead=0x593f2cc*=0x18142, lpOverlapped=0x0) returned 1
	[0124.277] CloseHandle (hObject=0x5dc) returned 1
	[0124.277] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0124.277] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.277] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278c59c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0124.278] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.278] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.278] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b400) returned 1
	[0124.278] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.278] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x278c654*=0x1, dwFlags=0x0) returned 1
	[0124.278] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x278c620, dwFlags=0x0) returned 1
	[0124.279] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x77dbc78*, pdwDataLen=0x593f2d4*=0x18150, dwBufLen=0x18150 | out: pbData=0x77dbc78*, pdwDataLen=0x593f2d4*=0x18150) returned 1
	[0124.280] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278c664*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x278c664*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.280] CryptDestroyKey (hKey=0x82b400) returned 1
	[0124.280] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.280] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.280] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4", lpFilePart=0x0) returned 0x30
	[0124.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.280] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\nnds9aiiq6exbau8by6s.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.282] GetFileType (hFile=0x5dc) returned 0x1
	[0124.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.282] GetFileType (hFile=0x5dc) returned 0x1
	[0124.282] WriteFile (in: hFile=0x5dc, lpBuffer=0x77dbc78*, nNumberOfBytesToWrite=0x18150, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x77dbc78*, lpNumberOfBytesWritten=0x593f2c0*=0x18150, lpOverlapped=0x0) returned 1
	[0124.284] CloseHandle (hObject=0x5dc) returned 1
	[0124.285] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4", lpFilePart=0x0) returned 0x30
	[0124.285] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0124.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.285] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\nnds9aiiq6exbau8by6s.mp4"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce4d0c0, ftCreationTime.dwHighDateTime=0x1d4cd82, ftLastAccessTime.dwLowDateTime=0xfa99f760, ftLastAccessTime.dwHighDateTime=0x1d4cc3e, ftLastWriteTime.dwLowDateTime=0x84693607, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x18150)) returned 1
	[0124.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.285] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\nnds9aiiq6exbau8by6s.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nNDS9aIIq6eXBAU8bY6s.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\nnds9aiiq6exbau8by6s.mp4 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.286] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc", lpFilePart=0x0) returned 0x2d
	[0124.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.286] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\p5oynb9tbd0-azqdu.doc"), fInfoLevelId=0x0, lpFileInformation=0x278ca28 | out: lpFileInformation=0x278ca28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62912120, ftCreationTime.dwHighDateTime=0x1d4ce9e, ftLastAccessTime.dwLowDateTime=0xa9602790, ftLastAccessTime.dwHighDateTime=0x1d4cddb, ftLastWriteTime.dwLowDateTime=0xa9602790, ftLastWriteTime.dwHighDateTime=0x1d4cddb, nFileSizeHigh=0x0, nFileSizeLow=0x5731)) returned 1
	[0124.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.286] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc", lpFilePart=0x0) returned 0x2d
	[0124.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.286] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\p5oynb9tbd0-azqdu.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.286] GetFileType (hFile=0x5dc) returned 0x1
	[0124.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.286] GetFileType (hFile=0x5dc) returned 0x1
	[0124.286] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x5731
	[0124.286] ReadFile (in: hFile=0x5dc, lpBuffer=0x278cc40, nNumberOfBytesToRead=0x5731, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x278cc40*, lpNumberOfBytesRead=0x593f2cc*=0x5731, lpOverlapped=0x0) returned 1
	[0124.287] CloseHandle (hObject=0x5dc) returned 1
	[0124.287] CryptDestroyKey (hKey=0x82b540) returned 1
	[0124.287] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.288] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2792410, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0124.288] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.288] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.288] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0124.288] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.288] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27924c8*=0x1, dwFlags=0x0) returned 1
	[0124.288] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2792494, dwFlags=0x0) returned 1
	[0124.288] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27924d8*, pdwDataLen=0x593f2d4*=0x5740, dwBufLen=0x5740 | out: pbData=0x27924d8*, pdwDataLen=0x593f2d4*=0x5740) returned 1
	[0124.288] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2797c24*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2797c24*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.288] CryptDestroyKey (hKey=0x82b540) returned 1
	[0124.288] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.288] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.288] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc", lpFilePart=0x0) returned 0x2d
	[0124.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.288] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\p5oynb9tbd0-azqdu.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.289] GetFileType (hFile=0x5dc) returned 0x1
	[0124.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.290] GetFileType (hFile=0x5dc) returned 0x1
	[0124.290] WriteFile (in: hFile=0x5dc, lpBuffer=0x27924d8*, nNumberOfBytesToWrite=0x5740, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27924d8*, lpNumberOfBytesWritten=0x593f2c0*=0x5740, lpOverlapped=0x0) returned 1
	[0124.291] CloseHandle (hObject=0x5dc) returned 1
	[0124.291] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc", lpFilePart=0x0) returned 0x2d
	[0124.291] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0124.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.291] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\p5oynb9tbd0-azqdu.doc"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62912120, ftCreationTime.dwHighDateTime=0x1d4ce9e, ftLastAccessTime.dwLowDateTime=0xa9602790, ftLastAccessTime.dwHighDateTime=0x1d4cddb, ftLastWriteTime.dwLowDateTime=0x84693607, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5740)) returned 1
	[0124.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.291] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\p5oynb9tbd0-azqdu.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\P5Oynb9TbD0-AZqdu.doc id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\p5oynb9tbd0-azqdu.doc id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg", lpFilePart=0x0) returned 0x24
	[0124.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.292] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\plqrcrxn.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2797fc4 | out: lpFileInformation=0x2797fc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4d5e80, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0xd65c8c40, ftLastAccessTime.dwHighDateTime=0x1d4d108, ftLastWriteTime.dwLowDateTime=0xd65c8c40, ftLastWriteTime.dwHighDateTime=0x1d4d108, nFileSizeHigh=0x0, nFileSizeLow=0xcf92)) returned 1
	[0124.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg", lpFilePart=0x0) returned 0x24
	[0124.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.292] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\plqrcrxn.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.292] GetFileType (hFile=0x5dc) returned 0x1
	[0124.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.292] GetFileType (hFile=0x5dc) returned 0x1
	[0124.292] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xcf92
	[0124.292] ReadFile (in: hFile=0x5dc, lpBuffer=0x279819c, nNumberOfBytesToRead=0xcf92, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x279819c*, lpNumberOfBytesRead=0x593f2cc*=0xcf92, lpOverlapped=0x0) returned 1
	[0124.293] CloseHandle (hObject=0x5dc) returned 1
	[0124.293] CryptDestroyKey (hKey=0x82b340) returned 1
	[0124.293] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.293] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a51cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0124.294] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.294] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.294] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0124.294] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.294] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27a5284*=0x1, dwFlags=0x0) returned 1
	[0124.294] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27a5250, dwFlags=0x0) returned 1
	[0124.294] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a5294*, pdwDataLen=0x593f2d4*=0xcfa0, dwBufLen=0xcfa0 | out: pbData=0x27a5294*, pdwDataLen=0x593f2d4*=0xcfa0) returned 1
	[0124.294] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b2240*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27b2240*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.294] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0124.294] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.294] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg", lpFilePart=0x0) returned 0x24
	[0124.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.294] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\plqrcrxn.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.295] GetFileType (hFile=0x5dc) returned 0x1
	[0124.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.295] GetFileType (hFile=0x5dc) returned 0x1
	[0124.296] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a5294*, nNumberOfBytesToWrite=0xcfa0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27a5294*, lpNumberOfBytesWritten=0x593f2c0*=0xcfa0, lpOverlapped=0x0) returned 1
	[0124.297] CloseHandle (hObject=0x5dc) returned 1
	[0124.297] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg", lpFilePart=0x0) returned 0x24
	[0124.297] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x53
	[0124.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.297] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\plqrcrxn.jpg"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4d5e80, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0xd65c8c40, ftLastAccessTime.dwHighDateTime=0x1d4d108, ftLastWriteTime.dwLowDateTime=0x846b9785, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xcfa0)) returned 1
	[0124.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.298] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\plqrcrxn.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\PlQRcrXn.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\plqrcrxn.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx", lpFilePart=0x0) returned 0x2f
	[0124.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.298] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\q rnkhvqd-pj-8-ian.pptx"), fInfoLevelId=0x0, lpFileInformation=0x27b2574 | out: lpFileInformation=0x27b2574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd71f8b0, ftCreationTime.dwHighDateTime=0x1d4c82f, ftLastAccessTime.dwLowDateTime=0xa5e54150, ftLastAccessTime.dwHighDateTime=0x1d4d370, ftLastWriteTime.dwLowDateTime=0xa5e54150, ftLastWriteTime.dwHighDateTime=0x1d4d370, nFileSizeHigh=0x0, nFileSizeLow=0x79ab)) returned 1
	[0124.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.299] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx", lpFilePart=0x0) returned 0x2f
	[0124.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.299] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\q rnkhvqd-pj-8-ian.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.299] GetFileType (hFile=0x5dc) returned 0x1
	[0124.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.299] GetFileType (hFile=0x5dc) returned 0x1
	[0124.299] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x79ab
	[0124.299] ReadFile (in: hFile=0x5dc, lpBuffer=0x27b279c, nNumberOfBytesToRead=0x79ab, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27b279c*, lpNumberOfBytesRead=0x593f2cc*=0x79ab, lpOverlapped=0x0) returned 1
	[0124.300] CloseHandle (hObject=0x5dc) returned 1
	[0124.300] CryptDestroyKey (hKey=0x82b540) returned 1
	[0124.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.300] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ba1e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0124.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.300] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0124.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.300] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27ba29c*=0x1, dwFlags=0x0) returned 1
	[0124.300] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27ba268, dwFlags=0x0) returned 1
	[0124.300] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ba2ac*, pdwDataLen=0x593f2d4*=0x79b0, dwBufLen=0x79b0 | out: pbData=0x27ba2ac*, pdwDataLen=0x593f2d4*=0x79b0) returned 1
	[0124.300] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c1c68*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27c1c68*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.300] CryptDestroyKey (hKey=0x82b380) returned 1
	[0124.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx", lpFilePart=0x0) returned 0x2f
	[0124.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.301] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\q rnkhvqd-pj-8-ian.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.302] GetFileType (hFile=0x5dc) returned 0x1
	[0124.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.302] GetFileType (hFile=0x5dc) returned 0x1
	[0124.302] WriteFile (in: hFile=0x5dc, lpBuffer=0x27ba2ac*, nNumberOfBytesToWrite=0x79b0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27ba2ac*, lpNumberOfBytesWritten=0x593f2c0*=0x79b0, lpOverlapped=0x0) returned 1
	[0124.303] CloseHandle (hObject=0x5dc) returned 1
	[0124.303] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx", lpFilePart=0x0) returned 0x2f
	[0124.303] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0124.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.303] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\q rnkhvqd-pj-8-ian.pptx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd71f8b0, ftCreationTime.dwHighDateTime=0x1d4c82f, ftLastAccessTime.dwLowDateTime=0xa5e54150, ftLastAccessTime.dwHighDateTime=0x1d4d370, ftLastWriteTime.dwLowDateTime=0x846b9785, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x79b0)) returned 1
	[0124.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.303] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\q rnkhvqd-pj-8-ian.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\q RnkHVqD-PJ-8-IAN.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\q rnkhvqd-pj-8-ian.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.304] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg", lpFilePart=0x0) returned 0x2b
	[0124.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.304] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\rcn2wdp_6nkqcfn.jpg"), fInfoLevelId=0x0, lpFileInformation=0x27c2020 | out: lpFileInformation=0x27c2020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4a1330, ftCreationTime.dwHighDateTime=0x1d4d15c, ftLastAccessTime.dwLowDateTime=0x3e11f730, ftLastAccessTime.dwHighDateTime=0x1d4c7e5, ftLastWriteTime.dwLowDateTime=0x3e11f730, ftLastWriteTime.dwHighDateTime=0x1d4c7e5, nFileSizeHigh=0x0, nFileSizeLow=0xbc34)) returned 1
	[0124.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.304] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg", lpFilePart=0x0) returned 0x2b
	[0124.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.304] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\rcn2wdp_6nkqcfn.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.305] GetFileType (hFile=0x5dc) returned 0x1
	[0124.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.305] GetFileType (hFile=0x5dc) returned 0x1
	[0124.305] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xbc34
	[0124.305] ReadFile (in: hFile=0x5dc, lpBuffer=0x27c2228, nNumberOfBytesToRead=0xbc34, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27c2228*, lpNumberOfBytesRead=0x593f2cc*=0xbc34, lpOverlapped=0x0) returned 1
	[0124.306] CloseHandle (hObject=0x5dc) returned 1
	[0124.306] CryptDestroyKey (hKey=0x82b340) returned 1
	[0124.306] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.306] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27cdef8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0124.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.306] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b000) returned 1
	[0124.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.306] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x27cdfb0*=0x1, dwFlags=0x0) returned 1
	[0124.307] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x27cdf7c, dwFlags=0x0) returned 1
	[0124.307] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27cdfc0*, pdwDataLen=0x593f2d4*=0xbc40, dwBufLen=0xbc40 | out: pbData=0x27cdfc0*, pdwDataLen=0x593f2d4*=0xbc40) returned 1
	[0124.307] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d9c0c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27d9c0c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.307] CryptDestroyKey (hKey=0x82b000) returned 1
	[0124.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.307] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg", lpFilePart=0x0) returned 0x2b
	[0124.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.307] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\rcn2wdp_6nkqcfn.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.309] GetFileType (hFile=0x5dc) returned 0x1
	[0124.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.309] GetFileType (hFile=0x5dc) returned 0x1
	[0124.309] WriteFile (in: hFile=0x5dc, lpBuffer=0x27cdfc0*, nNumberOfBytesToWrite=0xbc40, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27cdfc0*, lpNumberOfBytesWritten=0x593f2c0*=0xbc40, lpOverlapped=0x0) returned 1
	[0124.311] CloseHandle (hObject=0x5dc) returned 1
	[0124.311] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg", lpFilePart=0x0) returned 0x2b
	[0124.311] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5a
	[0124.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.311] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\rcn2wdp_6nkqcfn.jpg"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4a1330, ftCreationTime.dwHighDateTime=0x1d4d15c, ftLastAccessTime.dwLowDateTime=0x3e11f730, ftLastAccessTime.dwHighDateTime=0x1d4c7e5, ftLastWriteTime.dwLowDateTime=0x846b9785, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xbc40)) returned 1
	[0124.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.311] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\rcn2wdp_6nkqcfn.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Rcn2Wdp_6NKQcFN.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\rcn2wdp_6nkqcfn.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.347] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf", lpFilePart=0x0) returned 0x28
	[0124.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.347] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\t9mkgity88in.pdf"), fInfoLevelId=0x0, lpFileInformation=0x27d9f94 | out: lpFileInformation=0x27d9f94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1cd88e0, ftCreationTime.dwHighDateTime=0x1d4d2f1, ftLastAccessTime.dwLowDateTime=0x7e8caba0, ftLastAccessTime.dwHighDateTime=0x1d4d228, ftLastWriteTime.dwLowDateTime=0x7e8caba0, ftLastWriteTime.dwHighDateTime=0x1d4d228, nFileSizeHigh=0x0, nFileSizeLow=0x10863)) returned 1
	[0124.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf", lpFilePart=0x0) returned 0x28
	[0124.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.348] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\t9mkgity88in.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.348] GetFileType (hFile=0x5dc) returned 0x1
	[0124.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.348] GetFileType (hFile=0x5dc) returned 0x1
	[0124.348] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x10863
	[0124.349] ReadFile (in: hFile=0x5dc, lpBuffer=0x27da18c, nNumberOfBytesToRead=0x10863, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27da18c*, lpNumberOfBytesRead=0x593f2cc*=0x10863, lpOverlapped=0x0) returned 1
	[0124.350] CloseHandle (hObject=0x5dc) returned 1
	[0124.350] CryptDestroyKey (hKey=0x82b400) returned 1
	[0124.350] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.350] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27eaa8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0124.350] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.350] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.350] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0124.350] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.350] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27eab44*=0x1, dwFlags=0x0) returned 1
	[0124.350] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27eab10, dwFlags=0x0) returned 1
	[0124.350] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27eab54*, pdwDataLen=0x593f2d4*=0x10870, dwBufLen=0x10870 | out: pbData=0x27eab54*, pdwDataLen=0x593f2d4*=0x10870) returned 1
	[0124.351] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fb3d0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27fb3d0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.351] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0124.351] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.351] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf", lpFilePart=0x0) returned 0x28
	[0124.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\t9mkgity88in.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.491] GetFileType (hFile=0x5dc) returned 0x1
	[0124.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.491] GetFileType (hFile=0x5dc) returned 0x1
	[0124.491] WriteFile (in: hFile=0x5dc, lpBuffer=0x27eab54*, nNumberOfBytesToWrite=0x10870, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27eab54*, lpNumberOfBytesWritten=0x593f2c0*=0x10870, lpOverlapped=0x0) returned 1
	[0124.493] CloseHandle (hObject=0x5dc) returned 1
	[0124.502] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf", lpFilePart=0x0) returned 0x28
	[0124.502] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0124.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.502] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\t9mkgity88in.pdf"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1cd88e0, ftCreationTime.dwHighDateTime=0x1d4d2f1, ftLastAccessTime.dwLowDateTime=0x7e8caba0, ftLastAccessTime.dwHighDateTime=0x1d4d228, ftLastWriteTime.dwLowDateTime=0x8488351f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10870)) returned 1
	[0124.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.503] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\t9mkgity88in.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\t9mkgiTy88iN.pdf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\t9mkgity88in.pdf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.507] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv", lpFilePart=0x0) returned 0x26
	[0124.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.507] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\v11_sl6n u.flv"), fInfoLevelId=0x0, lpFileInformation=0x27fb734 | out: lpFileInformation=0x27fb734*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9356b80, ftCreationTime.dwHighDateTime=0x1d4ce45, ftLastAccessTime.dwLowDateTime=0x95fdfef0, ftLastAccessTime.dwHighDateTime=0x1d4c59f, ftLastWriteTime.dwLowDateTime=0x95fdfef0, ftLastWriteTime.dwHighDateTime=0x1d4c59f, nFileSizeHigh=0x0, nFileSizeLow=0xd604)) returned 1
	[0124.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.508] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv", lpFilePart=0x0) returned 0x26
	[0124.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.508] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\v11_sl6n u.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.508] GetFileType (hFile=0x5dc) returned 0x1
	[0124.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.509] GetFileType (hFile=0x5dc) returned 0x1
	[0124.509] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xd604
	[0124.509] ReadFile (in: hFile=0x5dc, lpBuffer=0x27fb91c, nNumberOfBytesToRead=0xd604, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27fb91c*, lpNumberOfBytesRead=0x593f2cc*=0xd604, lpOverlapped=0x0) returned 1
	[0124.510] CloseHandle (hObject=0x5dc) returned 1
	[0124.510] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0124.510] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.510] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2808fbc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0124.510] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.510] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.510] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b4c0) returned 1
	[0124.510] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.511] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2809074*=0x1, dwFlags=0x0) returned 1
	[0124.511] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2809040, dwFlags=0x0) returned 1
	[0124.511] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2809084*, pdwDataLen=0x593f2d4*=0xd610, dwBufLen=0xd610 | out: pbData=0x2809084*, pdwDataLen=0x593f2d4*=0xd610) returned 1
	[0124.511] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28166a0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28166a0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.511] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0124.511] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.511] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.511] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv", lpFilePart=0x0) returned 0x26
	[0124.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.511] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\v11_sl6n u.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.517] GetFileType (hFile=0x5dc) returned 0x1
	[0124.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.518] GetFileType (hFile=0x5dc) returned 0x1
	[0124.518] WriteFile (in: hFile=0x5dc, lpBuffer=0x2809084*, nNumberOfBytesToWrite=0xd610, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2809084*, lpNumberOfBytesWritten=0x593f2c0*=0xd610, lpOverlapped=0x0) returned 1
	[0124.520] CloseHandle (hObject=0x5dc) returned 1
	[0124.535] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv", lpFilePart=0x0) returned 0x26
	[0124.535] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0124.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.535] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\v11_sl6n u.flv"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9356b80, ftCreationTime.dwHighDateTime=0x1d4ce45, ftLastAccessTime.dwLowDateTime=0x95fdfef0, ftLastAccessTime.dwHighDateTime=0x1d4c59f, ftLastWriteTime.dwLowDateTime=0x848cf79e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xd610)) returned 1
	[0124.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.536] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\v11_sl6n u.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\V11_Sl6n U.flv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\v11_sl6n u.flv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.551] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a", lpFilePart=0x0) returned 0x30
	[0124.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.552] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\vaulzytkj-2u 18trt_x.m4a"), fInfoLevelId=0x0, lpFileInformation=0x28169ec | out: lpFileInformation=0x28169ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54558ff0, ftCreationTime.dwHighDateTime=0x1d4cd23, ftLastAccessTime.dwLowDateTime=0x1e86bce0, ftLastAccessTime.dwHighDateTime=0x1d4c8a6, ftLastWriteTime.dwLowDateTime=0x1e86bce0, ftLastWriteTime.dwHighDateTime=0x1d4c8a6, nFileSizeHigh=0x0, nFileSizeLow=0x540a)) returned 1
	[0124.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.552] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a", lpFilePart=0x0) returned 0x30
	[0124.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.552] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\vaulzytkj-2u 18trt_x.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.553] GetFileType (hFile=0x5dc) returned 0x1
	[0124.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.553] GetFileType (hFile=0x5dc) returned 0x1
	[0124.553] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x540a
	[0124.553] ReadFile (in: hFile=0x5dc, lpBuffer=0x2816c24, nNumberOfBytesToRead=0x540a, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2816c24*, lpNumberOfBytesRead=0x593f2cc*=0x540a, lpOverlapped=0x0) returned 1
	[0124.553] CloseHandle (hObject=0x5dc) returned 1
	[0124.554] CryptDestroyKey (hKey=0x82b280) returned 1
	[0124.554] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.554] CryptImportKey (in: hProv=0x7f93c0, pbData=0x281c0cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0124.554] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.554] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.554] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0124.554] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.554] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x281c184*=0x1, dwFlags=0x0) returned 1
	[0124.554] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x281c150, dwFlags=0x0) returned 1
	[0124.554] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x281c194*, pdwDataLen=0x593f2d4*=0x5410, dwBufLen=0x5410 | out: pbData=0x281c194*, pdwDataLen=0x593f2d4*=0x5410) returned 1
	[0124.554] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28215b0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28215b0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.554] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0124.554] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.555] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a", lpFilePart=0x0) returned 0x30
	[0124.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.556] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\vaulzytkj-2u 18trt_x.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.573] GetFileType (hFile=0x5dc) returned 0x1
	[0124.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.573] GetFileType (hFile=0x5dc) returned 0x1
	[0124.573] WriteFile (in: hFile=0x5dc, lpBuffer=0x281c194*, nNumberOfBytesToWrite=0x5410, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x281c194*, lpNumberOfBytesWritten=0x593f2c0*=0x5410, lpOverlapped=0x0) returned 1
	[0124.575] CloseHandle (hObject=0x5dc) returned 1
	[0124.578] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a", lpFilePart=0x0) returned 0x30
	[0124.578] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0124.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.578] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\vaulzytkj-2u 18trt_x.m4a"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54558ff0, ftCreationTime.dwHighDateTime=0x1d4cd23, ftLastAccessTime.dwLowDateTime=0x1e86bce0, ftLastAccessTime.dwHighDateTime=0x1d4c8a6, ftLastWriteTime.dwLowDateTime=0x8494204e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5410)) returned 1
	[0124.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.578] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\vaulzytkj-2u 18trt_x.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vAulzytKJ-2U 18tRT_x.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\vaulzytkj-2u 18trt_x.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.602] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a", lpFilePart=0x0) returned 0x28
	[0124.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\wt0-ikngkiu5.m4a"), fInfoLevelId=0x0, lpFileInformation=0x2821974 | out: lpFileInformation=0x2821974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf48142a0, ftCreationTime.dwHighDateTime=0x1d4cddf, ftLastAccessTime.dwLowDateTime=0x83304100, ftLastAccessTime.dwHighDateTime=0x1d4c93e, ftLastWriteTime.dwLowDateTime=0x83304100, ftLastWriteTime.dwHighDateTime=0x1d4c93e, nFileSizeHigh=0x0, nFileSizeLow=0x1365c)) returned 1
	[0124.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.603] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a", lpFilePart=0x0) returned 0x28
	[0124.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.603] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\wt0-ikngkiu5.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.603] GetFileType (hFile=0x5dc) returned 0x1
	[0124.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.603] GetFileType (hFile=0x5dc) returned 0x1
	[0124.604] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1365c
	[0124.604] ReadFile (in: hFile=0x5dc, lpBuffer=0x2821b6c, nNumberOfBytesToRead=0x1365c, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2821b6c*, lpNumberOfBytesRead=0x593f2cc*=0x1365c, lpOverlapped=0x0) returned 1
	[0124.604] CloseHandle (hObject=0x5dc) returned 1
	[0124.605] CryptDestroyKey (hKey=0x82b300) returned 1
	[0124.605] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.605] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2835264, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b4c0) returned 1
	[0124.605] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.605] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.605] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b440) returned 1
	[0124.605] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.605] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x283531c*=0x1, dwFlags=0x0) returned 1
	[0124.605] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x28352e8, dwFlags=0x0) returned 1
	[0124.605] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x283532c*, pdwDataLen=0x593f2d4*=0x13660, dwBufLen=0x13660 | out: pbData=0x283532c*, pdwDataLen=0x593f2d4*=0x13660) returned 1
	[0124.605] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2848998*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2848998*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.605] CryptDestroyKey (hKey=0x82b440) returned 1
	[0124.605] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.605] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a", lpFilePart=0x0) returned 0x28
	[0124.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.605] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\wt0-ikngkiu5.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.609] GetFileType (hFile=0x5dc) returned 0x1
	[0124.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.609] GetFileType (hFile=0x5dc) returned 0x1
	[0124.609] WriteFile (in: hFile=0x5dc, lpBuffer=0x283532c*, nNumberOfBytesToWrite=0x13660, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x283532c*, lpNumberOfBytesWritten=0x593f2c0*=0x13660, lpOverlapped=0x0) returned 1
	[0124.610] CloseHandle (hObject=0x5dc) returned 1
	[0124.612] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a", lpFilePart=0x0) returned 0x28
	[0124.612] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0124.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.612] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\wt0-ikngkiu5.m4a"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf48142a0, ftCreationTime.dwHighDateTime=0x1d4cddf, ftLastAccessTime.dwLowDateTime=0x83304100, ftLastAccessTime.dwHighDateTime=0x1d4c93e, ftLastWriteTime.dwLowDateTime=0x849b470a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13660)) returned 1
	[0124.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.612] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\wt0-ikngkiu5.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Wt0-IknGkIU5.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\wt0-ikngkiu5.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.615] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi", lpFilePart=0x0) returned 0x23
	[0124.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.616] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\x1qatak.avi"), fInfoLevelId=0x0, lpFileInformation=0x2848cfc | out: lpFileInformation=0x2848cfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24d5b20, ftCreationTime.dwHighDateTime=0x1d4cb87, ftLastAccessTime.dwLowDateTime=0x135f0900, ftLastAccessTime.dwHighDateTime=0x1d4cb29, ftLastWriteTime.dwLowDateTime=0x135f0900, ftLastWriteTime.dwHighDateTime=0x1d4cb29, nFileSizeHigh=0x0, nFileSizeLow=0xc4bb)) returned 1
	[0124.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi", lpFilePart=0x0) returned 0x23
	[0124.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\x1qatak.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.616] GetFileType (hFile=0x5dc) returned 0x1
	[0124.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.616] GetFileType (hFile=0x5dc) returned 0x1
	[0124.616] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xc4bb
	[0124.616] ReadFile (in: hFile=0x5dc, lpBuffer=0x2848ec4, nNumberOfBytesToRead=0xc4bb, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2848ec4*, lpNumberOfBytesRead=0x593f2cc*=0xc4bb, lpOverlapped=0x0) returned 1
	[0124.617] CloseHandle (hObject=0x5dc) returned 1
	[0124.617] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0124.617] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.617] CryptImportKey (in: hProv=0x7f93c0, pbData=0x285541c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0124.617] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.617] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.617] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0124.618] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.618] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x28554d4*=0x1, dwFlags=0x0) returned 1
	[0124.618] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x28554a0, dwFlags=0x0) returned 1
	[0124.618] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28554e4*, pdwDataLen=0x593f2d4*=0xc4c0, dwBufLen=0xc4c0 | out: pbData=0x28554e4*, pdwDataLen=0x593f2d4*=0xc4c0) returned 1
	[0124.618] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28619b0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28619b0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.618] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0124.618] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.618] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.618] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi", lpFilePart=0x0) returned 0x23
	[0124.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.618] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\x1qatak.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.625] GetFileType (hFile=0x5dc) returned 0x1
	[0124.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.625] GetFileType (hFile=0x5dc) returned 0x1
	[0124.625] WriteFile (in: hFile=0x5dc, lpBuffer=0x28554e4*, nNumberOfBytesToWrite=0xc4c0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x28554e4*, lpNumberOfBytesWritten=0x593f2c0*=0xc4c0, lpOverlapped=0x0) returned 1
	[0124.627] CloseHandle (hObject=0x5dc) returned 1
	[0124.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi", lpFilePart=0x0) returned 0x23
	[0124.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0124.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.629] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\x1qatak.avi"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24d5b20, ftCreationTime.dwHighDateTime=0x1d4cb87, ftLastAccessTime.dwLowDateTime=0x135f0900, ftLastAccessTime.dwHighDateTime=0x1d4cb29, ftLastWriteTime.dwLowDateTime=0x849da9f5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xc4c0)) returned 1
	[0124.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.629] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\x1qatak.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\x1qatAk.avi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\x1qatak.avi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.631] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav", lpFilePart=0x0) returned 0x24
	[0124.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.632] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\y-ylwaui.wav"), fInfoLevelId=0x0, lpFileInformation=0x2861cd8 | out: lpFileInformation=0x2861cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58028100, ftCreationTime.dwHighDateTime=0x1d4cd94, ftLastAccessTime.dwLowDateTime=0x6253efb0, ftLastAccessTime.dwHighDateTime=0x1d4c97d, ftLastWriteTime.dwLowDateTime=0x6253efb0, ftLastWriteTime.dwHighDateTime=0x1d4c97d, nFileSizeHigh=0x0, nFileSizeLow=0x3aeb)) returned 1
	[0124.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.632] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav", lpFilePart=0x0) returned 0x24
	[0124.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.632] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\y-ylwaui.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.633] GetFileType (hFile=0x5dc) returned 0x1
	[0124.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.633] GetFileType (hFile=0x5dc) returned 0x1
	[0124.633] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3aeb
	[0124.633] ReadFile (in: hFile=0x5dc, lpBuffer=0x2861eb0, nNumberOfBytesToRead=0x3aeb, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2861eb0*, lpNumberOfBytesRead=0x593f2cc*=0x3aeb, lpOverlapped=0x0) returned 1
	[0124.634] CloseHandle (hObject=0x5dc) returned 1
	[0124.634] CryptDestroyKey (hKey=0x82b400) returned 1
	[0124.634] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.634] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2865a38, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0124.634] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.634] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.635] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0124.635] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.635] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2865af0*=0x1, dwFlags=0x0) returned 1
	[0124.635] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2865abc, dwFlags=0x0) returned 1
	[0124.649] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2630034*, pdwDataLen=0x593f2d4*=0x3af0, dwBufLen=0x3af0 | out: pbData=0x2630034*, pdwDataLen=0x593f2d4*=0x3af0) returned 1
	[0124.649] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2633b30*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2633b30*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.649] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0124.649] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.649] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.649] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav", lpFilePart=0x0) returned 0x24
	[0124.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\y-ylwaui.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.652] GetFileType (hFile=0x5dc) returned 0x1
	[0124.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.652] GetFileType (hFile=0x5dc) returned 0x1
	[0124.652] WriteFile (in: hFile=0x5dc, lpBuffer=0x2630034*, nNumberOfBytesToWrite=0x3af0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2630034*, lpNumberOfBytesWritten=0x593f2c0*=0x3af0, lpOverlapped=0x0) returned 1
	[0124.653] CloseHandle (hObject=0x5dc) returned 1
	[0124.654] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav", lpFilePart=0x0) returned 0x24
	[0124.654] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x53
	[0124.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.654] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\y-ylwaui.wav"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58028100, ftCreationTime.dwHighDateTime=0x1d4cd94, ftLastAccessTime.dwLowDateTime=0x6253efb0, ftLastAccessTime.dwHighDateTime=0x1d4c97d, ftLastWriteTime.dwLowDateTime=0x84a00c0e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3af0)) returned 1
	[0124.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.655] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\y-ylwaui.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Y-YLwAUI.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\y-ylwaui.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.657] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3", lpFilePart=0x0) returned 0x28
	[0124.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.657] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\_ihn8mxrqkyt.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2633e64 | out: lpFileInformation=0x2633e64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c28c80, ftCreationTime.dwHighDateTime=0x1d4cf1f, ftLastAccessTime.dwLowDateTime=0x976acdb0, ftLastAccessTime.dwHighDateTime=0x1d4d0c9, ftLastWriteTime.dwLowDateTime=0x976acdb0, ftLastWriteTime.dwHighDateTime=0x1d4d0c9, nFileSizeHigh=0x0, nFileSizeLow=0x865c)) returned 1
	[0124.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.658] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3", lpFilePart=0x0) returned 0x28
	[0124.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.658] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\_ihn8mxrqkyt.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.658] GetFileType (hFile=0x5dc) returned 0x1
	[0124.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.658] GetFileType (hFile=0x5dc) returned 0x1
	[0124.658] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x865c
	[0124.658] ReadFile (in: hFile=0x5dc, lpBuffer=0x263405c, nNumberOfBytesToRead=0x865c, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x263405c*, lpNumberOfBytesRead=0x593f2cc*=0x865c, lpOverlapped=0x0) returned 1
	[0124.659] CloseHandle (hObject=0x5dc) returned 1
	[0124.659] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0124.660] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.660] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263c754, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b000) returned 1
	[0124.660] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.660] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.660] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0124.660] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.660] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x263c80c*=0x1, dwFlags=0x0) returned 1
	[0124.660] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x263c7d8, dwFlags=0x0) returned 1
	[0124.660] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263c81c*, pdwDataLen=0x593f2d4*=0x8660, dwBufLen=0x8660 | out: pbData=0x263c81c*, pdwDataLen=0x593f2d4*=0x8660) returned 1
	[0124.660] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2644e88*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2644e88*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.660] CryptDestroyKey (hKey=0x82b540) returned 1
	[0124.660] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.660] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.660] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3", lpFilePart=0x0) returned 0x28
	[0124.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.660] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\_ihn8mxrqkyt.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.663] GetFileType (hFile=0x5dc) returned 0x1
	[0124.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.663] GetFileType (hFile=0x5dc) returned 0x1
	[0124.663] WriteFile (in: hFile=0x5dc, lpBuffer=0x263c81c*, nNumberOfBytesToWrite=0x8660, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x263c81c*, lpNumberOfBytesWritten=0x593f2c0*=0x8660, lpOverlapped=0x0) returned 1
	[0124.664] CloseHandle (hObject=0x5dc) returned 1
	[0124.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3", lpFilePart=0x0) returned 0x28
	[0124.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0124.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\_ihn8mxrqkyt.mp3"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c28c80, ftCreationTime.dwHighDateTime=0x1d4cf1f, ftLastAccessTime.dwLowDateTime=0x976acdb0, ftLastAccessTime.dwHighDateTime=0x1d4d0c9, ftLastWriteTime.dwLowDateTime=0x84a26e45, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8660)) returned 1
	[0124.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.665] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\_ihn8mxrqkyt.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\_ihN8mXrQKyt.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\_ihn8mxrqkyt.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.667] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx", lpFilePart=0x0) returned 0x25
	[0124.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.667] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx" (normalized: "c:\\users\\fd1hvy\\documents\\1utpuv.docx"), fInfoLevelId=0x0, lpFileInformation=0x26451ec | out: lpFileInformation=0x26451ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdd06280, ftCreationTime.dwHighDateTime=0x1d4f292, ftLastAccessTime.dwLowDateTime=0x40571150, ftLastAccessTime.dwHighDateTime=0x1d4d961, ftLastWriteTime.dwLowDateTime=0x40571150, ftLastWriteTime.dwHighDateTime=0x1d4d961, nFileSizeHigh=0x0, nFileSizeLow=0x7711)) returned 1
	[0124.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.667] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx", lpFilePart=0x0) returned 0x25
	[0124.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.668] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx" (normalized: "c:\\users\\fd1hvy\\documents\\1utpuv.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.668] GetFileType (hFile=0x5dc) returned 0x1
	[0124.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.668] GetFileType (hFile=0x5dc) returned 0x1
	[0124.668] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x7711
	[0124.668] ReadFile (in: hFile=0x5dc, lpBuffer=0x26453bc, nNumberOfBytesToRead=0x7711, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26453bc*, lpNumberOfBytesRead=0x593f2cc*=0x7711, lpOverlapped=0x0) returned 1
	[0124.669] CloseHandle (hObject=0x5dc) returned 1
	[0124.669] CryptDestroyKey (hKey=0x82b000) returned 1
	[0124.669] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.669] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264cb6c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0124.669] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.669] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.669] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0124.669] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.669] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x264cc24*=0x1, dwFlags=0x0) returned 1
	[0124.670] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x264cbf0, dwFlags=0x0) returned 1
	[0124.670] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264cc34*, pdwDataLen=0x593f2d4*=0x7720, dwBufLen=0x7720 | out: pbData=0x264cc34*, pdwDataLen=0x593f2d4*=0x7720) returned 1
	[0124.670] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2654360*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2654360*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.670] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0124.670] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.670] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx", lpFilePart=0x0) returned 0x25
	[0124.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.670] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx" (normalized: "c:\\users\\fd1hvy\\documents\\1utpuv.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.672] GetFileType (hFile=0x5dc) returned 0x1
	[0124.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.672] GetFileType (hFile=0x5dc) returned 0x1
	[0124.672] WriteFile (in: hFile=0x5dc, lpBuffer=0x264cc34*, nNumberOfBytesToWrite=0x7720, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x264cc34*, lpNumberOfBytesWritten=0x593f2c0*=0x7720, lpOverlapped=0x0) returned 1
	[0124.673] CloseHandle (hObject=0x5dc) returned 1
	[0124.674] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx", lpFilePart=0x0) returned 0x25
	[0124.674] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x54
	[0124.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.674] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx" (normalized: "c:\\users\\fd1hvy\\documents\\1utpuv.docx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdd06280, ftCreationTime.dwHighDateTime=0x1d4f292, ftLastAccessTime.dwLowDateTime=0x40571150, ftLastAccessTime.dwHighDateTime=0x1d4d961, ftLastWriteTime.dwLowDateTime=0x84a4dc93, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7720)) returned 1
	[0124.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.674] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx" (normalized: "c:\\users\\fd1hvy\\documents\\1utpuv.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\1UtPUV.docx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\1utpuv.docx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.675] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx", lpFilePart=0x0) returned 0x2e
	[0124.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.675] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2kbiywfbbfh7sv4.pptx"), fInfoLevelId=0x0, lpFileInformation=0x265469c | out: lpFileInformation=0x265469c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc306d20, ftCreationTime.dwHighDateTime=0x1d514a4, ftLastAccessTime.dwLowDateTime=0xab460030, ftLastAccessTime.dwHighDateTime=0x1d4a189, ftLastWriteTime.dwLowDateTime=0xab460030, ftLastWriteTime.dwHighDateTime=0x1d4a189, nFileSizeHigh=0x0, nFileSizeLow=0x2895)) returned 1
	[0124.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.676] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx", lpFilePart=0x0) returned 0x2e
	[0124.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.676] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2kbiywfbbfh7sv4.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.676] GetFileType (hFile=0x5dc) returned 0x1
	[0124.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.676] GetFileType (hFile=0x5dc) returned 0x1
	[0124.676] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2895
	[0124.676] ReadFile (in: hFile=0x5dc, lpBuffer=0x26548bc, nNumberOfBytesToRead=0x2895, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26548bc*, lpNumberOfBytesRead=0x593f2cc*=0x2895, lpOverlapped=0x0) returned 1
	[0124.677] CloseHandle (hObject=0x5dc) returned 1
	[0124.677] CryptDestroyKey (hKey=0x82b400) returned 1
	[0124.677] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.677] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26571f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b200) returned 1
	[0124.677] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.677] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.678] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0124.678] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.678] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26572a8*=0x1, dwFlags=0x0) returned 1
	[0124.678] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2657274, dwFlags=0x0) returned 1
	[0124.678] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26572b8*, pdwDataLen=0x593f2d4*=0x28a0, dwBufLen=0x28a0 | out: pbData=0x26572b8*, pdwDataLen=0x593f2d4*=0x28a0) returned 1
	[0124.678] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2659b64*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2659b64*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.678] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0124.678] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.678] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx", lpFilePart=0x0) returned 0x2e
	[0124.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.678] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2kbiywfbbfh7sv4.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.679] GetFileType (hFile=0x5dc) returned 0x1
	[0124.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.680] GetFileType (hFile=0x5dc) returned 0x1
	[0124.680] WriteFile (in: hFile=0x5dc, lpBuffer=0x26572b8*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26572b8*, lpNumberOfBytesWritten=0x593f2c0*=0x28a0, lpOverlapped=0x0) returned 1
	[0124.681] CloseHandle (hObject=0x5dc) returned 1
	[0124.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx", lpFilePart=0x0) returned 0x2e
	[0124.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0124.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.681] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2kbiywfbbfh7sv4.pptx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc306d20, ftCreationTime.dwHighDateTime=0x1d514a4, ftLastAccessTime.dwLowDateTime=0xab460030, ftLastAccessTime.dwHighDateTime=0x1d4a189, ftLastWriteTime.dwLowDateTime=0x84a4dc93, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x28a0)) returned 1
	[0124.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.681] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2kbiywfbbfh7sv4.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\2KbiYwfbbFh7sv4.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\2kbiywfbbfh7sv4.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx", lpFilePart=0x0) returned 0x27
	[0124.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\479_nsie.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2659f0c | out: lpFileInformation=0x2659f0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf60d220, ftCreationTime.dwHighDateTime=0x1d4c388, ftLastAccessTime.dwLowDateTime=0xc006c210, ftLastAccessTime.dwHighDateTime=0x1d4fd01, ftLastWriteTime.dwLowDateTime=0xc006c210, ftLastWriteTime.dwHighDateTime=0x1d4fd01, nFileSizeHigh=0x0, nFileSizeLow=0xe128)) returned 1
	[0124.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx", lpFilePart=0x0) returned 0x27
	[0124.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.683] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\479_nsie.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.683] GetFileType (hFile=0x5dc) returned 0x1
	[0124.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.683] GetFileType (hFile=0x5dc) returned 0x1
	[0124.683] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xe128
	[0124.683] ReadFile (in: hFile=0x5dc, lpBuffer=0x265a0ec, nNumberOfBytesToRead=0xe128, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x265a0ec*, lpNumberOfBytesRead=0x593f2cc*=0xe128, lpOverlapped=0x0) returned 1
	[0124.684] CloseHandle (hObject=0x5dc) returned 1
	[0124.684] CryptDestroyKey (hKey=0x82b200) returned 1
	[0124.684] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.684] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26682b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b080) returned 1
	[0124.684] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.684] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.684] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0124.684] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.684] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2668368*=0x1, dwFlags=0x0) returned 1
	[0124.685] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2668334, dwFlags=0x0) returned 1
	[0124.685] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2668378*, pdwDataLen=0x593f2d4*=0xe130, dwBufLen=0xe130 | out: pbData=0x2668378*, pdwDataLen=0x593f2d4*=0xe130) returned 1
	[0124.685] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26764b4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26764b4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.685] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0124.685] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.685] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.685] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx", lpFilePart=0x0) returned 0x27
	[0124.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.685] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\479_nsie.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.688] GetFileType (hFile=0x5dc) returned 0x1
	[0124.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.688] GetFileType (hFile=0x5dc) returned 0x1
	[0124.688] WriteFile (in: hFile=0x5dc, lpBuffer=0x2668378*, nNumberOfBytesToWrite=0xe130, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2668378*, lpNumberOfBytesWritten=0x593f2c0*=0xe130, lpOverlapped=0x0) returned 1
	[0124.690] CloseHandle (hObject=0x5dc) returned 1
	[0124.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx", lpFilePart=0x0) returned 0x27
	[0124.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0124.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.690] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\479_nsie.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf60d220, ftCreationTime.dwHighDateTime=0x1d4c388, ftLastAccessTime.dwLowDateTime=0xc006c210, ftLastAccessTime.dwHighDateTime=0x1d4fd01, ftLastWriteTime.dwLowDateTime=0x84a73305, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xe130)) returned 1
	[0124.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.690] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\479_nsie.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\479_NSIE.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\479_nsie.xlsx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29
	[0124.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.691] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), fInfoLevelId=0x0, lpFileInformation=0x2676808 | out: lpFileInformation=0x2676808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000)) returned 1
	[0124.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.692] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29
	[0124.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.692] GetFileType (hFile=0x5dc) returned 0x1
	[0124.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.692] GetFileType (hFile=0x5dc) returned 0x1
	[0124.692] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x55000
	[0124.693] ReadFile (in: hFile=0x5dc, lpBuffer=0x77f3de8, nNumberOfBytesToRead=0x55000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x77f3de8*, lpNumberOfBytesRead=0x593f2cc*=0x55000, lpOverlapped=0x0) returned 1
	[0124.751] CloseHandle (hObject=0x5dc) returned 1
	[0124.751] CryptDestroyKey (hKey=0x82b080) returned 1
	[0124.751] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.751] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2676a88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b0c0) returned 1
	[0124.751] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.751] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.751] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0124.751] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.751] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2676b40*=0x1, dwFlags=0x0) returned 1
	[0124.751] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2676b0c, dwFlags=0x0) returned 1
	[0124.756] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7848e08*, pdwDataLen=0x593f2d4*=0x55010, dwBufLen=0x55010 | out: pbData=0x7848e08*, pdwDataLen=0x593f2d4*=0x55010) returned 1
	[0124.757] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2676b50*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2676b50*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.757] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0124.757] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.757] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.757] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29
	[0124.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.757] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.761] GetFileType (hFile=0x5dc) returned 0x1
	[0124.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.761] GetFileType (hFile=0x5dc) returned 0x1
	[0124.761] WriteFile (in: hFile=0x5dc, lpBuffer=0x7848e08*, nNumberOfBytesToWrite=0x55010, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x7848e08*, lpNumberOfBytesWritten=0x593f2c0*=0x55010, lpOverlapped=0x0) returned 1
	[0124.768] CloseHandle (hObject=0x5dc) returned 1
	[0124.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29
	[0124.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x58
	[0124.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.768] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x84b31ed8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x55010)) returned 1
	[0124.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.769] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.792] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0124.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.792] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x2676ebc | out: lpFileInformation=0x2676ebc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192)) returned 1
	[0124.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0124.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.793] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.793] GetFileType (hFile=0x5dc) returned 0x1
	[0124.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.793] GetFileType (hFile=0x5dc) returned 0x1
	[0124.793] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x192
	[0124.793] ReadFile (in: hFile=0x5dc, lpBuffer=0x267722c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x267722c*, lpNumberOfBytesRead=0x593f2cc*=0x192, lpOverlapped=0x0) returned 1
	[0124.794] CloseHandle (hObject=0x5dc) returned 1
	[0124.794] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0124.794] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.795] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26782c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0124.795] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.795] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.795] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0124.795] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.795] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2678380*=0x1, dwFlags=0x0) returned 1
	[0124.795] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x267834c, dwFlags=0x0) returned 1
	[0124.795] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2678390*, pdwDataLen=0x593f2d4*=0x1a0, dwBufLen=0x1a0 | out: pbData=0x2678390*, pdwDataLen=0x593f2d4*=0x1a0) returned 1
	[0124.795] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267853c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x267853c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.795] CryptDestroyKey (hKey=0x82b280) returned 1
	[0124.795] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.795] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0124.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0124.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0124.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx", lpFilePart=0x0) returned 0x24
	[0124.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.805] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\eaebb.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2678a28 | out: lpFileInformation=0x2678a28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4642ae20, ftCreationTime.dwHighDateTime=0x1d4c8c3, ftLastAccessTime.dwLowDateTime=0x767607a0, ftLastAccessTime.dwHighDateTime=0x1d4ff45, ftLastWriteTime.dwLowDateTime=0x767607a0, ftLastWriteTime.dwHighDateTime=0x1d4ff45, nFileSizeHigh=0x0, nFileSizeLow=0x181ba)) returned 1
	[0124.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx", lpFilePart=0x0) returned 0x24
	[0124.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.806] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\eaebb.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.806] GetFileType (hFile=0x5dc) returned 0x1
	[0124.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.806] GetFileType (hFile=0x5dc) returned 0x1
	[0124.806] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x181ba
	[0124.807] ReadFile (in: hFile=0x5dc, lpBuffer=0x789de38, nNumberOfBytesToRead=0x181ba, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x789de38*, lpNumberOfBytesRead=0x593f2cc*=0x181ba, lpOverlapped=0x0) returned 1
	[0124.809] CloseHandle (hObject=0x5dc) returned 1
	[0124.809] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0124.809] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.809] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2678c88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0124.810] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.810] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.810] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0124.810] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.810] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2678d40*=0x1, dwFlags=0x0) returned 1
	[0124.810] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2678d0c, dwFlags=0x0) returned 1
	[0124.816] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x78b6010*, pdwDataLen=0x593f2d4*=0x181c0, dwBufLen=0x181c0 | out: pbData=0x78b6010*, pdwDataLen=0x593f2d4*=0x181c0) returned 1
	[0124.816] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2678d50*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2678d50*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.817] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0124.817] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.817] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx", lpFilePart=0x0) returned 0x24
	[0124.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\eaebb.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.823] GetFileType (hFile=0x5dc) returned 0x1
	[0124.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.823] GetFileType (hFile=0x5dc) returned 0x1
	[0124.823] WriteFile (in: hFile=0x5dc, lpBuffer=0x78b6010*, nNumberOfBytesToWrite=0x181c0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x78b6010*, lpNumberOfBytesWritten=0x593f2c0*=0x181c0, lpOverlapped=0x0) returned 1
	[0124.825] CloseHandle (hObject=0x5dc) returned 1
	[0124.826] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx", lpFilePart=0x0) returned 0x24
	[0124.826] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x53
	[0124.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.826] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\eaebb.pptx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4642ae20, ftCreationTime.dwHighDateTime=0x1d4c8c3, ftLastAccessTime.dwLowDateTime=0x767607a0, ftLastAccessTime.dwHighDateTime=0x1d4ff45, ftLastWriteTime.dwLowDateTime=0x84ba449c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x181c0)) returned 1
	[0124.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.826] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\eaebb.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\EAEbB.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\eaebb.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.827] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx", lpFilePart=0x0) returned 0x27
	[0124.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.827] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\et6gcwoh.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2679080 | out: lpFileInformation=0x2679080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ca01d0, ftCreationTime.dwHighDateTime=0x1d4aa02, ftLastAccessTime.dwLowDateTime=0xa76b3100, ftLastAccessTime.dwHighDateTime=0x1d4fc20, ftLastWriteTime.dwLowDateTime=0xa76b3100, ftLastWriteTime.dwHighDateTime=0x1d4fc20, nFileSizeHigh=0x0, nFileSizeLow=0x15215)) returned 1
	[0124.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.828] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx", lpFilePart=0x0) returned 0x27
	[0124.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.828] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\et6gcwoh.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.828] GetFileType (hFile=0x5dc) returned 0x1
	[0124.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.828] GetFileType (hFile=0x5dc) returned 0x1
	[0124.829] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x15215
	[0124.829] ReadFile (in: hFile=0x5dc, lpBuffer=0x78ce1f0, nNumberOfBytesToRead=0x15215, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x78ce1f0*, lpNumberOfBytesRead=0x593f2cc*=0x15215, lpOverlapped=0x0) returned 1
	[0124.839] CloseHandle (hObject=0x5dc) returned 1
	[0124.839] CryptDestroyKey (hKey=0x82b400) returned 1
	[0124.839] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.839] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26792f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b2c0) returned 1
	[0124.839] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.839] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.839] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0124.839] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.839] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26793a8*=0x1, dwFlags=0x0) returned 1
	[0124.839] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2679374, dwFlags=0x0) returned 1
	[0124.841] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x78e3428*, pdwDataLen=0x593f2d4*=0x15220, dwBufLen=0x15220 | out: pbData=0x78e3428*, pdwDataLen=0x593f2d4*=0x15220) returned 1
	[0124.841] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26793b8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26793b8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.841] CryptDestroyKey (hKey=0x82b540) returned 1
	[0124.841] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.841] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.841] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx", lpFilePart=0x0) returned 0x27
	[0124.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.841] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\et6gcwoh.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.843] GetFileType (hFile=0x5dc) returned 0x1
	[0124.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.844] GetFileType (hFile=0x5dc) returned 0x1
	[0124.844] WriteFile (in: hFile=0x5dc, lpBuffer=0x78e3428*, nNumberOfBytesToWrite=0x15220, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x78e3428*, lpNumberOfBytesWritten=0x593f2c0*=0x15220, lpOverlapped=0x0) returned 1
	[0124.846] CloseHandle (hObject=0x5dc) returned 1
	[0124.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx", lpFilePart=0x0) returned 0x27
	[0124.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0124.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.846] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\et6gcwoh.pptx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ca01d0, ftCreationTime.dwHighDateTime=0x1d4aa02, ftLastAccessTime.dwLowDateTime=0xa76b3100, ftLastAccessTime.dwHighDateTime=0x1d4fc20, ftLastWriteTime.dwLowDateTime=0x84bf09a2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x15220)) returned 1
	[0124.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.846] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\et6gcwoh.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\et6GcwOh.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\et6gcwoh.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.855] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx", lpFilePart=0x0) returned 0x30
	[0124.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.855] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ggwvhzsj4qtsuyrg9.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x267970c | out: lpFileInformation=0x267970c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69abff90, ftCreationTime.dwHighDateTime=0x1d4edaa, ftLastAccessTime.dwLowDateTime=0x4625d5e0, ftLastAccessTime.dwHighDateTime=0x1d4d30c, ftLastWriteTime.dwLowDateTime=0x4625d5e0, ftLastWriteTime.dwHighDateTime=0x1d4d30c, nFileSizeHigh=0x0, nFileSizeLow=0xf72a)) returned 1
	[0124.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.857] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx", lpFilePart=0x0) returned 0x30
	[0124.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.857] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ggwvhzsj4qtsuyrg9.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.857] GetFileType (hFile=0x5dc) returned 0x1
	[0124.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.858] GetFileType (hFile=0x5dc) returned 0x1
	[0124.858] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xf72a
	[0124.858] ReadFile (in: hFile=0x5dc, lpBuffer=0x267993c, nNumberOfBytesToRead=0xf72a, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x267993c*, lpNumberOfBytesRead=0x593f2cc*=0xf72a, lpOverlapped=0x0) returned 1
	[0124.860] CloseHandle (hObject=0x5dc) returned 1
	[0124.860] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0124.860] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.860] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2689104, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b200) returned 1
	[0124.860] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.860] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.860] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b100) returned 1
	[0124.860] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.860] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26891bc*=0x1, dwFlags=0x0) returned 1
	[0124.861] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2689188, dwFlags=0x0) returned 1
	[0124.861] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26891cc*, pdwDataLen=0x593f2d4*=0xf730, dwBufLen=0xf730 | out: pbData=0x26891cc*, pdwDataLen=0x593f2d4*=0xf730) returned 1
	[0124.861] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2698908*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2698908*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.861] CryptDestroyKey (hKey=0x82b100) returned 1
	[0124.861] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.861] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.861] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx", lpFilePart=0x0) returned 0x30
	[0124.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.861] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ggwvhzsj4qtsuyrg9.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.867] GetFileType (hFile=0x5dc) returned 0x1
	[0124.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.867] GetFileType (hFile=0x5dc) returned 0x1
	[0124.867] WriteFile (in: hFile=0x5dc, lpBuffer=0x26891cc*, nNumberOfBytesToWrite=0xf730, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26891cc*, lpNumberOfBytesWritten=0x593f2c0*=0xf730, lpOverlapped=0x0) returned 1
	[0124.870] CloseHandle (hObject=0x5dc) returned 1
	[0124.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx", lpFilePart=0x0) returned 0x30
	[0124.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0124.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.871] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ggwvhzsj4qtsuyrg9.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69abff90, ftCreationTime.dwHighDateTime=0x1d4edaa, ftLastAccessTime.dwLowDateTime=0x4625d5e0, ftLastAccessTime.dwHighDateTime=0x1d4d30c, ftLastWriteTime.dwLowDateTime=0x84c16bc1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xf730)) returned 1
	[0124.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.871] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ggwvhzsj4qtsuyrg9.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\gGwVHZSJ4QTsUYRg9.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\ggwvhzsj4qtsuyrg9.xlsx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.872] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx", lpFilePart=0x0) returned 0x2f
	[0124.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx" (normalized: "c:\\users\\fd1hvy\\documents\\h9gxc2tns2wuu7-r.docx"), fInfoLevelId=0x0, lpFileInformation=0x2698cc8 | out: lpFileInformation=0x2698cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22cf82b0, ftCreationTime.dwHighDateTime=0x1d50676, ftLastAccessTime.dwLowDateTime=0x83e10c90, ftLastAccessTime.dwHighDateTime=0x1d4b257, ftLastWriteTime.dwLowDateTime=0x83e10c90, ftLastWriteTime.dwHighDateTime=0x1d4b257, nFileSizeHigh=0x0, nFileSizeLow=0x15cbc)) returned 1
	[0124.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.872] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx", lpFilePart=0x0) returned 0x2f
	[0124.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.872] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx" (normalized: "c:\\users\\fd1hvy\\documents\\h9gxc2tns2wuu7-r.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.873] GetFileType (hFile=0x5dc) returned 0x1
	[0124.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.873] GetFileType (hFile=0x5dc) returned 0x1
	[0124.873] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x15cbc
	[0124.873] ReadFile (in: hFile=0x5dc, lpBuffer=0x78f8668, nNumberOfBytesToRead=0x15cbc, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x78f8668*, lpNumberOfBytesRead=0x593f2cc*=0x15cbc, lpOverlapped=0x0) returned 1
	[0124.876] CloseHandle (hObject=0x5dc) returned 1
	[0124.877] CryptDestroyKey (hKey=0x82b200) returned 1
	[0124.877] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.877] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2698f78, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b2c0) returned 1
	[0124.877] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.877] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.877] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b5c0) returned 1
	[0124.877] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.877] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2699030*=0x1, dwFlags=0x0) returned 1
	[0124.877] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2698ffc, dwFlags=0x0) returned 1
	[0124.878] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x790e340*, pdwDataLen=0x593f2d4*=0x15cc0, dwBufLen=0x15cc0 | out: pbData=0x790e340*, pdwDataLen=0x593f2d4*=0x15cc0) returned 1
	[0124.879] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2699040*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2699040*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.879] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0124.879] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.879] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.879] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx", lpFilePart=0x0) returned 0x2f
	[0124.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.879] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx" (normalized: "c:\\users\\fd1hvy\\documents\\h9gxc2tns2wuu7-r.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.882] GetFileType (hFile=0x5dc) returned 0x1
	[0124.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.882] GetFileType (hFile=0x5dc) returned 0x1
	[0124.882] WriteFile (in: hFile=0x5dc, lpBuffer=0x790e340*, nNumberOfBytesToWrite=0x15cc0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x790e340*, lpNumberOfBytesWritten=0x593f2c0*=0x15cc0, lpOverlapped=0x0) returned 1
	[0124.884] CloseHandle (hObject=0x5dc) returned 1
	[0124.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx", lpFilePart=0x0) returned 0x2f
	[0124.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0124.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.885] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx" (normalized: "c:\\users\\fd1hvy\\documents\\h9gxc2tns2wuu7-r.docx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22cf82b0, ftCreationTime.dwHighDateTime=0x1d50676, ftLastAccessTime.dwLowDateTime=0x83e10c90, ftLastAccessTime.dwHighDateTime=0x1d4b257, ftLastWriteTime.dwLowDateTime=0x84c3ce9a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x15cc0)) returned 1
	[0124.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.885] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx" (normalized: "c:\\users\\fd1hvy\\documents\\h9gxc2tns2wuu7-r.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\H9gxc2Tns2wUu7-r.docx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\h9gxc2tns2wuu7-r.docx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.886] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv", lpFilePart=0x0) returned 0x2c
	[0124.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.886] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv" (normalized: "c:\\users\\fd1hvy\\documents\\j2cnjgjrqsehqu.csv"), fInfoLevelId=0x0, lpFileInformation=0x26993f4 | out: lpFileInformation=0x26993f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173cf440, ftCreationTime.dwHighDateTime=0x1d4ceff, ftLastAccessTime.dwLowDateTime=0x3b5d8ef0, ftLastAccessTime.dwHighDateTime=0x1d4d190, ftLastWriteTime.dwLowDateTime=0x3b5d8ef0, ftLastWriteTime.dwHighDateTime=0x1d4d190, nFileSizeHigh=0x0, nFileSizeLow=0xf0c7)) returned 1
	[0124.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.886] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv", lpFilePart=0x0) returned 0x2c
	[0124.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.887] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv" (normalized: "c:\\users\\fd1hvy\\documents\\j2cnjgjrqsehqu.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.887] GetFileType (hFile=0x5dc) returned 0x1
	[0124.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.887] GetFileType (hFile=0x5dc) returned 0x1
	[0124.887] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xf0c7
	[0124.887] ReadFile (in: hFile=0x5dc, lpBuffer=0x2699604, nNumberOfBytesToRead=0xf0c7, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2699604*, lpNumberOfBytesRead=0x593f2cc*=0xf0c7, lpOverlapped=0x0) returned 1
	[0124.888] CloseHandle (hObject=0x5dc) returned 1
	[0124.888] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0124.888] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.888] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a8768, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b4c0) returned 1
	[0124.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.888] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0124.888] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.888] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26a8820*=0x1, dwFlags=0x0) returned 1
	[0124.889] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26a87ec, dwFlags=0x0) returned 1
	[0124.889] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a8830*, pdwDataLen=0x593f2d4*=0xf0d0, dwBufLen=0xf0d0 | out: pbData=0x26a8830*, pdwDataLen=0x593f2d4*=0xf0d0) returned 1
	[0124.889] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b790c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26b790c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.889] CryptDestroyKey (hKey=0x82b540) returned 1
	[0124.889] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.889] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv", lpFilePart=0x0) returned 0x2c
	[0124.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.889] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv" (normalized: "c:\\users\\fd1hvy\\documents\\j2cnjgjrqsehqu.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.892] GetFileType (hFile=0x5dc) returned 0x1
	[0124.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.892] GetFileType (hFile=0x5dc) returned 0x1
	[0124.892] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a8830*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26a8830*, lpNumberOfBytesWritten=0x593f2c0*=0xf0d0, lpOverlapped=0x0) returned 1
	[0124.910] CloseHandle (hObject=0x5dc) returned 1
	[0124.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv", lpFilePart=0x0) returned 0x2c
	[0124.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0124.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.910] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv" (normalized: "c:\\users\\fd1hvy\\documents\\j2cnjgjrqsehqu.csv"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173cf440, ftCreationTime.dwHighDateTime=0x1d4ceff, ftLastAccessTime.dwLowDateTime=0x3b5d8ef0, ftLastAccessTime.dwHighDateTime=0x1d4d190, ftLastWriteTime.dwLowDateTime=0x84c8930d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xf0d0)) returned 1
	[0124.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.910] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv" (normalized: "c:\\users\\fd1hvy\\documents\\j2cnjgjrqsehqu.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\J2cnjGjRQSehqu.csv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\j2cnjgjrqsehqu.csv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx", lpFilePart=0x0) returned 0x24
	[0124.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jfjye.docx"), fInfoLevelId=0x0, lpFileInformation=0x26b7c9c | out: lpFileInformation=0x26b7c9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3ab5c70, ftCreationTime.dwHighDateTime=0x1d48d50, ftLastAccessTime.dwLowDateTime=0x1c26c300, ftLastAccessTime.dwHighDateTime=0x1d50000, ftLastWriteTime.dwLowDateTime=0x1c26c300, ftLastWriteTime.dwHighDateTime=0x1d50000, nFileSizeHigh=0x0, nFileSizeLow=0x5c47)) returned 1
	[0124.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.912] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx", lpFilePart=0x0) returned 0x24
	[0124.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.912] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jfjye.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.912] GetFileType (hFile=0x5dc) returned 0x1
	[0124.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.912] GetFileType (hFile=0x5dc) returned 0x1
	[0124.912] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x5c47
	[0124.913] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b7e6c, nNumberOfBytesToRead=0x5c47, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26b7e6c*, lpNumberOfBytesRead=0x593f2cc*=0x5c47, lpOverlapped=0x0) returned 1
	[0124.913] CloseHandle (hObject=0x5dc) returned 1
	[0124.914] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0124.914] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.914] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bdb50, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b480) returned 1
	[0124.914] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.914] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.914] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0124.914] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.914] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26bdc08*=0x1, dwFlags=0x0) returned 1
	[0124.914] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26bdbd4, dwFlags=0x0) returned 1
	[0124.914] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bdc18*, pdwDataLen=0x593f2d4*=0x5c50, dwBufLen=0x5c50 | out: pbData=0x26bdc18*, pdwDataLen=0x593f2d4*=0x5c50) returned 1
	[0124.914] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c3874*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26c3874*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.914] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0124.914] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.914] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx", lpFilePart=0x0) returned 0x24
	[0124.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.915] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jfjye.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.916] GetFileType (hFile=0x5dc) returned 0x1
	[0124.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.916] GetFileType (hFile=0x5dc) returned 0x1
	[0124.916] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bdc18*, nNumberOfBytesToWrite=0x5c50, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26bdc18*, lpNumberOfBytesWritten=0x593f2c0*=0x5c50, lpOverlapped=0x0) returned 1
	[0124.918] CloseHandle (hObject=0x5dc) returned 1
	[0124.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx", lpFilePart=0x0) returned 0x24
	[0124.919] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x53
	[0124.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.919] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jfjye.docx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3ab5c70, ftCreationTime.dwHighDateTime=0x1d48d50, ftLastAccessTime.dwLowDateTime=0x1c26c300, ftLastAccessTime.dwHighDateTime=0x1d50000, ftLastWriteTime.dwLowDateTime=0x84c8930d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5c50)) returned 1
	[0124.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.919] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jfjye.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\jfjYE.docx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\jfjye.docx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.920] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx", lpFilePart=0x0) returned 0x25
	[0124.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.920] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\KgrFcG.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\kgrfcg.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x26c3ba4 | out: lpFileInformation=0x26c3ba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd581650, ftCreationTime.dwHighDateTime=0x1d4d045, ftLastAccessTime.dwLowDateTime=0x9a89a20, ftLastAccessTime.dwHighDateTime=0x1d50b3e, ftLastWriteTime.dwLowDateTime=0x9a89a20, ftLastWriteTime.dwHighDateTime=0x1d50b3e, nFileSizeHigh=0x0, nFileSizeLow=0x3949)) returned 1
	[0124.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx", lpFilePart=0x0) returned 0x2c
	[0124.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.958] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\uld9-9kj pjf2.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.958] GetFileType (hFile=0x5dc) returned 0x1
	[0124.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.958] GetFileType (hFile=0x5dc) returned 0x1
	[0124.958] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x10932
	[0124.958] ReadFile (in: hFile=0x5dc, lpBuffer=0x27293b0, nNumberOfBytesToRead=0x10932, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27293b0*, lpNumberOfBytesRead=0x593f2cc*=0x10932, lpOverlapped=0x0) returned 1
	[0124.959] CloseHandle (hObject=0x5dc) returned 1
	[0124.959] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0124.959] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.960] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2739d80, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0124.960] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.960] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.960] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b2c0) returned 1
	[0124.960] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.960] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2739e38*=0x1, dwFlags=0x0) returned 1
	[0124.960] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2739e04, dwFlags=0x0) returned 1
	[0124.960] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2739e48*, pdwDataLen=0x593f2d4*=0x10940, dwBufLen=0x10940 | out: pbData=0x2739e48*, pdwDataLen=0x593f2d4*=0x10940) returned 1
	[0124.960] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274a794*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x274a794*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.960] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0124.960] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.960] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx", lpFilePart=0x0) returned 0x2c
	[0124.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.960] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\uld9-9kj pjf2.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.962] GetFileType (hFile=0x5dc) returned 0x1
	[0124.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.962] GetFileType (hFile=0x5dc) returned 0x1
	[0124.962] WriteFile (in: hFile=0x5dc, lpBuffer=0x2739e48*, nNumberOfBytesToWrite=0x10940, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2739e48*, lpNumberOfBytesWritten=0x593f2c0*=0x10940, lpOverlapped=0x0) returned 1
	[0124.964] CloseHandle (hObject=0x5dc) returned 1
	[0124.964] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx", lpFilePart=0x0) returned 0x2c
	[0124.964] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0124.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.965] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\uld9-9kj pjf2.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c692970, ftCreationTime.dwHighDateTime=0x1d50401, ftLastAccessTime.dwLowDateTime=0x3d1555a0, ftLastAccessTime.dwHighDateTime=0x1d4fdc5, ftLastWriteTime.dwLowDateTime=0x84cfbace, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10940)) returned 1
	[0124.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.965] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\uld9-9kj pjf2.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ulD9-9KJ pJF2.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\uld9-9kj pjf2.xlsx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.966] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx", lpFilePart=0x0) returned 0x28
	[0124.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.966] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\v 8fp6dzf.pptx"), fInfoLevelId=0x0, lpFileInformation=0x274ab24 | out: lpFileInformation=0x274ab24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f0b6ff0, ftCreationTime.dwHighDateTime=0x1d4e8ce, ftLastAccessTime.dwLowDateTime=0x8a774be0, ftLastAccessTime.dwHighDateTime=0x1d4bbd1, ftLastWriteTime.dwLowDateTime=0x8a774be0, ftLastWriteTime.dwHighDateTime=0x1d4bbd1, nFileSizeHigh=0x0, nFileSizeLow=0x87b5)) returned 1
	[0124.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.966] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx", lpFilePart=0x0) returned 0x28
	[0124.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.966] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\v 8fp6dzf.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.966] GetFileType (hFile=0x5dc) returned 0x1
	[0124.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.967] GetFileType (hFile=0x5dc) returned 0x1
	[0124.967] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x87b5
	[0124.967] ReadFile (in: hFile=0x5dc, lpBuffer=0x274ad14, nNumberOfBytesToRead=0x87b5, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x274ad14*, lpNumberOfBytesRead=0x593f2cc*=0x87b5, lpOverlapped=0x0) returned 1
	[0124.968] CloseHandle (hObject=0x5dc) returned 1
	[0124.968] CryptDestroyKey (hKey=0x82b280) returned 1
	[0124.968] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.968] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2753568, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b380) returned 1
	[0124.968] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.968] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.968] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0124.968] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.969] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2753620*=0x1, dwFlags=0x0) returned 1
	[0124.969] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27535ec, dwFlags=0x0) returned 1
	[0124.969] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2753630*, pdwDataLen=0x593f2d4*=0x87c0, dwBufLen=0x87c0 | out: pbData=0x2753630*, pdwDataLen=0x593f2d4*=0x87c0) returned 1
	[0124.969] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275bdfc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x275bdfc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.969] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0124.969] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.969] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.969] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx", lpFilePart=0x0) returned 0x28
	[0124.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.969] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\v 8fp6dzf.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.971] GetFileType (hFile=0x5dc) returned 0x1
	[0124.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.971] GetFileType (hFile=0x5dc) returned 0x1
	[0124.971] WriteFile (in: hFile=0x5dc, lpBuffer=0x2753630*, nNumberOfBytesToWrite=0x87c0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2753630*, lpNumberOfBytesWritten=0x593f2c0*=0x87c0, lpOverlapped=0x0) returned 1
	[0124.972] CloseHandle (hObject=0x5dc) returned 1
	[0124.973] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx", lpFilePart=0x0) returned 0x28
	[0124.973] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x57
	[0124.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.973] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\v 8fp6dzf.pptx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f0b6ff0, ftCreationTime.dwHighDateTime=0x1d4e8ce, ftLastAccessTime.dwLowDateTime=0x8a774be0, ftLastAccessTime.dwHighDateTime=0x1d4bbd1, ftLastWriteTime.dwLowDateTime=0x84d21d39, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x87c0)) returned 1
	[0124.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.973] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\v 8fp6dzf.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\v 8fp6DZf.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\v 8fp6dzf.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.974] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx", lpFilePart=0x0) returned 0x26
	[0124.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.974] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx" (normalized: "c:\\users\\fd1hvy\\documents\\_vvycj6.docx"), fInfoLevelId=0x0, lpFileInformation=0x275c15c | out: lpFileInformation=0x275c15c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3ad30, ftCreationTime.dwHighDateTime=0x1d4b8a4, ftLastAccessTime.dwLowDateTime=0xa4cc0, ftLastAccessTime.dwHighDateTime=0x1d4fa36, ftLastWriteTime.dwLowDateTime=0xa4cc0, ftLastWriteTime.dwHighDateTime=0x1d4fa36, nFileSizeHigh=0x0, nFileSizeLow=0xbb41)) returned 1
	[0124.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.974] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx", lpFilePart=0x0) returned 0x26
	[0124.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.975] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx" (normalized: "c:\\users\\fd1hvy\\documents\\_vvycj6.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.975] GetFileType (hFile=0x5dc) returned 0x1
	[0124.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.975] GetFileType (hFile=0x5dc) returned 0x1
	[0124.975] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xbb41
	[0124.975] ReadFile (in: hFile=0x5dc, lpBuffer=0x275c33c, nNumberOfBytesToRead=0xbb41, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x275c33c*, lpNumberOfBytesRead=0x593f2cc*=0xbb41, lpOverlapped=0x0) returned 1
	[0124.976] CloseHandle (hObject=0x5dc) returned 1
	[0124.976] CryptDestroyKey (hKey=0x82b380) returned 1
	[0124.976] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.976] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2767f1c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0124.976] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.976] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.976] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0124.976] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.976] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2767fd4*=0x1, dwFlags=0x0) returned 1
	[0124.976] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2767fa0, dwFlags=0x0) returned 1
	[0124.976] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2767fe4*, pdwDataLen=0x593f2d4*=0xbb50, dwBufLen=0xbb50 | out: pbData=0x2767fe4*, pdwDataLen=0x593f2d4*=0xbb50) returned 1
	[0124.976] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2773b40*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2773b40*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.976] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0124.976] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.976] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx", lpFilePart=0x0) returned 0x26
	[0124.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.977] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx" (normalized: "c:\\users\\fd1hvy\\documents\\_vvycj6.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.978] GetFileType (hFile=0x5dc) returned 0x1
	[0124.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.978] GetFileType (hFile=0x5dc) returned 0x1
	[0124.978] WriteFile (in: hFile=0x5dc, lpBuffer=0x2767fe4*, nNumberOfBytesToWrite=0xbb50, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2767fe4*, lpNumberOfBytesWritten=0x593f2c0*=0xbb50, lpOverlapped=0x0) returned 1
	[0124.980] CloseHandle (hObject=0x5dc) returned 1
	[0124.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx", lpFilePart=0x0) returned 0x26
	[0124.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0124.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.980] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx" (normalized: "c:\\users\\fd1hvy\\documents\\_vvycj6.docx"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3ad30, ftCreationTime.dwHighDateTime=0x1d4b8a4, ftLastAccessTime.dwLowDateTime=0xa4cc0, ftLastAccessTime.dwHighDateTime=0x1d4fa36, ftLastWriteTime.dwLowDateTime=0x84d21d39, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xbb50)) returned 1
	[0124.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.980] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx" (normalized: "c:\\users\\fd1hvy\\documents\\_vvycj6.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_vvYCj6.docx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\_vvycj6.docx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.981] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0124.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.981] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x2773e88 | out: lpFileInformation=0x2773e88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a)) returned 1
	[0124.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.982] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0124.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.982] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.982] GetFileType (hFile=0x5dc) returned 0x1
	[0124.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.982] GetFileType (hFile=0x5dc) returned 0x1
	[0124.982] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x11a
	[0124.982] ReadFile (in: hFile=0x5dc, lpBuffer=0x2774180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2774180*, lpNumberOfBytesRead=0x593f2cc*=0x11a, lpOverlapped=0x0) returned 1
	[0124.983] CloseHandle (hObject=0x5dc) returned 1
	[0124.983] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0124.983] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.984] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277521c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0124.984] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.984] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.984] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0124.984] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.984] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27752d4*=0x1, dwFlags=0x0) returned 1
	[0124.984] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27752a0, dwFlags=0x0) returned 1
	[0124.984] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27752e4*, pdwDataLen=0x593f2d4*=0x120, dwBufLen=0x120 | out: pbData=0x27752e4*, pdwDataLen=0x593f2d4*=0x120) returned 1
	[0124.984] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2775410*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2775410*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.984] CryptDestroyKey (hKey=0x82b340) returned 1
	[0124.984] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.984] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.984] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0124.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.984] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0124.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0124.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Bing.url", lpFilePart=0x0) returned 0x22
	[0124.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.986] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), fInfoLevelId=0x0, lpFileInformation=0x27758fc | out: lpFileInformation=0x27758fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0)) returned 1
	[0124.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Bing.url", lpFilePart=0x0) returned 0x22
	[0124.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.987] GetFileType (hFile=0x5dc) returned 0x1
	[0124.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.988] GetFileType (hFile=0x5dc) returned 0x1
	[0124.988] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xd0
	[0124.988] ReadFile (in: hFile=0x5dc, lpBuffer=0x2775b98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2775b98*, lpNumberOfBytesRead=0x593f2cc*=0xd0, lpOverlapped=0x0) returned 1
	[0124.989] CloseHandle (hObject=0x5dc) returned 1
	[0124.989] CryptDestroyKey (hKey=0x82b400) returned 1
	[0124.989] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.989] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2776c34, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0124.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.989] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b100) returned 1
	[0124.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.989] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2776cec*=0x1, dwFlags=0x0) returned 1
	[0124.989] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2776cb8, dwFlags=0x0) returned 1
	[0124.989] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2776cfc*, pdwDataLen=0x593f2d4*=0xe0, dwBufLen=0xe0 | out: pbData=0x2776cfc*, pdwDataLen=0x593f2d4*=0xe0) returned 1
	[0124.989] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2776de8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2776de8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.990] CryptDestroyKey (hKey=0x82b100) returned 1
	[0124.990] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.990] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Bing.url", lpFilePart=0x0) returned 0x22
	[0124.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.990] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.991] GetFileType (hFile=0x5dc) returned 0x1
	[0124.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0124.991] GetFileType (hFile=0x5dc) returned 0x1
	[0124.991] WriteFile (in: hFile=0x5dc, lpBuffer=0x2776ed4*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2776ed4*, lpNumberOfBytesWritten=0x593f294*=0xe0, lpOverlapped=0x0) returned 1
	[0124.992] CloseHandle (hObject=0x5dc) returned 1
	[0124.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Bing.url", lpFilePart=0x0) returned 0x22
	[0124.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Bing.url id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x51
	[0124.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0124.992] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x84d47f9a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1
	[0124.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0124.993] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0124.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0124.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.994] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x277810c | out: lpFileInformation=0x277810c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192)) returned 1
	[0124.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.994] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0124.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.994] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.994] GetFileType (hFile=0x5dc) returned 0x1
	[0124.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.994] GetFileType (hFile=0x5dc) returned 0x1
	[0124.994] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x192
	[0124.994] ReadFile (in: hFile=0x5dc, lpBuffer=0x277847c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x277847c*, lpNumberOfBytesRead=0x593f2cc*=0x192, lpOverlapped=0x0) returned 1
	[0124.995] CloseHandle (hObject=0x5dc) returned 1
	[0124.995] CryptDestroyKey (hKey=0x82b540) returned 1
	[0124.995] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.995] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2779518, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0124.995] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.996] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.996] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b040) returned 1
	[0124.996] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0124.996] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x27795d0*=0x1, dwFlags=0x0) returned 1
	[0124.996] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x277959c, dwFlags=0x0) returned 1
	[0124.996] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27795e0*, pdwDataLen=0x593f2d4*=0x1a0, dwBufLen=0x1a0 | out: pbData=0x27795e0*, pdwDataLen=0x593f2d4*=0x1a0) returned 1
	[0124.996] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277978c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x277978c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0124.996] CryptDestroyKey (hKey=0x82b040) returned 1
	[0124.996] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.996] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0124.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0124.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0124.996] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0124.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0124.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\desktop.ini", lpFilePart=0x0) returned 0x21
	[0124.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0124.998] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x2779c78 | out: lpFileInformation=0x2779c78*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8)) returned 1
	[0124.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0124.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\desktop.ini", lpFilePart=0x0) returned 0x21
	[0124.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0124.999] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0124.999] GetFileType (hFile=0x5dc) returned 0x1
	[0124.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0124.999] GetFileType (hFile=0x5dc) returned 0x1
	[0124.999] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1f8
	[0124.999] ReadFile (in: hFile=0x5dc, lpBuffer=0x277a03c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x277a03c*, lpNumberOfBytesRead=0x593f2cc*=0x1f8, lpOverlapped=0x0) returned 1
	[0125.000] CloseHandle (hObject=0x5dc) returned 1
	[0125.000] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.000] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.000] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277b0d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b480) returned 1
	[0125.000] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.001] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.001] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0125.001] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.001] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x277b190*=0x1, dwFlags=0x0) returned 1
	[0125.001] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x277b15c, dwFlags=0x0) returned 1
	[0125.001] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277b1a0*, pdwDataLen=0x593f2d4*=0x200, dwBufLen=0x200 | out: pbData=0x277b1a0*, pdwDataLen=0x593f2d4*=0x200) returned 1
	[0125.001] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277b3ac*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x277b3ac*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.001] CryptDestroyKey (hKey=0x82b340) returned 1
	[0125.001] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.001] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.001] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\desktop.ini", lpFilePart=0x0) returned 0x21
	[0125.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.001] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0125.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0125.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21
	[0125.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.003] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x277b878 | out: lpFileInformation=0x277b878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5)) returned 1
	[0125.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21
	[0125.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.005] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.005] GetFileType (hFile=0x5dc) returned 0x1
	[0125.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.005] GetFileType (hFile=0x5dc) returned 0x1
	[0125.005] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1f5
	[0125.005] ReadFile (in: hFile=0x5dc, lpBuffer=0x277bc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x277bc3c*, lpNumberOfBytesRead=0x593f2cc*=0x1f5, lpOverlapped=0x0) returned 1
	[0125.007] CloseHandle (hObject=0x5dc) returned 1
	[0125.007] CryptDestroyKey (hKey=0x82b480) returned 1
	[0125.007] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.007] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277ccd8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b200) returned 1
	[0125.007] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.007] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.007] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b040) returned 1
	[0125.007] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.007] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x277cd90*=0x1, dwFlags=0x0) returned 1
	[0125.007] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x277cd5c, dwFlags=0x0) returned 1
	[0125.007] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277cda0*, pdwDataLen=0x593f2d4*=0x200, dwBufLen=0x200 | out: pbData=0x277cda0*, pdwDataLen=0x593f2d4*=0x200) returned 1
	[0125.007] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277cfac*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x277cfac*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.007] CryptDestroyKey (hKey=0x82b040) returned 1
	[0125.007] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.007] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.007] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21
	[0125.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.008] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.009] GetFileType (hFile=0x5dc) returned 0x1
	[0125.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.009] GetFileType (hFile=0x5dc) returned 0x1
	[0125.009] WriteFile (in: hFile=0x5dc, lpBuffer=0x277d098*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x277d098*, lpNumberOfBytesWritten=0x593f294*=0x200, lpOverlapped=0x0) returned 1
	[0125.010] CloseHandle (hObject=0x5dc) returned 1
	[0125.010] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21
	[0125.010] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x50
	[0125.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.010] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x84d6e282, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1
	[0125.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.011] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.013] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23
	[0125.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.013] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x277e2cc | out: lpFileInformation=0x277e2cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae)) returned 1
	[0125.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.014] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23
	[0125.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.014] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.014] GetFileType (hFile=0x5dc) returned 0x1
	[0125.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.014] GetFileType (hFile=0x5dc) returned 0x1
	[0125.014] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3ae
	[0125.014] ReadFile (in: hFile=0x5dc, lpBuffer=0x277e858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x277e858*, lpNumberOfBytesRead=0x593f2cc*=0x3ae, lpOverlapped=0x0) returned 1
	[0125.024] CloseHandle (hObject=0x5dc) returned 1
	[0125.024] CryptDestroyKey (hKey=0x82b200) returned 1
	[0125.024] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.025] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277f8f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0125.025] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.025] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.025] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0125.025] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.025] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x277f9ac*=0x1, dwFlags=0x0) returned 1
	[0125.025] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x277f978, dwFlags=0x0) returned 1
	[0125.025] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277f9bc*, pdwDataLen=0x593f2d4*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x277f9bc*, pdwDataLen=0x593f2d4*=0x3b0) returned 1
	[0125.025] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277fd78*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x277fd78*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.025] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0125.025] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.025] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23
	[0125.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.025] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.027] GetFileType (hFile=0x5dc) returned 0x1
	[0125.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.027] GetFileType (hFile=0x5dc) returned 0x1
	[0125.027] WriteFile (in: hFile=0x5dc, lpBuffer=0x277fe6c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x277fe6c*, lpNumberOfBytesWritten=0x593f294*=0x3b0, lpOverlapped=0x0) returned 1
	[0125.028] CloseHandle (hObject=0x5dc) returned 1
	[0125.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23
	[0125.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0125.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.028] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x84d9438b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1
	[0125.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.028] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.029] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22
	[0125.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.029] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), fInfoLevelId=0x0, lpFileInformation=0x27810b0 | out: lpFileInformation=0x27810b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a)) returned 1
	[0125.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.031] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22
	[0125.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.031] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.031] GetFileType (hFile=0x5dc) returned 0x1
	[0125.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.031] GetFileType (hFile=0x5dc) returned 0x1
	[0125.031] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x53a
	[0125.031] ReadFile (in: hFile=0x5dc, lpBuffer=0x27817c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27817c8*, lpNumberOfBytesRead=0x593f2cc*=0x53a, lpOverlapped=0x0) returned 1
	[0125.038] CloseHandle (hObject=0x5dc) returned 1
	[0125.038] CryptDestroyKey (hKey=0x82b540) returned 1
	[0125.039] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.039] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2782864, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0125.039] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.039] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.039] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0125.039] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.039] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x278291c*=0x1, dwFlags=0x0) returned 1
	[0125.039] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27828e8, dwFlags=0x0) returned 1
	[0125.039] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278292c*, pdwDataLen=0x593f2d4*=0x540, dwBufLen=0x540 | out: pbData=0x278292c*, pdwDataLen=0x593f2d4*=0x540) returned 1
	[0125.039] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2782e78*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2782e78*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.039] CryptDestroyKey (hKey=0x82b280) returned 1
	[0125.039] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.039] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22
	[0125.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.039] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.041] GetFileType (hFile=0x5dc) returned 0x1
	[0125.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.041] GetFileType (hFile=0x5dc) returned 0x1
	[0125.041] WriteFile (in: hFile=0x5dc, lpBuffer=0x2782f6c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2782f6c*, lpNumberOfBytesWritten=0x593f294*=0x540, lpOverlapped=0x0) returned 1
	[0125.042] CloseHandle (hObject=0x5dc) returned 1
	[0125.042] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22
	[0125.042] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x51
	[0125.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.042] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84dba563, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x540)) returned 1
	[0125.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.042] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav", lpFilePart=0x0) returned 0x2e
	[0125.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.043] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav" (normalized: "c:\\users\\fd1hvy\\music\\6v6hcb-lonskgcwnzwqf.wav"), fInfoLevelId=0x0, lpFileInformation=0x27841a4 | out: lpFileInformation=0x27841a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb6ae10, ftCreationTime.dwHighDateTime=0x1d4cbfe, ftLastAccessTime.dwLowDateTime=0xd296fce0, ftLastAccessTime.dwHighDateTime=0x1d4ca72, ftLastWriteTime.dwLowDateTime=0xd296fce0, ftLastWriteTime.dwHighDateTime=0x1d4ca72, nFileSizeHigh=0x0, nFileSizeLow=0x66dc)) returned 1
	[0125.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav", lpFilePart=0x0) returned 0x2e
	[0125.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.044] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav" (normalized: "c:\\users\\fd1hvy\\music\\6v6hcb-lonskgcwnzwqf.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.044] GetFileType (hFile=0x5dc) returned 0x1
	[0125.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.044] GetFileType (hFile=0x5dc) returned 0x1
	[0125.044] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x66dc
	[0125.044] ReadFile (in: hFile=0x5dc, lpBuffer=0x27843d4, nNumberOfBytesToRead=0x66dc, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27843d4*, lpNumberOfBytesRead=0x593f2cc*=0x66dc, lpOverlapped=0x0) returned 1
	[0125.045] CloseHandle (hObject=0x5dc) returned 1
	[0125.045] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0125.045] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.045] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278ab4c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0125.045] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.045] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.045] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0125.045] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.045] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x278ac04*=0x1, dwFlags=0x0) returned 1
	[0125.045] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x278abd0, dwFlags=0x0) returned 1
	[0125.046] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278ac14*, pdwDataLen=0x593f2d4*=0x66e0, dwBufLen=0x66e0 | out: pbData=0x278ac14*, pdwDataLen=0x593f2d4*=0x66e0) returned 1
	[0125.046] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2791300*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2791300*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.046] CryptDestroyKey (hKey=0x82b540) returned 1
	[0125.046] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.046] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.046] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav", lpFilePart=0x0) returned 0x2e
	[0125.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.046] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav" (normalized: "c:\\users\\fd1hvy\\music\\6v6hcb-lonskgcwnzwqf.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.048] GetFileType (hFile=0x5dc) returned 0x1
	[0125.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.048] GetFileType (hFile=0x5dc) returned 0x1
	[0125.048] WriteFile (in: hFile=0x5dc, lpBuffer=0x278ac14*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x278ac14*, lpNumberOfBytesWritten=0x593f2c0*=0x66e0, lpOverlapped=0x0) returned 1
	[0125.049] CloseHandle (hObject=0x5dc) returned 1
	[0125.049] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav", lpFilePart=0x0) returned 0x2e
	[0125.050] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0125.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav" (normalized: "c:\\users\\fd1hvy\\music\\6v6hcb-lonskgcwnzwqf.wav"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb6ae10, ftCreationTime.dwHighDateTime=0x1d4cbfe, ftLastAccessTime.dwLowDateTime=0xd296fce0, ftLastAccessTime.dwHighDateTime=0x1d4ca72, ftLastWriteTime.dwLowDateTime=0x84de08f3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x66e0)) returned 1
	[0125.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.050] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav" (normalized: "c:\\users\\fd1hvy\\music\\6v6hcb-lonskgcwnzwqf.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\6V6hCB-lOnsKGcwNZWQF.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\6v6hcb-lonskgcwnzwqf.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.051] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav", lpFilePart=0x0) returned 0x21
	[0125.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.051] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav" (normalized: "c:\\users\\fd1hvy\\music\\bxh qjf.wav"), fInfoLevelId=0x0, lpFileInformation=0x27916b0 | out: lpFileInformation=0x27916b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bef70e0, ftCreationTime.dwHighDateTime=0x1d4c7db, ftLastAccessTime.dwLowDateTime=0xe04b9a60, ftLastAccessTime.dwHighDateTime=0x1d4c5c4, ftLastWriteTime.dwLowDateTime=0xe04b9a60, ftLastWriteTime.dwHighDateTime=0x1d4c5c4, nFileSizeHigh=0x0, nFileSizeLow=0x16bd5)) returned 1
	[0125.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.051] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav", lpFilePart=0x0) returned 0x21
	[0125.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.051] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav" (normalized: "c:\\users\\fd1hvy\\music\\bxh qjf.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.051] GetFileType (hFile=0x5dc) returned 0x1
	[0125.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.051] GetFileType (hFile=0x5dc) returned 0x1
	[0125.051] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x16bd5
	[0125.052] ReadFile (in: hFile=0x5dc, lpBuffer=0x7924020, nNumberOfBytesToRead=0x16bd5, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x7924020*, lpNumberOfBytesRead=0x593f2cc*=0x16bd5, lpOverlapped=0x0) returned 1
	[0125.054] CloseHandle (hObject=0x5dc) returned 1
	[0125.054] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0125.054] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.054] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2791900, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b0c0) returned 1
	[0125.054] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.054] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.054] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b440) returned 1
	[0125.054] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.054] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x27919b8*=0x1, dwFlags=0x0) returned 1
	[0125.055] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2791984, dwFlags=0x0) returned 1
	[0125.056] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x793ac18*, pdwDataLen=0x593f2d4*=0x16be0, dwBufLen=0x16be0 | out: pbData=0x793ac18*, pdwDataLen=0x593f2d4*=0x16be0) returned 1
	[0125.056] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27919c8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27919c8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.056] CryptDestroyKey (hKey=0x82b440) returned 1
	[0125.056] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.056] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.056] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav", lpFilePart=0x0) returned 0x21
	[0125.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.056] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav" (normalized: "c:\\users\\fd1hvy\\music\\bxh qjf.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.058] GetFileType (hFile=0x5dc) returned 0x1
	[0125.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.058] GetFileType (hFile=0x5dc) returned 0x1
	[0125.058] WriteFile (in: hFile=0x5dc, lpBuffer=0x793ac18*, nNumberOfBytesToWrite=0x16be0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x793ac18*, lpNumberOfBytesWritten=0x593f2c0*=0x16be0, lpOverlapped=0x0) returned 1
	[0125.061] CloseHandle (hObject=0x5dc) returned 1
	[0125.061] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav", lpFilePart=0x0) returned 0x21
	[0125.061] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x50
	[0125.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.068] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav" (normalized: "c:\\users\\fd1hvy\\music\\bxh qjf.wav"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bef70e0, ftCreationTime.dwHighDateTime=0x1d4c7db, ftLastAccessTime.dwLowDateTime=0xe04b9a60, ftLastAccessTime.dwHighDateTime=0x1d4c5c4, ftLastWriteTime.dwLowDateTime=0x84de08f3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x16be0)) returned 1
	[0125.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.068] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav" (normalized: "c:\\users\\fd1hvy\\music\\bxh qjf.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\bXH qJF.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\bxh qjf.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\desktop.ini", lpFilePart=0x0) returned 0x21
	[0125.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.069] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x2791cdc | out: lpFileInformation=0x2791cdc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8)) returned 1
	[0125.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.070] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\desktop.ini", lpFilePart=0x0) returned 0x21
	[0125.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.070] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.070] GetFileType (hFile=0x5dc) returned 0x1
	[0125.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.070] GetFileType (hFile=0x5dc) returned 0x1
	[0125.070] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1f8
	[0125.070] ReadFile (in: hFile=0x5dc, lpBuffer=0x27920a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27920a0*, lpNumberOfBytesRead=0x593f2cc*=0x1f8, lpOverlapped=0x0) returned 1
	[0125.071] CloseHandle (hObject=0x5dc) returned 1
	[0125.071] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0125.071] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.071] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279313c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b200) returned 1
	[0125.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.072] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b0c0) returned 1
	[0125.072] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.072] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27931f4*=0x1, dwFlags=0x0) returned 1
	[0125.072] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x27931c0, dwFlags=0x0) returned 1
	[0125.072] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2793204*, pdwDataLen=0x593f2d4*=0x200, dwBufLen=0x200 | out: pbData=0x2793204*, pdwDataLen=0x593f2d4*=0x200) returned 1
	[0125.072] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2793410*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2793410*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.072] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0125.072] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.072] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.072] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\desktop.ini", lpFilePart=0x0) returned 0x21
	[0125.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.072] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0125.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0125.074] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3", lpFilePart=0x0) returned 0x27
	[0125.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.074] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\sjo78jjmghrlz.mp3"), fInfoLevelId=0x0, lpFileInformation=0x27938dc | out: lpFileInformation=0x27938dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ccbb310, ftCreationTime.dwHighDateTime=0x1d4cef9, ftLastAccessTime.dwLowDateTime=0x54972f0, ftLastAccessTime.dwHighDateTime=0x1d4cf2b, ftLastWriteTime.dwLowDateTime=0x54972f0, ftLastWriteTime.dwHighDateTime=0x1d4cf2b, nFileSizeHigh=0x0, nFileSizeLow=0x72c)) returned 1
	[0125.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.074] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3", lpFilePart=0x0) returned 0x27
	[0125.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.075] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\sjo78jjmghrlz.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.075] GetFileType (hFile=0x5dc) returned 0x1
	[0125.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.075] GetFileType (hFile=0x5dc) returned 0x1
	[0125.075] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x72c
	[0125.075] ReadFile (in: hFile=0x5dc, lpBuffer=0x2794204, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2794204*, lpNumberOfBytesRead=0x593f2cc*=0x72c, lpOverlapped=0x0) returned 1
	[0125.076] CloseHandle (hObject=0x5dc) returned 1
	[0125.076] CryptDestroyKey (hKey=0x82b200) returned 1
	[0125.076] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.076] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27952a0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0125.076] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.076] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.076] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b100) returned 1
	[0125.076] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.076] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2795358*=0x1, dwFlags=0x0) returned 1
	[0125.076] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2795324, dwFlags=0x0) returned 1
	[0125.077] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2795368*, pdwDataLen=0x593f2d4*=0x730, dwBufLen=0x730 | out: pbData=0x2795368*, pdwDataLen=0x593f2d4*=0x730) returned 1
	[0125.077] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2795aa4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2795aa4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.077] CryptDestroyKey (hKey=0x82b100) returned 1
	[0125.077] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.077] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.077] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3", lpFilePart=0x0) returned 0x27
	[0125.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.077] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\sjo78jjmghrlz.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.078] GetFileType (hFile=0x5dc) returned 0x1
	[0125.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.078] GetFileType (hFile=0x5dc) returned 0x1
	[0125.079] WriteFile (in: hFile=0x5dc, lpBuffer=0x2795ba8*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2795ba8*, lpNumberOfBytesWritten=0x593f294*=0x730, lpOverlapped=0x0) returned 1
	[0125.092] CloseHandle (hObject=0x5dc) returned 1
	[0125.092] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3", lpFilePart=0x0) returned 0x27
	[0125.092] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0125.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.093] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\sjo78jjmghrlz.mp3"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ccbb310, ftCreationTime.dwHighDateTime=0x1d4cef9, ftLastAccessTime.dwLowDateTime=0x54972f0, ftLastAccessTime.dwHighDateTime=0x1d4cf2b, ftLastWriteTime.dwLowDateTime=0x84e2cdf9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x730)) returned 1
	[0125.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.093] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\sjo78jjmghrlz.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\sJo78JJMGHrLZ.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\sjo78jjmghrlz.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0125.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.094] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x2796e0c | out: lpFileInformation=0x2796e0c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61)) returned 1
	[0125.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0125.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.094] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.094] GetFileType (hFile=0x5dc) returned 0x1
	[0125.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.095] GetFileType (hFile=0x5dc) returned 0x1
	[0125.095] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x61
	[0125.095] ReadFile (in: hFile=0x5dc, lpBuffer=0x279704c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x279704c*, lpNumberOfBytesRead=0x593f2cc*=0x61, lpOverlapped=0x0) returned 1
	[0125.096] CloseHandle (hObject=0x5dc) returned 1
	[0125.096] CryptDestroyKey (hKey=0x82b300) returned 1
	[0125.096] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.096] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27980e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b000) returned 1
	[0125.096] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.096] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.096] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0125.096] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.096] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27981a0*=0x1, dwFlags=0x0) returned 1
	[0125.096] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x279816c, dwFlags=0x0) returned 1
	[0125.096] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27981b0*, pdwDataLen=0x593f2d4*=0x70, dwBufLen=0x70 | out: pbData=0x27981b0*, pdwDataLen=0x593f2d4*=0x70) returned 1
	[0125.096] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279822c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x279822c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.096] CryptDestroyKey (hKey=0x82b280) returned 1
	[0125.096] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.096] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.096] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0125.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.097] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0125.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0125.098] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg", lpFilePart=0x0) returned 0x29
	[0125.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.098] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\5qjgihqrkn_7.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2798714 | out: lpFileInformation=0x2798714*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7232b90, ftCreationTime.dwHighDateTime=0x1d4c5cd, ftLastAccessTime.dwLowDateTime=0x2c306e40, ftLastAccessTime.dwHighDateTime=0x1d4cfc7, ftLastWriteTime.dwLowDateTime=0x2c306e40, ftLastWriteTime.dwHighDateTime=0x1d4cfc7, nFileSizeHigh=0x0, nFileSizeLow=0x355a)) returned 1
	[0125.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.099] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg", lpFilePart=0x0) returned 0x29
	[0125.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.099] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\5qjgihqrkn_7.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.099] GetFileType (hFile=0x5dc) returned 0x1
	[0125.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.099] GetFileType (hFile=0x5dc) returned 0x1
	[0125.099] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x355a
	[0125.099] ReadFile (in: hFile=0x5dc, lpBuffer=0x279890c, nNumberOfBytesToRead=0x355a, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x279890c*, lpNumberOfBytesRead=0x593f2cc*=0x355a, lpOverlapped=0x0) returned 1
	[0125.100] CloseHandle (hObject=0x5dc) returned 1
	[0125.100] CryptDestroyKey (hKey=0x82b000) returned 1
	[0125.100] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.100] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279bf04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0125.100] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.101] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.101] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b300) returned 1
	[0125.101] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.101] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x279bfbc*=0x1, dwFlags=0x0) returned 1
	[0125.101] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x279bf88, dwFlags=0x0) returned 1
	[0125.101] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279bfcc*, pdwDataLen=0x593f2d4*=0x3560, dwBufLen=0x3560 | out: pbData=0x279bfcc*, pdwDataLen=0x593f2d4*=0x3560) returned 1
	[0125.101] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279f538*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x279f538*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.101] CryptDestroyKey (hKey=0x82b300) returned 1
	[0125.101] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.101] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.101] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg", lpFilePart=0x0) returned 0x29
	[0125.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.101] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\5qjgihqrkn_7.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.103] GetFileType (hFile=0x5dc) returned 0x1
	[0125.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.103] GetFileType (hFile=0x5dc) returned 0x1
	[0125.103] WriteFile (in: hFile=0x5dc, lpBuffer=0x279bfcc*, nNumberOfBytesToWrite=0x3560, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x279bfcc*, lpNumberOfBytesWritten=0x593f2c0*=0x3560, lpOverlapped=0x0) returned 1
	[0125.104] CloseHandle (hObject=0x5dc) returned 1
	[0125.104] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg", lpFilePart=0x0) returned 0x29
	[0125.104] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x58
	[0125.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.104] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\5qjgihqrkn_7.jpg"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7232b90, ftCreationTime.dwHighDateTime=0x1d4c5cd, ftLastAccessTime.dwLowDateTime=0x2c306e40, ftLastAccessTime.dwHighDateTime=0x1d4cfc7, ftLastWriteTime.dwLowDateTime=0x84e53618, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3560)) returned 1
	[0125.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.104] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\5qjgihqrkn_7.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\5qJGIHqRkn_7.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\5qjgihqrkn_7.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.105] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png", lpFilePart=0x0) returned 0x26
	[0125.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\9fz86lnej.png"), fInfoLevelId=0x0, lpFileInformation=0x279f8a8 | out: lpFileInformation=0x279f8a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26e10, ftCreationTime.dwHighDateTime=0x1d4ce6f, ftLastAccessTime.dwLowDateTime=0x49188940, ftLastAccessTime.dwHighDateTime=0x1d4c638, ftLastWriteTime.dwLowDateTime=0x49188940, ftLastWriteTime.dwHighDateTime=0x1d4c638, nFileSizeHigh=0x0, nFileSizeLow=0x8677)) returned 1
	[0125.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.105] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png", lpFilePart=0x0) returned 0x26
	[0125.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\9fz86lnej.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.106] GetFileType (hFile=0x5dc) returned 0x1
	[0125.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.106] GetFileType (hFile=0x5dc) returned 0x1
	[0125.106] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x8677
	[0125.106] ReadFile (in: hFile=0x5dc, lpBuffer=0x279fa88, nNumberOfBytesToRead=0x8677, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x279fa88*, lpNumberOfBytesRead=0x593f2cc*=0x8677, lpOverlapped=0x0) returned 1
	[0125.106] CloseHandle (hObject=0x5dc) returned 1
	[0125.107] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.107] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.107] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a819c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0125.107] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.107] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.107] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0125.107] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.107] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27a8254*=0x1, dwFlags=0x0) returned 1
	[0125.107] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27a8220, dwFlags=0x0) returned 1
	[0125.107] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a8264*, pdwDataLen=0x593f2d4*=0x8680, dwBufLen=0x8680 | out: pbData=0x27a8264*, pdwDataLen=0x593f2d4*=0x8680) returned 1
	[0125.107] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b08f0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27b08f0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.107] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0125.107] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.107] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.108] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png", lpFilePart=0x0) returned 0x26
	[0125.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.108] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\9fz86lnej.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.120] GetFileType (hFile=0x5dc) returned 0x1
	[0125.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.121] GetFileType (hFile=0x5dc) returned 0x1
	[0125.121] WriteFile (in: hFile=0x5dc, lpBuffer=0x27a8264*, nNumberOfBytesToWrite=0x8680, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27a8264*, lpNumberOfBytesWritten=0x593f2c0*=0x8680, lpOverlapped=0x0) returned 1
	[0125.122] CloseHandle (hObject=0x5dc) returned 1
	[0125.122] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png", lpFilePart=0x0) returned 0x26
	[0125.122] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0125.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\9fz86lnej.png"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26e10, ftCreationTime.dwHighDateTime=0x1d4ce6f, ftLastAccessTime.dwLowDateTime=0x49188940, ftLastAccessTime.dwHighDateTime=0x1d4c638, ftLastWriteTime.dwLowDateTime=0x84e79292, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8680)) returned 1
	[0125.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.123] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\9fz86lnej.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\9Fz86lnEj.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\9fz86lnej.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.124] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif", lpFilePart=0x0) returned 0x26
	[0125.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.124] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\c491ojxkx.gif"), fInfoLevelId=0x0, lpFileInformation=0x27b0c38 | out: lpFileInformation=0x27b0c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfeb5cd0, ftCreationTime.dwHighDateTime=0x1d4d308, ftLastAccessTime.dwLowDateTime=0xdce35510, ftLastAccessTime.dwHighDateTime=0x1d4c9d5, ftLastWriteTime.dwLowDateTime=0xdce35510, ftLastWriteTime.dwHighDateTime=0x1d4c9d5, nFileSizeHigh=0x0, nFileSizeLow=0x102b0)) returned 1
	[0125.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.125] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif", lpFilePart=0x0) returned 0x26
	[0125.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\c491ojxkx.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.125] GetFileType (hFile=0x5dc) returned 0x1
	[0125.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.125] GetFileType (hFile=0x5dc) returned 0x1
	[0125.125] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x102b0
	[0125.125] ReadFile (in: hFile=0x5dc, lpBuffer=0x27b0e18, nNumberOfBytesToRead=0x102b0, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27b0e18*, lpNumberOfBytesRead=0x593f2cc*=0x102b0, lpOverlapped=0x0) returned 1
	[0125.126] CloseHandle (hObject=0x5dc) returned 1
	[0125.126] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.126] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.127] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c1164, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0125.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.127] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b4c0) returned 1
	[0125.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.127] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27c121c*=0x1, dwFlags=0x0) returned 1
	[0125.127] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27c11e8, dwFlags=0x0) returned 1
	[0125.127] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c122c*, pdwDataLen=0x593f2d4*=0x102c0, dwBufLen=0x102c0 | out: pbData=0x27c122c*, pdwDataLen=0x593f2d4*=0x102c0) returned 1
	[0125.127] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d14f8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27d14f8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.127] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0125.127] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.127] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.127] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif", lpFilePart=0x0) returned 0x26
	[0125.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.128] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\c491ojxkx.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.129] GetFileType (hFile=0x5dc) returned 0x1
	[0125.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.129] GetFileType (hFile=0x5dc) returned 0x1
	[0125.130] WriteFile (in: hFile=0x5dc, lpBuffer=0x27c122c*, nNumberOfBytesToWrite=0x102c0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27c122c*, lpNumberOfBytesWritten=0x593f2c0*=0x102c0, lpOverlapped=0x0) returned 1
	[0125.131] CloseHandle (hObject=0x5dc) returned 1
	[0125.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif", lpFilePart=0x0) returned 0x26
	[0125.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0125.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.132] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\c491ojxkx.gif"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfeb5cd0, ftCreationTime.dwHighDateTime=0x1d4d308, ftLastAccessTime.dwLowDateTime=0xdce35510, ftLastAccessTime.dwHighDateTime=0x1d4c9d5, ftLastWriteTime.dwLowDateTime=0x84e9f593, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x102c0)) returned 1
	[0125.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.132] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\c491ojxkx.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\c491ojXkX.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\c491ojxkx.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.133] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg", lpFilePart=0x0) returned 0x24
	[0125.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.133] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\cpbp l3.jpg"), fInfoLevelId=0x0, lpFileInformation=0x27d1840 | out: lpFileInformation=0x27d1840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7068ad0, ftCreationTime.dwHighDateTime=0x1d4d492, ftLastAccessTime.dwLowDateTime=0xc01df60, ftLastAccessTime.dwHighDateTime=0x1d4d4b7, ftLastWriteTime.dwLowDateTime=0xc01df60, ftLastWriteTime.dwHighDateTime=0x1d4d4b7, nFileSizeHigh=0x0, nFileSizeLow=0x14b9)) returned 1
	[0125.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.133] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg", lpFilePart=0x0) returned 0x24
	[0125.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.134] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\cpbp l3.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.134] GetFileType (hFile=0x5dc) returned 0x1
	[0125.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.134] GetFileType (hFile=0x5dc) returned 0x1
	[0125.134] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x14b9
	[0125.134] ReadFile (in: hFile=0x5dc, lpBuffer=0x27d1a10, nNumberOfBytesToRead=0x14b9, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27d1a10*, lpNumberOfBytesRead=0x593f2cc*=0x14b9, lpOverlapped=0x0) returned 1
	[0125.135] CloseHandle (hObject=0x5dc) returned 1
	[0125.135] CryptDestroyKey (hKey=0x82b280) returned 1
	[0125.135] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.135] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d2f68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0125.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.135] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b000) returned 1
	[0125.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.136] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x27d3020*=0x1, dwFlags=0x0) returned 1
	[0125.136] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x27d2fec, dwFlags=0x0) returned 1
	[0125.136] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d3030*, pdwDataLen=0x593f2d4*=0x14c0, dwBufLen=0x14c0 | out: pbData=0x27d3030*, pdwDataLen=0x593f2d4*=0x14c0) returned 1
	[0125.136] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d44fc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27d44fc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.136] CryptDestroyKey (hKey=0x82b000) returned 1
	[0125.136] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.136] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.136] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg", lpFilePart=0x0) returned 0x24
	[0125.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.136] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\cpbp l3.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.138] GetFileType (hFile=0x5dc) returned 0x1
	[0125.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.138] GetFileType (hFile=0x5dc) returned 0x1
	[0125.138] WriteFile (in: hFile=0x5dc, lpBuffer=0x27d3030*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27d3030*, lpNumberOfBytesWritten=0x593f2c0*=0x14c0, lpOverlapped=0x0) returned 1
	[0125.139] CloseHandle (hObject=0x5dc) returned 1
	[0125.139] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg", lpFilePart=0x0) returned 0x24
	[0125.139] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x53
	[0125.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.140] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\cpbp l3.jpg"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7068ad0, ftCreationTime.dwHighDateTime=0x1d4d492, ftLastAccessTime.dwLowDateTime=0xc01df60, ftLastAccessTime.dwHighDateTime=0x1d4d4b7, ftLastWriteTime.dwLowDateTime=0x84e9f593, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x14c0)) returned 1
	[0125.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.140] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\cpbp l3.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\CPbP l3.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\cpbp l3.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.141] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0125.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.141] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x27d482c | out: lpFileInformation=0x27d482c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8)) returned 1
	[0125.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.141] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0125.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.141] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.142] GetFileType (hFile=0x5dc) returned 0x1
	[0125.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.142] GetFileType (hFile=0x5dc) returned 0x1
	[0125.142] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1f8
	[0125.142] ReadFile (in: hFile=0x5dc, lpBuffer=0x27d4c00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27d4c00*, lpNumberOfBytesRead=0x593f2cc*=0x1f8, lpOverlapped=0x0) returned 1
	[0125.143] CloseHandle (hObject=0x5dc) returned 1
	[0125.143] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0125.143] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.143] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d5c9c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0125.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.143] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0125.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.144] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27d5d54*=0x1, dwFlags=0x0) returned 1
	[0125.144] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27d5d20, dwFlags=0x0) returned 1
	[0125.144] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d5d64*, pdwDataLen=0x593f2d4*=0x200, dwBufLen=0x200 | out: pbData=0x27d5d64*, pdwDataLen=0x593f2d4*=0x200) returned 1
	[0125.144] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d5f70*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27d5f70*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.144] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0125.144] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.144] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.144] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0125.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.144] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0125.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0125.146] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp", lpFilePart=0x0) returned 0x27
	[0125.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.146] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7jrluskcu.bmp"), fInfoLevelId=0x0, lpFileInformation=0x27d6458 | out: lpFileInformation=0x27d6458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x464ef1a0, ftCreationTime.dwHighDateTime=0x1d4d591, ftLastAccessTime.dwLowDateTime=0xd6897db0, ftLastAccessTime.dwHighDateTime=0x1d4ca7b, ftLastWriteTime.dwLowDateTime=0xd6897db0, ftLastWriteTime.dwHighDateTime=0x1d4ca7b, nFileSizeHigh=0x0, nFileSizeLow=0xfec5)) returned 1
	[0125.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.147] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp", lpFilePart=0x0) returned 0x27
	[0125.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.147] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7jrluskcu.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.147] GetFileType (hFile=0x5dc) returned 0x1
	[0125.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.147] GetFileType (hFile=0x5dc) returned 0x1
	[0125.147] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xfec5
	[0125.147] ReadFile (in: hFile=0x5dc, lpBuffer=0x27d6640, nNumberOfBytesToRead=0xfec5, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27d6640*, lpNumberOfBytesRead=0x593f2cc*=0xfec5, lpOverlapped=0x0) returned 1
	[0125.149] CloseHandle (hObject=0x5dc) returned 1
	[0125.149] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.149] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.149] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e65a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0125.149] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.149] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.149] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0125.149] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.149] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27e665c*=0x1, dwFlags=0x0) returned 1
	[0125.149] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27e6628, dwFlags=0x0) returned 1
	[0125.149] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e666c*, pdwDataLen=0x593f2d4*=0xfed0, dwBufLen=0xfed0 | out: pbData=0x27e666c*, pdwDataLen=0x593f2d4*=0xfed0) returned 1
	[0125.150] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f6548*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27f6548*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.150] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0125.150] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.150] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp", lpFilePart=0x0) returned 0x27
	[0125.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.150] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7jrluskcu.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.152] GetFileType (hFile=0x5dc) returned 0x1
	[0125.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.152] GetFileType (hFile=0x5dc) returned 0x1
	[0125.152] WriteFile (in: hFile=0x5dc, lpBuffer=0x27e666c*, nNumberOfBytesToWrite=0xfed0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27e666c*, lpNumberOfBytesWritten=0x593f2c0*=0xfed0, lpOverlapped=0x0) returned 1
	[0125.154] CloseHandle (hObject=0x5dc) returned 1
	[0125.154] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp", lpFilePart=0x0) returned 0x27
	[0125.154] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x56
	[0125.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.154] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7jrluskcu.bmp"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x464ef1a0, ftCreationTime.dwHighDateTime=0x1d4d591, ftLastAccessTime.dwLowDateTime=0xd6897db0, ftLastAccessTime.dwHighDateTime=0x1d4ca7b, ftLastWriteTime.dwLowDateTime=0x84ec5720, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xfed0)) returned 1
	[0125.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.154] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7jrluskcu.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\e7jrLUSkcu.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\e7jrluskcu.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.155] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png", lpFilePart=0x0) returned 0x22
	[0125.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.155] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png" (normalized: "c:\\users\\fd1hvy\\pictures\\etp9d.png"), fInfoLevelId=0x0, lpFileInformation=0x27f68a0 | out: lpFileInformation=0x27f68a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d060890, ftCreationTime.dwHighDateTime=0x1d4d334, ftLastAccessTime.dwLowDateTime=0x604ce5a0, ftLastAccessTime.dwHighDateTime=0x1d4d300, ftLastWriteTime.dwLowDateTime=0x604ce5a0, ftLastWriteTime.dwHighDateTime=0x1d4d300, nFileSizeHigh=0x0, nFileSizeLow=0x13dc5)) returned 1
	[0125.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png", lpFilePart=0x0) returned 0x22
	[0125.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.156] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png" (normalized: "c:\\users\\fd1hvy\\pictures\\etp9d.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.156] GetFileType (hFile=0x5dc) returned 0x1
	[0125.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.156] GetFileType (hFile=0x5dc) returned 0x1
	[0125.162] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x13dc5
	[0125.162] ReadFile (in: hFile=0x5dc, lpBuffer=0x27f6a60, nNumberOfBytesToRead=0x13dc5, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27f6a60*, lpNumberOfBytesRead=0x593f2cc*=0x13dc5, lpOverlapped=0x0) returned 1
	[0125.163] CloseHandle (hObject=0x5dc) returned 1
	[0125.163] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.163] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.164] CryptImportKey (in: hProv=0x7f93c0, pbData=0x280a8c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0125.164] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.164] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.164] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0125.164] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.164] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x280a97c*=0x1, dwFlags=0x0) returned 1
	[0125.164] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x280a948, dwFlags=0x0) returned 1
	[0125.164] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x280a98c*, pdwDataLen=0x593f2d4*=0x13dd0, dwBufLen=0x13dd0 | out: pbData=0x280a98c*, pdwDataLen=0x593f2d4*=0x13dd0) returned 1
	[0125.164] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x281e768*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x281e768*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.164] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0125.164] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.164] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.165] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png", lpFilePart=0x0) returned 0x22
	[0125.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.165] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png" (normalized: "c:\\users\\fd1hvy\\pictures\\etp9d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.167] GetFileType (hFile=0x5dc) returned 0x1
	[0125.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.167] GetFileType (hFile=0x5dc) returned 0x1
	[0125.167] WriteFile (in: hFile=0x5dc, lpBuffer=0x280a98c*, nNumberOfBytesToWrite=0x13dd0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x280a98c*, lpNumberOfBytesWritten=0x593f2c0*=0x13dd0, lpOverlapped=0x0) returned 1
	[0125.169] CloseHandle (hObject=0x5dc) returned 1
	[0125.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png", lpFilePart=0x0) returned 0x22
	[0125.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x51
	[0125.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.169] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png" (normalized: "c:\\users\\fd1hvy\\pictures\\etp9d.png"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d060890, ftCreationTime.dwHighDateTime=0x1d4d334, ftLastAccessTime.dwLowDateTime=0x604ce5a0, ftLastAccessTime.dwHighDateTime=0x1d4d300, ftLastWriteTime.dwLowDateTime=0x84eeec09, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13dd0)) returned 1
	[0125.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.170] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png" (normalized: "c:\\users\\fd1hvy\\pictures\\etp9d.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Etp9d.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\etp9d.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.170] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg", lpFilePart=0x0) returned 0x30
	[0125.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.171] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fek6ezdtcihugztgodx.jpg"), fInfoLevelId=0x0, lpFileInformation=0x281ea80 | out: lpFileInformation=0x281ea80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62d69e50, ftCreationTime.dwHighDateTime=0x1d4c73a, ftLastAccessTime.dwLowDateTime=0x4f2d7b70, ftLastAccessTime.dwHighDateTime=0x1d4cdc1, ftLastWriteTime.dwLowDateTime=0x4f2d7b70, ftLastWriteTime.dwHighDateTime=0x1d4cdc1, nFileSizeHigh=0x0, nFileSizeLow=0x3cc8)) returned 1
	[0125.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.171] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg", lpFilePart=0x0) returned 0x30
	[0125.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.171] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fek6ezdtcihugztgodx.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.171] GetFileType (hFile=0x5dc) returned 0x1
	[0125.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.172] GetFileType (hFile=0x5dc) returned 0x1
	[0125.172] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3cc8
	[0125.172] ReadFile (in: hFile=0x5dc, lpBuffer=0x281ecb0, nNumberOfBytesToRead=0x3cc8, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x281ecb0*, lpNumberOfBytesRead=0x593f2cc*=0x3cc8, lpOverlapped=0x0) returned 1
	[0125.226] CloseHandle (hObject=0x5dc) returned 1
	[0125.226] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.227] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.227] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2822a14, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0125.227] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.227] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.227] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0125.227] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.227] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2822acc*=0x1, dwFlags=0x0) returned 1
	[0125.227] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2822a98, dwFlags=0x0) returned 1
	[0125.227] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2822adc*, pdwDataLen=0x593f2d4*=0x3cd0, dwBufLen=0x3cd0 | out: pbData=0x2822adc*, pdwDataLen=0x593f2d4*=0x3cd0) returned 1
	[0125.227] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28267b8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x28267b8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.227] CryptDestroyKey (hKey=0x82b280) returned 1
	[0125.227] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.228] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.228] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg", lpFilePart=0x0) returned 0x30
	[0125.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.228] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fek6ezdtcihugztgodx.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.229] GetFileType (hFile=0x5dc) returned 0x1
	[0125.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.229] GetFileType (hFile=0x5dc) returned 0x1
	[0125.229] WriteFile (in: hFile=0x5dc, lpBuffer=0x2822adc*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2822adc*, lpNumberOfBytesWritten=0x593f2c0*=0x3cd0, lpOverlapped=0x0) returned 1
	[0125.230] CloseHandle (hObject=0x5dc) returned 1
	[0125.231] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg", lpFilePart=0x0) returned 0x30
	[0125.231] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0125.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.231] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fek6ezdtcihugztgodx.jpg"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62d69e50, ftCreationTime.dwHighDateTime=0x1d4c73a, ftLastAccessTime.dwLowDateTime=0x4f2d7b70, ftLastAccessTime.dwHighDateTime=0x1d4cdc1, ftLastWriteTime.dwLowDateTime=0x84f842cb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3cd0)) returned 1
	[0125.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.231] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fek6ezdtcihugztgodx.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\feK6eZdtcihugZTGOdx.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\fek6ezdtcihugztgodx.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.232] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp", lpFilePart=0x0) returned 0x26
	[0125.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.232] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hzg79a8f_.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2826b78 | out: lpFileInformation=0x2826b78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec452800, ftCreationTime.dwHighDateTime=0x1d4ced8, ftLastAccessTime.dwLowDateTime=0x9ade9ef0, ftLastAccessTime.dwHighDateTime=0x1d4c88a, ftLastWriteTime.dwLowDateTime=0x9ade9ef0, ftLastWriteTime.dwHighDateTime=0x1d4c88a, nFileSizeHigh=0x0, nFileSizeLow=0x1314d)) returned 1
	[0125.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp", lpFilePart=0x0) returned 0x26
	[0125.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.233] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hzg79a8f_.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.233] GetFileType (hFile=0x5dc) returned 0x1
	[0125.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.233] GetFileType (hFile=0x5dc) returned 0x1
	[0125.233] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1314d
	[0125.233] ReadFile (in: hFile=0x5dc, lpBuffer=0x2826d58, nNumberOfBytesToRead=0x1314d, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2826d58*, lpNumberOfBytesRead=0x593f2cc*=0x1314d, lpOverlapped=0x0) returned 1
	[0125.234] CloseHandle (hObject=0x5dc) returned 1
	[0125.234] CryptDestroyKey (hKey=0x82b340) returned 1
	[0125.235] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.235] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2839f44, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0125.235] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.235] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.235] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b040) returned 1
	[0125.235] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.235] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2839ffc*=0x1, dwFlags=0x0) returned 1
	[0125.235] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2839fc8, dwFlags=0x0) returned 1
	[0125.237] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263f870*, pdwDataLen=0x593f2d4*=0x13150, dwBufLen=0x13150 | out: pbData=0x263f870*, pdwDataLen=0x593f2d4*=0x13150) returned 1
	[0125.237] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26529cc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26529cc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.237] CryptDestroyKey (hKey=0x82b040) returned 1
	[0125.237] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.237] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.238] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp", lpFilePart=0x0) returned 0x26
	[0125.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.238] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hzg79a8f_.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.239] GetFileType (hFile=0x5dc) returned 0x1
	[0125.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.239] GetFileType (hFile=0x5dc) returned 0x1
	[0125.239] WriteFile (in: hFile=0x5dc, lpBuffer=0x263f870*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x263f870*, lpNumberOfBytesWritten=0x593f2c0*=0x13150, lpOverlapped=0x0) returned 1
	[0125.242] CloseHandle (hObject=0x5dc) returned 1
	[0125.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp", lpFilePart=0x0) returned 0x26
	[0125.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x55
	[0125.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hzg79a8f_.bmp"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec452800, ftCreationTime.dwHighDateTime=0x1d4ced8, ftLastAccessTime.dwLowDateTime=0x9ade9ef0, ftLastAccessTime.dwHighDateTime=0x1d4c88a, ftLastWriteTime.dwLowDateTime=0x84faa5d5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13150)) returned 1
	[0125.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.242] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hzg79a8f_.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\HZg79A8F_.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\hzg79a8f_.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.243] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png", lpFilePart=0x0) returned 0x2d
	[0125.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.243] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png" (normalized: "c:\\users\\fd1hvy\\pictures\\i2pbbseix4zh9h0o.png"), fInfoLevelId=0x0, lpFileInformation=0x2652d14 | out: lpFileInformation=0x2652d14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce137420, ftCreationTime.dwHighDateTime=0x1d4d484, ftLastAccessTime.dwLowDateTime=0x86e5d760, ftLastAccessTime.dwHighDateTime=0x1d4c86c, ftLastWriteTime.dwLowDateTime=0x86e5d760, ftLastWriteTime.dwHighDateTime=0x1d4c86c, nFileSizeHigh=0x0, nFileSizeLow=0xf734)) returned 1
	[0125.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.243] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png", lpFilePart=0x0) returned 0x2d
	[0125.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.243] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png" (normalized: "c:\\users\\fd1hvy\\pictures\\i2pbbseix4zh9h0o.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.244] GetFileType (hFile=0x5dc) returned 0x1
	[0125.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.244] GetFileType (hFile=0x5dc) returned 0x1
	[0125.244] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xf734
	[0125.244] ReadFile (in: hFile=0x5dc, lpBuffer=0x2652f2c, nNumberOfBytesToRead=0xf734, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2652f2c*, lpNumberOfBytesRead=0x593f2cc*=0xf734, lpOverlapped=0x0) returned 1
	[0125.245] CloseHandle (hObject=0x5dc) returned 1
	[0125.245] CryptDestroyKey (hKey=0x82b400) returned 1
	[0125.245] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.245] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26626fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0125.245] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.245] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.245] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0125.245] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.245] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26627b4*=0x1, dwFlags=0x0) returned 1
	[0125.245] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2662780, dwFlags=0x0) returned 1
	[0125.245] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26627c4*, pdwDataLen=0x593f2d4*=0xf740, dwBufLen=0xf740 | out: pbData=0x26627c4*, pdwDataLen=0x593f2d4*=0xf740) returned 1
	[0125.246] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2671f10*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2671f10*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.246] CryptDestroyKey (hKey=0x82b540) returned 1
	[0125.246] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.246] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png", lpFilePart=0x0) returned 0x2d
	[0125.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.246] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png" (normalized: "c:\\users\\fd1hvy\\pictures\\i2pbbseix4zh9h0o.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.247] GetFileType (hFile=0x5dc) returned 0x1
	[0125.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.247] GetFileType (hFile=0x5dc) returned 0x1
	[0125.248] WriteFile (in: hFile=0x5dc, lpBuffer=0x26627c4*, nNumberOfBytesToWrite=0xf740, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26627c4*, lpNumberOfBytesWritten=0x593f2c0*=0xf740, lpOverlapped=0x0) returned 1
	[0125.250] CloseHandle (hObject=0x5dc) returned 1
	[0125.250] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png", lpFilePart=0x0) returned 0x2d
	[0125.251] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0125.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.251] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png" (normalized: "c:\\users\\fd1hvy\\pictures\\i2pbbseix4zh9h0o.png"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce137420, ftCreationTime.dwHighDateTime=0x1d4d484, ftLastAccessTime.dwLowDateTime=0x86e5d760, ftLastAccessTime.dwHighDateTime=0x1d4c86c, ftLastWriteTime.dwLowDateTime=0x84fd07ea, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xf740)) returned 1
	[0125.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.251] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png" (normalized: "c:\\users\\fd1hvy\\pictures\\i2pbbseix4zh9h0o.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\I2pBbseix4zH9h0O.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\i2pbbseix4zh9h0o.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg", lpFilePart=0x0) returned 0x23
	[0125.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.252] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ightif.jpg"), fInfoLevelId=0x0, lpFileInformation=0x26722b0 | out: lpFileInformation=0x26722b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28ef2ee0, ftCreationTime.dwHighDateTime=0x1d4cb46, ftLastAccessTime.dwLowDateTime=0xe1d1a40, ftLastAccessTime.dwHighDateTime=0x1d4cd90, ftLastWriteTime.dwLowDateTime=0xe1d1a40, ftLastWriteTime.dwHighDateTime=0x1d4cd90, nFileSizeHigh=0x0, nFileSizeLow=0xf682)) returned 1
	[0125.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg", lpFilePart=0x0) returned 0x23
	[0125.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.252] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ightif.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.252] GetFileType (hFile=0x5dc) returned 0x1
	[0125.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.252] GetFileType (hFile=0x5dc) returned 0x1
	[0125.252] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xf682
	[0125.253] ReadFile (in: hFile=0x5dc, lpBuffer=0x2672478, nNumberOfBytesToRead=0xf682, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2672478*, lpNumberOfBytesRead=0x593f2cc*=0xf682, lpOverlapped=0x0) returned 1
	[0125.254] CloseHandle (hObject=0x5dc) returned 1
	[0125.254] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.254] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.254] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2681b98, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0125.254] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.254] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.254] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b2c0) returned 1
	[0125.254] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.254] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2681c50*=0x1, dwFlags=0x0) returned 1
	[0125.254] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2681c1c, dwFlags=0x0) returned 1
	[0125.254] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2681c60*, pdwDataLen=0x593f2d4*=0xf690, dwBufLen=0xf690 | out: pbData=0x2681c60*, pdwDataLen=0x593f2d4*=0xf690) returned 1
	[0125.254] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26912fc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26912fc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.254] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0125.254] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.254] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.254] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg", lpFilePart=0x0) returned 0x23
	[0125.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.255] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ightif.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.256] GetFileType (hFile=0x5dc) returned 0x1
	[0125.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.256] GetFileType (hFile=0x5dc) returned 0x1
	[0125.256] WriteFile (in: hFile=0x5dc, lpBuffer=0x2681c60*, nNumberOfBytesToWrite=0xf690, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2681c60*, lpNumberOfBytesWritten=0x593f2c0*=0xf690, lpOverlapped=0x0) returned 1
	[0125.258] CloseHandle (hObject=0x5dc) returned 1
	[0125.258] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg", lpFilePart=0x0) returned 0x23
	[0125.258] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0125.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.259] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ightif.jpg"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28ef2ee0, ftCreationTime.dwHighDateTime=0x1d4cb46, ftLastAccessTime.dwLowDateTime=0xe1d1a40, ftLastAccessTime.dwHighDateTime=0x1d4cd90, ftLastWriteTime.dwLowDateTime=0x84fd07ea, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xf690)) returned 1
	[0125.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.259] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ightif.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\IGHtIf.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\ightif.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.260] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg", lpFilePart=0x0) returned 0x23
	[0125.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.260] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\iwz i6.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2691624 | out: lpFileInformation=0x2691624*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76358d60, ftCreationTime.dwHighDateTime=0x1d4d52e, ftLastAccessTime.dwLowDateTime=0xc9785a00, ftLastAccessTime.dwHighDateTime=0x1d4d288, ftLastWriteTime.dwLowDateTime=0xc9785a00, ftLastWriteTime.dwHighDateTime=0x1d4d288, nFileSizeHigh=0x0, nFileSizeLow=0xac49)) returned 1
	[0125.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.260] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg", lpFilePart=0x0) returned 0x23
	[0125.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.260] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\iwz i6.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.260] GetFileType (hFile=0x5dc) returned 0x1
	[0125.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.260] GetFileType (hFile=0x5dc) returned 0x1
	[0125.260] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xac49
	[0125.260] ReadFile (in: hFile=0x5dc, lpBuffer=0x26917ec, nNumberOfBytesToRead=0xac49, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26917ec*, lpNumberOfBytesRead=0x593f2cc*=0xac49, lpOverlapped=0x0) returned 1
	[0125.261] CloseHandle (hObject=0x5dc) returned 1
	[0125.261] CryptDestroyKey (hKey=0x82b540) returned 1
	[0125.261] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.262] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269c4d4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b200) returned 1
	[0125.262] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.262] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.262] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0125.262] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.262] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x269c58c*=0x1, dwFlags=0x0) returned 1
	[0125.262] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x269c558, dwFlags=0x0) returned 1
	[0125.262] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269c59c*, pdwDataLen=0x593f2d4*=0xac50, dwBufLen=0xac50 | out: pbData=0x269c59c*, pdwDataLen=0x593f2d4*=0xac50) returned 1
	[0125.262] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a71f8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26a71f8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.262] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0125.262] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.262] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.262] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg", lpFilePart=0x0) returned 0x23
	[0125.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.262] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\iwz i6.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.264] GetFileType (hFile=0x5dc) returned 0x1
	[0125.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.264] GetFileType (hFile=0x5dc) returned 0x1
	[0125.264] WriteFile (in: hFile=0x5dc, lpBuffer=0x269c59c*, nNumberOfBytesToWrite=0xac50, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x269c59c*, lpNumberOfBytesWritten=0x593f2c0*=0xac50, lpOverlapped=0x0) returned 1
	[0125.266] CloseHandle (hObject=0x5dc) returned 1
	[0125.266] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg", lpFilePart=0x0) returned 0x23
	[0125.266] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x52
	[0125.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.266] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\iwz i6.jpg"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76358d60, ftCreationTime.dwHighDateTime=0x1d4d52e, ftLastAccessTime.dwLowDateTime=0xc9785a00, ftLastAccessTime.dwHighDateTime=0x1d4d288, ftLastWriteTime.dwLowDateTime=0x84ff6a15, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xac50)) returned 1
	[0125.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.266] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\iwz i6.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\IWZ I6.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\iwz i6.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.267] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png", lpFilePart=0x0) returned 0x29
	[0125.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.267] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jfsabdgb9yyh.png"), fInfoLevelId=0x0, lpFileInformation=0x26a7520 | out: lpFileInformation=0x26a7520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4732f0, ftCreationTime.dwHighDateTime=0x1d4d1bc, ftLastAccessTime.dwLowDateTime=0xddc7ee40, ftLastAccessTime.dwHighDateTime=0x1d4ca0d, ftLastWriteTime.dwLowDateTime=0xddc7ee40, ftLastWriteTime.dwHighDateTime=0x1d4ca0d, nFileSizeHigh=0x0, nFileSizeLow=0x161b9)) returned 1
	[0125.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.267] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png", lpFilePart=0x0) returned 0x29
	[0125.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.267] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jfsabdgb9yyh.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.268] GetFileType (hFile=0x5dc) returned 0x1
	[0125.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.268] GetFileType (hFile=0x5dc) returned 0x1
	[0125.268] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x161b9
	[0125.268] ReadFile (in: hFile=0x5dc, lpBuffer=0x7951818, nNumberOfBytesToRead=0x161b9, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x7951818*, lpNumberOfBytesRead=0x593f2cc*=0x161b9, lpOverlapped=0x0) returned 1
	[0125.270] CloseHandle (hObject=0x5dc) returned 1
	[0125.270] CryptDestroyKey (hKey=0x82b200) returned 1
	[0125.270] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.270] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a77a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0125.270] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.271] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.271] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b4c0) returned 1
	[0125.271] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.271] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26a7860*=0x1, dwFlags=0x0) returned 1
	[0125.271] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26a782c, dwFlags=0x0) returned 1
	[0125.273] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x79679f0*, pdwDataLen=0x593f2d4*=0x161c0, dwBufLen=0x161c0 | out: pbData=0x79679f0*, pdwDataLen=0x593f2d4*=0x161c0) returned 1
	[0125.273] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a7870*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26a7870*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.273] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0125.273] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.273] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.273] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png", lpFilePart=0x0) returned 0x29
	[0125.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.273] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jfsabdgb9yyh.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.275] GetFileType (hFile=0x5dc) returned 0x1
	[0125.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.275] GetFileType (hFile=0x5dc) returned 0x1
	[0125.275] WriteFile (in: hFile=0x5dc, lpBuffer=0x79679f0*, nNumberOfBytesToWrite=0x161c0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x79679f0*, lpNumberOfBytesWritten=0x593f2c0*=0x161c0, lpOverlapped=0x0) returned 1
	[0125.278] CloseHandle (hObject=0x5dc) returned 1
	[0125.278] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png", lpFilePart=0x0) returned 0x29
	[0125.278] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x58
	[0125.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.278] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jfsabdgb9yyh.png"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4732f0, ftCreationTime.dwHighDateTime=0x1d4d1bc, ftLastAccessTime.dwLowDateTime=0xddc7ee40, ftLastAccessTime.dwHighDateTime=0x1d4ca0d, ftLastWriteTime.dwLowDateTime=0x84ff6a15, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x161c0)) returned 1
	[0125.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.278] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jfsabdgb9yyh.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\jFSAbdgB9yYH.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\jfsabdgb9yyh.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.279] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif", lpFilePart=0x0) returned 0x2e
	[0125.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.279] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\jqgfiqnpvovlzd_z-.gif"), fInfoLevelId=0x0, lpFileInformation=0x26a7be0 | out: lpFileInformation=0x26a7be0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c22930, ftCreationTime.dwHighDateTime=0x1d4cfa7, ftLastAccessTime.dwLowDateTime=0x9ee9dcd0, ftLastAccessTime.dwHighDateTime=0x1d4d073, ftLastWriteTime.dwLowDateTime=0x9ee9dcd0, ftLastWriteTime.dwHighDateTime=0x1d4d073, nFileSizeHigh=0x0, nFileSizeLow=0x6fb9)) returned 1
	[0125.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.279] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif", lpFilePart=0x0) returned 0x2e
	[0125.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.279] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\jqgfiqnpvovlzd_z-.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.279] GetFileType (hFile=0x5dc) returned 0x1
	[0125.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.280] GetFileType (hFile=0x5dc) returned 0x1
	[0125.280] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x6fb9
	[0125.280] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a7e00, nNumberOfBytesToRead=0x6fb9, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26a7e00*, lpNumberOfBytesRead=0x593f2cc*=0x6fb9, lpOverlapped=0x0) returned 1
	[0125.284] CloseHandle (hObject=0x5dc) returned 1
	[0125.284] CryptDestroyKey (hKey=0x82b280) returned 1
	[0125.284] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.284] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26aee58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b4c0) returned 1
	[0125.284] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.284] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.284] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b300) returned 1
	[0125.284] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.284] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26aef10*=0x1, dwFlags=0x0) returned 1
	[0125.284] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26aeedc, dwFlags=0x0) returned 1
	[0125.284] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26aef20*, pdwDataLen=0x593f2d4*=0x6fc0, dwBufLen=0x6fc0 | out: pbData=0x26aef20*, pdwDataLen=0x593f2d4*=0x6fc0) returned 1
	[0125.284] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b5eec*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26b5eec*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.285] CryptDestroyKey (hKey=0x82b300) returned 1
	[0125.285] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.285] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.285] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif", lpFilePart=0x0) returned 0x2e
	[0125.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.285] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\jqgfiqnpvovlzd_z-.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.286] GetFileType (hFile=0x5dc) returned 0x1
	[0125.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.286] GetFileType (hFile=0x5dc) returned 0x1
	[0125.286] WriteFile (in: hFile=0x5dc, lpBuffer=0x26aef20*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26aef20*, lpNumberOfBytesWritten=0x593f2c0*=0x6fc0, lpOverlapped=0x0) returned 1
	[0125.288] CloseHandle (hObject=0x5dc) returned 1
	[0125.288] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif", lpFilePart=0x0) returned 0x2e
	[0125.288] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0125.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.288] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\jqgfiqnpvovlzd_z-.gif"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c22930, ftCreationTime.dwHighDateTime=0x1d4cfa7, ftLastAccessTime.dwLowDateTime=0x9ee9dcd0, ftLastAccessTime.dwHighDateTime=0x1d4d073, ftLastWriteTime.dwLowDateTime=0x8501cc64, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x6fc0)) returned 1
	[0125.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.288] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\jqgfiqnpvovlzd_z-.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\jqgFIqnpvOvLZD_z-.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\jqgfiqnpvovlzd_z-.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.289] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg", lpFilePart=0x0) returned 0x31
	[0125.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.289] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\kedz whklkbty18n6ckq.jpg"), fInfoLevelId=0x0, lpFileInformation=0x26b6294 | out: lpFileInformation=0x26b6294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c95810, ftCreationTime.dwHighDateTime=0x1d4c870, ftLastAccessTime.dwLowDateTime=0xa902e690, ftLastAccessTime.dwHighDateTime=0x1d4cbd1, ftLastWriteTime.dwLowDateTime=0xa902e690, ftLastWriteTime.dwHighDateTime=0x1d4cbd1, nFileSizeHigh=0x0, nFileSizeLow=0x14329)) returned 1
	[0125.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.289] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg", lpFilePart=0x0) returned 0x31
	[0125.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.289] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\kedz whklkbty18n6ckq.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.290] GetFileType (hFile=0x5dc) returned 0x1
	[0125.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.290] GetFileType (hFile=0x5dc) returned 0x1
	[0125.290] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x14329
	[0125.290] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b64cc, nNumberOfBytesToRead=0x14329, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26b64cc*, lpNumberOfBytesRead=0x593f2cc*=0x14329, lpOverlapped=0x0) returned 1
	[0125.291] CloseHandle (hObject=0x5dc) returned 1
	[0125.291] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0125.291] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.291] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ca894, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0125.291] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.291] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.291] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0125.291] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.291] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26ca94c*=0x1, dwFlags=0x0) returned 1
	[0125.291] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26ca918, dwFlags=0x0) returned 1
	[0125.291] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ca95c*, pdwDataLen=0x593f2d4*=0x14330, dwBufLen=0x14330 | out: pbData=0x26ca95c*, pdwDataLen=0x593f2d4*=0x14330) returned 1
	[0125.292] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dec98*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26dec98*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.292] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0125.292] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.292] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg", lpFilePart=0x0) returned 0x31
	[0125.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.292] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\kedz whklkbty18n6ckq.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.294] GetFileType (hFile=0x5dc) returned 0x1
	[0125.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.294] GetFileType (hFile=0x5dc) returned 0x1
	[0125.294] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ca95c*, nNumberOfBytesToWrite=0x14330, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26ca95c*, lpNumberOfBytesWritten=0x593f2c0*=0x14330, lpOverlapped=0x0) returned 1
	[0125.312] CloseHandle (hObject=0x5dc) returned 1
	[0125.312] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg", lpFilePart=0x0) returned 0x31
	[0125.312] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x60
	[0125.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.312] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\kedz whklkbty18n6ckq.jpg"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c95810, ftCreationTime.dwHighDateTime=0x1d4c870, ftLastAccessTime.dwLowDateTime=0xa902e690, ftLastAccessTime.dwHighDateTime=0x1d4cbd1, ftLastWriteTime.dwLowDateTime=0x85069123, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x14330)) returned 1
	[0125.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.312] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\kedz whklkbty18n6ckq.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Kedz whkLKbTy18N6CKQ.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\pictures\\kedz whklkbty18n6ckq.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.313] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png", lpFilePart=0x0) returned 0x2b
	[0125.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.313] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\kggVr-zfra9Y39.png" (normalized: "c:\\users\\fd1hvy\\pictures\\kggvr-zfra9y39.png"), fInfoLevelId=0x0, lpFileInformation=0x26df068 | out: lpFileInformation=0x26df068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d74ea0, ftCreationTime.dwHighDateTime=0x1d4cdd7, ftLastAccessTime.dwLowDateTime=0xe21447f0, ftLastAccessTime.dwHighDateTime=0x1d4ce81, ftLastWriteTime.dwLowDateTime=0xe21447f0, ftLastWriteTime.dwHighDateTime=0x1d4ce81, nFileSizeHigh=0x0, nFileSizeLow=0x164ad)) returned 1
	[0125.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.405] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.586] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.750] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.866] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.925] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.925] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0125.939] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpFilePart=0x0) returned 0x63
	[0125.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.939] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.939] GetFileType (hFile=0x5dc) returned 0x1
	[0125.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.939] GetFileType (hFile=0x5dc) returned 0x1
	[0125.939] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x357
	[0125.939] ReadFile (in: hFile=0x5dc, lpBuffer=0x266e600, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x266e600*, lpNumberOfBytesRead=0x593f2cc*=0x357, lpOverlapped=0x0) returned 1
	[0125.960] CloseHandle (hObject=0x5dc) returned 1
	[0125.960] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0125.960] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.961] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266f69c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0125.961] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.961] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.961] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0125.961] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.961] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x266f754*=0x1, dwFlags=0x0) returned 1
	[0125.961] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x266f720, dwFlags=0x0) returned 1
	[0125.961] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266f764*, pdwDataLen=0x593f2d4*=0x360, dwBufLen=0x360 | out: pbData=0x266f764*, pdwDataLen=0x593f2d4*=0x360) returned 1
	[0125.961] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266fad0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x266fad0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.961] CryptDestroyKey (hKey=0x82b280) returned 1
	[0125.961] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.961] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.961] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpFilePart=0x0) returned 0x63
	[0125.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.963] GetFileType (hFile=0x5dc) returned 0x1
	[0125.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.963] GetFileType (hFile=0x5dc) returned 0x1
	[0125.963] WriteFile (in: hFile=0x5dc, lpBuffer=0x266fcc0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x266fcc0*, lpNumberOfBytesWritten=0x593f294*=0x360, lpOverlapped=0x0) returned 1
	[0125.964] CloseHandle (hObject=0x5dc) returned 1
	[0125.964] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpFilePart=0x0) returned 0x63
	[0125.964] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x92
	[0125.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.964] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x856895b3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0125.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.964] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.965] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\6t75.flv", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\6t75.flv", lpFilePart=0x0) returned 0x1f
	[0125.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.965] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\6t75.flv" (normalized: "c:\\users\\fd1hvy\\videos\\6t75.flv"), fInfoLevelId=0x0, lpFileInformation=0x2671104 | out: lpFileInformation=0x2671104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11bb26a0, ftCreationTime.dwHighDateTime=0x1d4cce2, ftLastAccessTime.dwLowDateTime=0x91e6f10, ftLastAccessTime.dwHighDateTime=0x1d4cb62, ftLastWriteTime.dwLowDateTime=0x91e6f10, ftLastWriteTime.dwHighDateTime=0x1d4cb62, nFileSizeHigh=0x0, nFileSizeLow=0xa65c)) returned 1
	[0125.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.965] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\6t75.flv", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\6t75.flv", lpFilePart=0x0) returned 0x1f
	[0125.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.965] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6t75.flv" (normalized: "c:\\users\\fd1hvy\\videos\\6t75.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.966] GetFileType (hFile=0x5dc) returned 0x1
	[0125.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.966] GetFileType (hFile=0x5dc) returned 0x1
	[0125.966] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xa65c
	[0125.966] ReadFile (in: hFile=0x5dc, lpBuffer=0x26712b4, nNumberOfBytesToRead=0xa65c, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26712b4*, lpNumberOfBytesRead=0x593f2cc*=0xa65c, lpOverlapped=0x0) returned 1
	[0125.967] CloseHandle (hObject=0x5dc) returned 1
	[0125.967] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0125.967] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.967] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267b9ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0125.967] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.967] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.967] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0125.967] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.968] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x267ba64*=0x1, dwFlags=0x0) returned 1
	[0125.968] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x267ba30, dwFlags=0x0) returned 1
	[0125.968] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267ba74*, pdwDataLen=0x593f2d4*=0xa660, dwBufLen=0xa660 | out: pbData=0x267ba74*, pdwDataLen=0x593f2d4*=0xa660) returned 1
	[0125.968] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26860e0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26860e0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.968] CryptDestroyKey (hKey=0x82b340) returned 1
	[0125.968] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.968] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.968] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\6t75.flv", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\6t75.flv", lpFilePart=0x0) returned 0x1f
	[0125.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.968] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6t75.flv" (normalized: "c:\\users\\fd1hvy\\videos\\6t75.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.970] GetFileType (hFile=0x5dc) returned 0x1
	[0125.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.970] GetFileType (hFile=0x5dc) returned 0x1
	[0125.970] WriteFile (in: hFile=0x5dc, lpBuffer=0x267ba74*, nNumberOfBytesToWrite=0xa660, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x267ba74*, lpNumberOfBytesWritten=0x593f2c0*=0xa660, lpOverlapped=0x0) returned 1
	[0125.971] CloseHandle (hObject=0x5dc) returned 1
	[0125.971] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\6t75.flv", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\6t75.flv", lpFilePart=0x0) returned 0x1f
	[0125.972] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\6t75.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\6t75.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x4e
	[0125.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.972] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\6t75.flv" (normalized: "c:\\users\\fd1hvy\\videos\\6t75.flv"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11bb26a0, ftCreationTime.dwHighDateTime=0x1d4cce2, ftLastAccessTime.dwLowDateTime=0x91e6f10, ftLastAccessTime.dwHighDateTime=0x1d4cb62, ftLastWriteTime.dwLowDateTime=0x856ab5da, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xa660)) returned 1
	[0125.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.972] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6t75.flv" (normalized: "c:\\users\\fd1hvy\\videos\\6t75.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6t75.flv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\6t75.flv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.973] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\desktop.ini", lpFilePart=0x0) returned 0x22
	[0125.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.973] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26863dc | out: lpFileInformation=0x26863dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8)) returned 1
	[0125.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.973] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\desktop.ini", lpFilePart=0x0) returned 0x22
	[0125.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.973] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.973] GetFileType (hFile=0x5dc) returned 0x1
	[0125.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.974] GetFileType (hFile=0x5dc) returned 0x1
	[0125.974] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1f8
	[0125.974] ReadFile (in: hFile=0x5dc, lpBuffer=0x26867a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26867a8*, lpNumberOfBytesRead=0x593f2cc*=0x1f8, lpOverlapped=0x0) returned 1
	[0125.975] CloseHandle (hObject=0x5dc) returned 1
	[0125.975] CryptDestroyKey (hKey=0x82b280) returned 1
	[0125.975] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.975] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2687844, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b380) returned 1
	[0125.975] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.975] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.975] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0125.975] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.975] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26878fc*=0x1, dwFlags=0x0) returned 1
	[0125.975] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26878c8, dwFlags=0x0) returned 1
	[0125.975] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268790c*, pdwDataLen=0x593f2d4*=0x200, dwBufLen=0x200 | out: pbData=0x268790c*, pdwDataLen=0x593f2d4*=0x200) returned 1
	[0125.975] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2687b18*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2687b18*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.976] CryptDestroyKey (hKey=0x82b540) returned 1
	[0125.976] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.976] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\desktop.ini", lpFilePart=0x0) returned 0x22
	[0125.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.976] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0125.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0125.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv", lpFilePart=0x0) returned 0x21
	[0125.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.978] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\pjbilq.mkv"), fInfoLevelId=0x0, lpFileInformation=0x2687ff0 | out: lpFileInformation=0x2687ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9100c570, ftCreationTime.dwHighDateTime=0x1d4cd58, ftLastAccessTime.dwLowDateTime=0x34df4770, ftLastAccessTime.dwHighDateTime=0x1d4c7f5, ftLastWriteTime.dwLowDateTime=0x34df4770, ftLastWriteTime.dwHighDateTime=0x1d4c7f5, nFileSizeHigh=0x0, nFileSizeLow=0xd380)) returned 1
	[0125.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv", lpFilePart=0x0) returned 0x21
	[0125.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.978] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\pjbilq.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.978] GetFileType (hFile=0x5dc) returned 0x1
	[0125.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.979] GetFileType (hFile=0x5dc) returned 0x1
	[0125.979] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xd380
	[0125.979] ReadFile (in: hFile=0x5dc, lpBuffer=0x26881b0, nNumberOfBytesToRead=0xd380, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26881b0*, lpNumberOfBytesRead=0x593f2cc*=0xd380, lpOverlapped=0x0) returned 1
	[0125.980] CloseHandle (hObject=0x5dc) returned 1
	[0125.980] CryptDestroyKey (hKey=0x82b380) returned 1
	[0125.980] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.980] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26955cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0125.980] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.980] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.980] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0125.980] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.980] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2695684*=0x1, dwFlags=0x0) returned 1
	[0125.980] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2695650, dwFlags=0x0) returned 1
	[0125.981] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2695694*, pdwDataLen=0x593f2d4*=0xd390, dwBufLen=0xd390 | out: pbData=0x2695694*, pdwDataLen=0x593f2d4*=0xd390) returned 1
	[0125.981] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a2a30*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26a2a30*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.981] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0125.981] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.981] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.981] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv", lpFilePart=0x0) returned 0x21
	[0125.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.981] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\pjbilq.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.983] GetFileType (hFile=0x5dc) returned 0x1
	[0125.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.983] GetFileType (hFile=0x5dc) returned 0x1
	[0125.983] WriteFile (in: hFile=0x5dc, lpBuffer=0x2695694*, nNumberOfBytesToWrite=0xd390, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2695694*, lpNumberOfBytesWritten=0x593f2c0*=0xd390, lpOverlapped=0x0) returned 1
	[0125.985] CloseHandle (hObject=0x5dc) returned 1
	[0125.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv", lpFilePart=0x0) returned 0x21
	[0125.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x50
	[0125.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.986] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\pjbilq.mkv"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9100c570, ftCreationTime.dwHighDateTime=0x1d4cd58, ftLastAccessTime.dwLowDateTime=0x34df4770, ftLastAccessTime.dwHighDateTime=0x1d4c7f5, ftLastWriteTime.dwLowDateTime=0x856d161c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xd390)) returned 1
	[0125.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.986] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\pjbilq.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PJBilQ.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\pjbilq.mkv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi", lpFilePart=0x0) returned 0x2e
	[0125.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.987] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x 8vkjwfhmvlywbhbxe.avi"), fInfoLevelId=0x0, lpFileInformation=0x26a2d44 | out: lpFileInformation=0x26a2d44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c16850, ftCreationTime.dwHighDateTime=0x1d4d3c0, ftLastAccessTime.dwLowDateTime=0x6d346f30, ftLastAccessTime.dwHighDateTime=0x1d4cb1d, ftLastWriteTime.dwLowDateTime=0x6d346f30, ftLastWriteTime.dwHighDateTime=0x1d4cb1d, nFileSizeHigh=0x0, nFileSizeLow=0x34e3)) returned 1
	[0125.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi", lpFilePart=0x0) returned 0x2e
	[0125.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x 8vkjwfhmvlywbhbxe.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.987] GetFileType (hFile=0x5dc) returned 0x1
	[0125.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.988] GetFileType (hFile=0x5dc) returned 0x1
	[0125.988] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x34e3
	[0125.988] ReadFile (in: hFile=0x5dc, lpBuffer=0x26a2f6c, nNumberOfBytesToRead=0x34e3, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26a2f6c*, lpNumberOfBytesRead=0x593f2cc*=0x34e3, lpOverlapped=0x0) returned 1
	[0125.989] CloseHandle (hObject=0x5dc) returned 1
	[0125.989] CryptDestroyKey (hKey=0x82b400) returned 1
	[0125.989] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.989] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a64ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b200) returned 1
	[0125.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.989] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b040) returned 1
	[0125.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0125.989] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x26a65a4*=0x1, dwFlags=0x0) returned 1
	[0125.989] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x26a6570, dwFlags=0x0) returned 1
	[0125.990] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a65b4*, pdwDataLen=0x593f2d4*=0x34f0, dwBufLen=0x34f0 | out: pbData=0x26a65b4*, pdwDataLen=0x593f2d4*=0x34f0) returned 1
	[0125.990] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a9ab0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26a9ab0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0125.990] CryptDestroyKey (hKey=0x82b040) returned 1
	[0125.990] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.990] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0125.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi", lpFilePart=0x0) returned 0x2e
	[0125.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0125.990] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x 8vkjwfhmvlywbhbxe.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.991] GetFileType (hFile=0x5dc) returned 0x1
	[0125.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0125.992] GetFileType (hFile=0x5dc) returned 0x1
	[0125.992] WriteFile (in: hFile=0x5dc, lpBuffer=0x26a65b4*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26a65b4*, lpNumberOfBytesWritten=0x593f2c0*=0x34f0, lpOverlapped=0x0) returned 1
	[0125.993] CloseHandle (hObject=0x5dc) returned 1
	[0125.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi", lpFilePart=0x0) returned 0x2e
	[0125.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0125.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0125.993] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x 8vkjwfhmvlywbhbxe.avi"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c16850, ftCreationTime.dwHighDateTime=0x1d4d3c0, ftLastAccessTime.dwLowDateTime=0x6d346f30, ftLastAccessTime.dwHighDateTime=0x1d4cb1d, ftLastWriteTime.dwLowDateTime=0x856d161c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x34f0)) returned 1
	[0125.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0125.994] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x 8vkjwfhmvlywbhbxe.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\X 8VKJWfhmVLyWbhbxE.avi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\videos\\x 8vkjwfhmvlywbhbxe.avi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0125.994] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\AccountPictures\\desktop.ini", lpFilePart=0x0) returned 0x2b
	[0125.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0125.995] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26a9e5c | out: lpFileInformation=0x26a9e5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4)) returned 1
	[0125.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0125.995] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\AccountPictures\\desktop.ini", lpFilePart=0x0) returned 0x2b
	[0125.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0125.995] CreateFileW (lpFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0125.995] GetFileType (hFile=0x5dc) returned 0x1
	[0125.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0125.995] GetFileType (hFile=0x5dc) returned 0x1
	[0125.995] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xc4
	[0125.995] ReadFile (in: hFile=0x5dc, lpBuffer=0x26aa114, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26aa114*, lpNumberOfBytesRead=0x593f2cc*=0xc4, lpOverlapped=0x0) returned 1
	[0126.082] CloseHandle (hObject=0x5dc) returned 1
	[0126.082] CryptDestroyKey (hKey=0x82b200) returned 1
	[0126.082] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.082] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ab1b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0126.082] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.082] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.083] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0126.083] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.083] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26ab268*=0x1, dwFlags=0x0) returned 1
	[0126.083] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26ab234, dwFlags=0x0) returned 1
	[0126.083] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ab278*, pdwDataLen=0x593f2d4*=0xd0, dwBufLen=0xd0 | out: pbData=0x26ab278*, pdwDataLen=0x593f2d4*=0xd0) returned 1
	[0126.083] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ab354*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26ab354*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.083] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0126.083] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.083] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.083] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\AccountPictures\\desktop.ini", lpFilePart=0x0) returned 0x2b
	[0126.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.083] CreateFileW (lpFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0126.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0126.085] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", lpFilePart=0x0) returned 0x2d
	[0126.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.085] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x26ab870 | out: lpFileInformation=0x26ab870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852)) returned 1
	[0126.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.086] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", lpFilePart=0x0) returned 0x2d
	[0126.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.086] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.086] GetFileType (hFile=0x5dc) returned 0x1
	[0126.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.086] GetFileType (hFile=0x5dc) returned 0x1
	[0126.086] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x852
	[0126.086] ReadFile (in: hFile=0x5dc, lpBuffer=0x26ac2e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26ac2e8*, lpNumberOfBytesRead=0x593f2cc*=0x852, lpOverlapped=0x0) returned 1
	[0126.087] CloseHandle (hObject=0x5dc) returned 1
	[0126.087] CryptDestroyKey (hKey=0x82b540) returned 1
	[0126.087] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.087] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ad384, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0126.087] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.088] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.088] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b480) returned 1
	[0126.088] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.088] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26ad43c*=0x1, dwFlags=0x0) returned 1
	[0126.088] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26ad408, dwFlags=0x0) returned 1
	[0126.088] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ad44c*, pdwDataLen=0x593f2d4*=0x860, dwBufLen=0x860 | out: pbData=0x26ad44c*, pdwDataLen=0x593f2d4*=0x860) returned 1
	[0126.088] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26adcb8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26adcb8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.088] CryptDestroyKey (hKey=0x82b480) returned 1
	[0126.088] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.088] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.088] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", lpFilePart=0x0) returned 0x2d
	[0126.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.088] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.090] GetFileType (hFile=0x5dc) returned 0x1
	[0126.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0126.090] GetFileType (hFile=0x5dc) returned 0x1
	[0126.090] WriteFile (in: hFile=0x5dc, lpBuffer=0x26addd0*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x26addd0*, lpNumberOfBytesWritten=0x593f294*=0x860, lpOverlapped=0x0) returned 1
	[0126.091] CloseHandle (hObject=0x5dc) returned 1
	[0126.091] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", lpFilePart=0x0) returned 0x2d
	[0126.091] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5c
	[0126.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0126.091] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x857b64d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x860)) returned 1
	[0126.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0126.091] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0126.092] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x23
	[0126.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26af064 | out: lpFileInformation=0x26af064*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae)) returned 1
	[0126.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.092] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x23
	[0126.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.093] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.093] GetFileType (hFile=0x5dc) returned 0x1
	[0126.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.093] GetFileType (hFile=0x5dc) returned 0x1
	[0126.093] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xae
	[0126.093] ReadFile (in: hFile=0x5dc, lpBuffer=0x26af2e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26af2e8*, lpNumberOfBytesRead=0x593f2cc*=0xae, lpOverlapped=0x0) returned 1
	[0126.094] CloseHandle (hObject=0x5dc) returned 1
	[0126.094] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0126.094] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.094] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b0384, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0126.094] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.094] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.094] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0126.094] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.094] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26b043c*=0x1, dwFlags=0x0) returned 1
	[0126.094] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26b0408, dwFlags=0x0) returned 1
	[0126.095] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b044c*, pdwDataLen=0x593f2d4*=0xb0, dwBufLen=0xb0 | out: pbData=0x26b044c*, pdwDataLen=0x593f2d4*=0xb0) returned 1
	[0126.095] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b0508*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26b0508*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.095] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0126.095] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.095] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.095] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x23
	[0126.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.095] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0126.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0126.097] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", lpFilePart=0x0) returned 0x29
	[0126.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.097] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), fInfoLevelId=0x0, lpFileInformation=0x26b09e4 | out: lpFileInformation=0x26b09e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a)) returned 1
	[0126.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.097] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", lpFilePart=0x0) returned 0x29
	[0126.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.097] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.097] GetFileType (hFile=0x5dc) returned 0x1
	[0126.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.097] GetFileType (hFile=0x5dc) returned 0x1
	[0126.097] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x91a
	[0126.098] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b1504, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26b1504*, lpNumberOfBytesRead=0x593f2cc*=0x91a, lpOverlapped=0x0) returned 1
	[0126.098] CloseHandle (hObject=0x5dc) returned 1
	[0126.098] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0126.098] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.099] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b25a0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0126.099] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.099] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.099] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0126.099] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.099] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26b2658*=0x1, dwFlags=0x0) returned 1
	[0126.099] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26b2624, dwFlags=0x0) returned 1
	[0126.099] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b2668*, pdwDataLen=0x593f2d4*=0x920, dwBufLen=0x920 | out: pbData=0x26b2668*, pdwDataLen=0x593f2d4*=0x920) returned 1
	[0126.099] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b2f94*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26b2f94*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.099] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0126.099] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.099] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.099] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", lpFilePart=0x0) returned 0x29
	[0126.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.099] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.100] GetFileType (hFile=0x5dc) returned 0x1
	[0126.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0126.101] GetFileType (hFile=0x5dc) returned 0x1
	[0126.101] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b309c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x26b309c*, lpNumberOfBytesWritten=0x593f294*=0x920, lpOverlapped=0x0) returned 1
	[0126.102] CloseHandle (hObject=0x5dc) returned 1
	[0126.102] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", lpFilePart=0x0) returned 0x29
	[0126.102] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Google Chrome.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x58
	[0126.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0126.102] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x857dc70f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x920)) returned 1
	[0126.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0126.102] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0126.103] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x2b
	[0126.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.103] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), fInfoLevelId=0x0, lpFileInformation=0x26b4310 | out: lpFileInformation=0x26b4310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7)) returned 1
	[0126.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.103] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x2b
	[0126.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.103] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.103] GetFileType (hFile=0x5dc) returned 0x1
	[0126.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.104] GetFileType (hFile=0x5dc) returned 0x1
	[0126.104] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3e7
	[0126.104] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b490c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26b490c*, lpNumberOfBytesRead=0x593f2cc*=0x3e7, lpOverlapped=0x0) returned 1
	[0126.104] CloseHandle (hObject=0x5dc) returned 1
	[0126.105] CryptDestroyKey (hKey=0x82b540) returned 1
	[0126.105] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.105] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b59a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b540) returned 1
	[0126.105] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.105] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.105] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0126.105] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.105] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26b5a60*=0x1, dwFlags=0x0) returned 1
	[0126.105] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26b5a2c, dwFlags=0x0) returned 1
	[0126.105] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b5a70*, pdwDataLen=0x593f2d4*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x26b5a70*, pdwDataLen=0x593f2d4*=0x3f0) returned 1
	[0126.105] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b5e6c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26b5e6c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.105] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0126.105] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.105] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.105] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x2b
	[0126.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.105] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.107] GetFileType (hFile=0x5dc) returned 0x1
	[0126.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0126.107] GetFileType (hFile=0x5dc) returned 0x1
	[0126.107] WriteFile (in: hFile=0x5dc, lpBuffer=0x26b5f7c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x26b5f7c*, lpNumberOfBytesWritten=0x593f294*=0x3f0, lpOverlapped=0x0) returned 1
	[0126.108] CloseHandle (hObject=0x5dc) returned 1
	[0126.108] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x2b
	[0126.108] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5a
	[0126.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0126.108] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x857dc70f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1
	[0126.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0126.155] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0126.156] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0126.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.156] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26b7200 | out: lpFileInformation=0x26b7200*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116)) returned 1
	[0126.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.213] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0126.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.213] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.213] GetFileType (hFile=0x5dc) returned 0x1
	[0126.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.213] GetFileType (hFile=0x5dc) returned 0x1
	[0126.213] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x116
	[0126.213] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b74f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26b74f4*, lpNumberOfBytesRead=0x593f2cc*=0x116, lpOverlapped=0x0) returned 1
	[0126.214] CloseHandle (hObject=0x5dc) returned 1
	[0126.214] CryptDestroyKey (hKey=0x82b540) returned 1
	[0126.214] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.215] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b8590, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0126.215] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.215] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.215] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b100) returned 1
	[0126.215] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.215] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26b8648*=0x1, dwFlags=0x0) returned 1
	[0126.215] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x26b8614, dwFlags=0x0) returned 1
	[0126.215] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b8658*, pdwDataLen=0x593f2d4*=0x120, dwBufLen=0x120 | out: pbData=0x26b8658*, pdwDataLen=0x593f2d4*=0x120) returned 1
	[0126.215] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b8784*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26b8784*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.215] CryptDestroyKey (hKey=0x82b100) returned 1
	[0126.215] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.215] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.215] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0126.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.215] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0126.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0126.217] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0126.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26b8c70 | out: lpFileInformation=0x26b8c70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae)) returned 1
	[0126.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.218] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0126.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.218] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.218] GetFileType (hFile=0x5dc) returned 0x1
	[0126.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.218] GetFileType (hFile=0x5dc) returned 0x1
	[0126.218] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xae
	[0126.218] ReadFile (in: hFile=0x5dc, lpBuffer=0x26b8efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26b8efc*, lpNumberOfBytesRead=0x593f2cc*=0xae, lpOverlapped=0x0) returned 1
	[0126.219] CloseHandle (hObject=0x5dc) returned 1
	[0126.219] CryptDestroyKey (hKey=0x82b300) returned 1
	[0126.219] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.219] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b9f98, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0126.219] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.219] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.220] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0126.220] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.220] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26ba050*=0x1, dwFlags=0x0) returned 1
	[0126.220] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26ba01c, dwFlags=0x0) returned 1
	[0126.220] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ba060*, pdwDataLen=0x593f2d4*=0xb0, dwBufLen=0xb0 | out: pbData=0x26ba060*, pdwDataLen=0x593f2d4*=0xb0) returned 1
	[0126.220] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ba11c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26ba11c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.220] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0126.220] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.220] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.220] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0126.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.220] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0126.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0126.222] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0126.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.222] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26ba608 | out: lpFileInformation=0x26ba608*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf)) returned 1
	[0126.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.222] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0126.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.222] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.222] GetFileType (hFile=0x5dc) returned 0x1
	[0126.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.222] GetFileType (hFile=0x5dc) returned 0x1
	[0126.222] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xaf
	[0126.223] ReadFile (in: hFile=0x5dc, lpBuffer=0x26ba894, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26ba894*, lpNumberOfBytesRead=0x593f2cc*=0xaf, lpOverlapped=0x0) returned 1
	[0126.224] CloseHandle (hObject=0x5dc) returned 1
	[0126.224] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0126.224] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.224] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bb930, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b440) returned 1
	[0126.224] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.224] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.224] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0126.224] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.224] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26bb9e8*=0x1, dwFlags=0x0) returned 1
	[0126.224] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26bb9b4, dwFlags=0x0) returned 1
	[0126.224] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bb9f8*, pdwDataLen=0x593f2d4*=0xb0, dwBufLen=0xb0 | out: pbData=0x26bb9f8*, pdwDataLen=0x593f2d4*=0xb0) returned 1
	[0126.224] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bbab4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26bbab4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.224] CryptDestroyKey (hKey=0x82b340) returned 1
	[0126.224] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.224] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.224] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\desktop.ini", lpFilePart=0x0) returned 0x25
	[0126.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.224] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0126.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0126.226] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", lpFilePart=0x0) returned 0x2f
	[0126.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.226] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), fInfoLevelId=0x0, lpFileInformation=0x26bbfa0 | out: lpFileInformation=0x26bbfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0)) returned 1
	[0126.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.227] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", lpFilePart=0x0) returned 0x2f
	[0126.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.227] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.227] GetFileType (hFile=0x5dc) returned 0x1
	[0126.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.227] GetFileType (hFile=0x5dc) returned 0x1
	[0126.227] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3c0
	[0126.227] ReadFile (in: hFile=0x5dc, lpBuffer=0x26bc58c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26bc58c*, lpNumberOfBytesRead=0x593f2cc*=0x3c0, lpOverlapped=0x0) returned 1
	[0126.297] CloseHandle (hObject=0x5dc) returned 1
	[0126.297] CryptDestroyKey (hKey=0x82b440) returned 1
	[0126.297] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.297] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bd628, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b2c0) returned 1
	[0126.297] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.297] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.298] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0126.298] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.298] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26bd6e0*=0x1, dwFlags=0x0) returned 1
	[0126.298] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26bd6ac, dwFlags=0x0) returned 1
	[0126.298] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bd6f0*, pdwDataLen=0x593f2d4*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26bd6f0*, pdwDataLen=0x593f2d4*=0x3d0) returned 1
	[0126.298] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bdacc*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26bdacc*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.298] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0126.298] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.298] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.298] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", lpFilePart=0x0) returned 0x2f
	[0126.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.298] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.299] GetFileType (hFile=0x5dc) returned 0x1
	[0126.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0126.299] GetFileType (hFile=0x5dc) returned 0x1
	[0126.299] WriteFile (in: hFile=0x5dc, lpBuffer=0x26bdbe8*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x26bdbe8*, lpNumberOfBytesWritten=0x593f294*=0x3d0, lpOverlapped=0x0) returned 1
	[0126.300] CloseHandle (hObject=0x5dc) returned 1
	[0126.301] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", lpFilePart=0x0) returned 0x2f
	[0126.301] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0126.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0126.301] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x859cc5a1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1
	[0126.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0126.301] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0126.302] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\desktop.ini", lpFilePart=0x0) returned 0x21
	[0126.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.302] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26bee8c | out: lpFileInformation=0x26bee8c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c)) returned 1
	[0126.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.303] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\desktop.ini", lpFilePart=0x0) returned 0x21
	[0126.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.303] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.303] GetFileType (hFile=0x5dc) returned 0x1
	[0126.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.303] GetFileType (hFile=0x5dc) returned 0x1
	[0126.303] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x17c
	[0126.304] ReadFile (in: hFile=0x5dc, lpBuffer=0x26bf1d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26bf1d4*, lpNumberOfBytesRead=0x593f2cc*=0x17c, lpOverlapped=0x0) returned 1
	[0126.304] CloseHandle (hObject=0x5dc) returned 1
	[0126.305] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0126.305] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.305] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c0270, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82afc0) returned 1
	[0126.305] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.305] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.305] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0126.305] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.305] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26c0328*=0x1, dwFlags=0x0) returned 1
	[0126.305] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26c02f4, dwFlags=0x0) returned 1
	[0126.305] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0338*, pdwDataLen=0x593f2d4*=0x180, dwBufLen=0x180 | out: pbData=0x26c0338*, pdwDataLen=0x593f2d4*=0x180) returned 1
	[0126.305] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c04c4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26c04c4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.305] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0126.305] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.305] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.305] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\desktop.ini", lpFilePart=0x0) returned 0x21
	[0126.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.305] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0126.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0126.307] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0126.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.307] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26c0990 | out: lpFileInformation=0x26c0990*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c)) returned 1
	[0126.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.308] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0126.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.308] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.308] GetFileType (hFile=0x5dc) returned 0x1
	[0126.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.308] GetFileType (hFile=0x5dc) returned 0x1
	[0126.308] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x17c
	[0126.308] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c0ce8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26c0ce8*, lpNumberOfBytesRead=0x593f2cc*=0x17c, lpOverlapped=0x0) returned 1
	[0126.309] CloseHandle (hObject=0x5dc) returned 1
	[0126.309] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0126.309] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.310] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c1d84, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0126.310] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.310] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.310] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0126.310] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.310] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26c1e3c*=0x1, dwFlags=0x0) returned 1
	[0126.310] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26c1e08, dwFlags=0x0) returned 1
	[0126.310] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c1e4c*, pdwDataLen=0x593f2d4*=0x180, dwBufLen=0x180 | out: pbData=0x26c1e4c*, pdwDataLen=0x593f2d4*=0x180) returned 1
	[0126.310] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c1fd8*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26c1fd8*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.310] CryptDestroyKey (hKey=0x82b280) returned 1
	[0126.310] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.310] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.310] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x24
	[0126.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.310] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0126.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0126.312] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\desktop.ini", lpFilePart=0x0) returned 0x22
	[0126.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.313] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26c24c0 | out: lpFileInformation=0x26c24c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c)) returned 1
	[0126.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.313] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\desktop.ini", lpFilePart=0x0) returned 0x22
	[0126.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.313] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.313] GetFileType (hFile=0x5dc) returned 0x1
	[0126.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.313] GetFileType (hFile=0x5dc) returned 0x1
	[0126.313] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x17c
	[0126.313] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c2810, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26c2810*, lpNumberOfBytesRead=0x593f2cc*=0x17c, lpOverlapped=0x0) returned 1
	[0126.314] CloseHandle (hObject=0x5dc) returned 1
	[0126.315] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0126.315] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.315] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c38ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b480) returned 1
	[0126.315] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.315] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.315] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0126.315] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.315] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26c3964*=0x1, dwFlags=0x0) returned 1
	[0126.315] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26c3930, dwFlags=0x0) returned 1
	[0126.315] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c3974*, pdwDataLen=0x593f2d4*=0x180, dwBufLen=0x180 | out: pbData=0x26c3974*, pdwDataLen=0x593f2d4*=0x180) returned 1
	[0126.315] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c3b00*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26c3b00*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.315] CryptDestroyKey (hKey=0x82b540) returned 1
	[0126.315] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.315] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.315] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\desktop.ini", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\desktop.ini", lpFilePart=0x0) returned 0x22
	[0126.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.315] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0126.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0126.317] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1", lpFilePart=0x0) returned 0x38
	[0126.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.317] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\programdata\\microsoft\\appv\\setup\\officeintegrator.ps1"), fInfoLevelId=0x0, lpFileInformation=0x26c3fd8 | out: lpFileInformation=0x26c3fd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368)) returned 1
	[0126.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.359] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1", lpFilePart=0x0) returned 0x38
	[0126.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.359] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\programdata\\microsoft\\appv\\setup\\officeintegrator.ps1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.360] GetFileType (hFile=0x5dc) returned 0x1
	[0126.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.360] GetFileType (hFile=0x5dc) returned 0x1
	[0126.360] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1368
	[0126.360] ReadFile (in: hFile=0x5dc, lpBuffer=0x26c4220, nNumberOfBytesToRead=0x1368, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26c4220*, lpNumberOfBytesRead=0x593f2cc*=0x1368, lpOverlapped=0x0) returned 1
	[0126.420] CloseHandle (hObject=0x5dc) returned 1
	[0126.420] CryptDestroyKey (hKey=0x82b480) returned 1
	[0126.420] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.420] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c93d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0126.420] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.420] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.423] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b440) returned 1
	[0126.423] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.423] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26c9490*=0x1, dwFlags=0x0) returned 1
	[0126.423] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26c945c, dwFlags=0x0) returned 1
	[0126.423] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c94a0*, pdwDataLen=0x593f2d4*=0x1370, dwBufLen=0x1370 | out: pbData=0x26c94a0*, pdwDataLen=0x593f2d4*=0x1370) returned 1
	[0126.423] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ca81c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26ca81c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.423] CryptDestroyKey (hKey=0x82b440) returned 1
	[0126.423] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.423] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1", lpFilePart=0x0) returned 0x38
	[0126.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.423] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\programdata\\microsoft\\appv\\setup\\officeintegrator.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0126.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593dbf0) returned 1
	[0126.425] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", lpFilePart=0x0) returned 0x5b
	[0126.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.425] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), fInfoLevelId=0x0, lpFileInformation=0x26cadb8 | out: lpFileInformation=0x26cadb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x247ecc35, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e23)) returned 1
	[0126.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.426] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", lpFilePart=0x0) returned 0x5b
	[0126.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.426] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.426] GetFileType (hFile=0x5dc) returned 0x1
	[0126.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.426] GetFileType (hFile=0x5dc) returned 0x1
	[0126.426] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x44e23
	[0126.427] ReadFile (in: hFile=0x5dc, lpBuffer=0x7a35be8, nNumberOfBytesToRead=0x44e23, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x7a35be8*, lpNumberOfBytesRead=0x593f2cc*=0x44e23, lpOverlapped=0x0) returned 1
	[0126.653] CloseHandle (hObject=0x5dc) returned 1
	[0126.653] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0126.653] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.653] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26cd550, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0126.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.653] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b200) returned 1
	[0126.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.653] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26cd608*=0x1, dwFlags=0x0) returned 1
	[0126.653] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26cd5d4, dwFlags=0x0) returned 1
	[0126.656] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7a7aa28*, pdwDataLen=0x593f2d4*=0x44e30, dwBufLen=0x44e30 | out: pbData=0x7a7aa28*, pdwDataLen=0x593f2d4*=0x44e30) returned 1
	[0126.657] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26cd618*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26cd618*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.657] CryptDestroyKey (hKey=0x82b200) returned 1
	[0126.657] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.657] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.657] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", lpFilePart=0x0) returned 0x5b
	[0126.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.657] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.660] GetFileType (hFile=0x5dc) returned 0x1
	[0126.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0126.661] GetFileType (hFile=0x5dc) returned 0x1
	[0126.661] WriteFile (in: hFile=0x5dc, lpBuffer=0x7a7aa28*, nNumberOfBytesToWrite=0x44e30, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x7a7aa28*, lpNumberOfBytesWritten=0x593f2c0*=0x44e30, lpOverlapped=0x0) returned 1
	[0126.665] CloseHandle (hObject=0x5dc) returned 1
	[0126.665] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", lpFilePart=0x0) returned 0x5b
	[0126.665] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8a
	[0126.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0126.665] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x85d3dfc9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x44e30)) returned 1
	[0126.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0126.665] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0126.666] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0126.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.666] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x26cdb7c | out: lpFileInformation=0x26cdb7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0)) returned 1
	[0126.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0126.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.667] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.667] GetFileType (hFile=0x5dc) returned 0x1
	[0126.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.668] GetFileType (hFile=0x5dc) returned 0x1
	[0126.668] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x91f0
	[0126.668] ReadFile (in: hFile=0x5dc, lpBuffer=0x26cdf4c, nNumberOfBytesToRead=0x91f0, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26cdf4c*, lpNumberOfBytesRead=0x593f2cc*=0x91f0, lpOverlapped=0x0) returned 1
	[0126.864] CloseHandle (hObject=0x5dc) returned 1
	[0126.865] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0126.865] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.865] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d71d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0126.865] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.865] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.865] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82afc0) returned 1
	[0126.865] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0126.865] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26d7290*=0x1, dwFlags=0x0) returned 1
	[0126.865] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26d725c, dwFlags=0x0) returned 1
	[0126.865] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d72a0*, pdwDataLen=0x593f2d4*=0x9200, dwBufLen=0x9200 | out: pbData=0x26d72a0*, pdwDataLen=0x593f2d4*=0x9200) returned 1
	[0126.865] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e04ac*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26e04ac*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0126.865] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0126.865] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.865] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0126.865] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0126.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0126.865] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.866] GetFileType (hFile=0x5dc) returned 0x1
	[0126.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0126.866] GetFileType (hFile=0x5dc) returned 0x1
	[0126.867] WriteFile (in: hFile=0x5dc, lpBuffer=0x26d72a0*, nNumberOfBytesToWrite=0x9200, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26d72a0*, lpNumberOfBytesWritten=0x593f2c0*=0x9200, lpOverlapped=0x0) returned 1
	[0126.868] CloseHandle (hObject=0x5dc) returned 1
	[0126.868] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0126.868] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xac
	[0126.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0126.868] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85f2dd86, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9200)) returned 1
	[0126.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0126.868] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0126.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71
	[0126.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0126.869] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x26e0ba8 | out: lpFileInformation=0x26e0ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c)) returned 1
	[0126.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0126.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71
	[0126.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0126.869] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0126.870] GetFileType (hFile=0x5dc) returned 0x1
	[0126.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0126.870] GetFileType (hFile=0x5dc) returned 0x1
	[0126.870] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0xe71c
	[0126.870] ReadFile (in: hFile=0x5dc, lpBuffer=0x26e0f18, nNumberOfBytesToRead=0xe71c, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26e0f18*, lpNumberOfBytesRead=0x593f2cc*=0xe71c, lpOverlapped=0x0) returned 1
	[0127.033] CloseHandle (hObject=0x5dc) returned 1
	[0127.033] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0127.033] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.033] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ef6d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0127.033] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.033] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.033] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b200) returned 1
	[0127.033] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.033] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26ef788*=0x1, dwFlags=0x0) returned 1
	[0127.033] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26ef754, dwFlags=0x0) returned 1
	[0127.033] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ef798*, pdwDataLen=0x593f2d4*=0xe720, dwBufLen=0xe720 | out: pbData=0x26ef798*, pdwDataLen=0x593f2d4*=0xe720) returned 1
	[0127.034] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fdec4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x26fdec4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.034] CryptDestroyKey (hKey=0x82b200) returned 1
	[0127.034] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.034] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.034] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71
	[0127.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.034] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.035] GetFileType (hFile=0x5dc) returned 0x1
	[0127.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.036] GetFileType (hFile=0x5dc) returned 0x1
	[0127.036] WriteFile (in: hFile=0x5dc, lpBuffer=0x26ef798*, nNumberOfBytesToWrite=0xe720, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x26ef798*, lpNumberOfBytesWritten=0x593f2c0*=0xe720, lpOverlapped=0x0) returned 1
	[0127.038] CloseHandle (hObject=0x5dc) returned 1
	[0127.038] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71
	[0127.038] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa0
	[0127.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.038] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x860d182d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xe720)) returned 1
	[0127.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.038] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0127.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.039] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x26fe530 | out: lpFileInformation=0x26fe530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa)) returned 1
	[0127.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0127.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.084] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.084] GetFileType (hFile=0x5dc) returned 0x1
	[0127.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.084] GetFileType (hFile=0x5dc) returned 0x1
	[0127.084] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x7fa
	[0127.084] ReadFile (in: hFile=0x5dc, lpBuffer=0x26ff0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x26ff0c0*, lpNumberOfBytesRead=0x593f2cc*=0x7fa, lpOverlapped=0x0) returned 1
	[0127.143] CloseHandle (hObject=0x5dc) returned 1
	[0127.143] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0127.143] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.143] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270015c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b2c0) returned 1
	[0127.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.143] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0127.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.143] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2700214*=0x1, dwFlags=0x0) returned 1
	[0127.144] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27001e0, dwFlags=0x0) returned 1
	[0127.144] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2700224*, pdwDataLen=0x593f2d4*=0x800, dwBufLen=0x800 | out: pbData=0x2700224*, pdwDataLen=0x593f2d4*=0x800) returned 1
	[0127.144] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2700a30*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2700a30*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.144] CryptDestroyKey (hKey=0x82b540) returned 1
	[0127.144] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.144] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0127.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.144] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.145] GetFileType (hFile=0x5dc) returned 0x1
	[0127.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.146] GetFileType (hFile=0x5dc) returned 0x1
	[0127.146] WriteFile (in: hFile=0x5dc, lpBuffer=0x2700c00*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2700c00*, lpNumberOfBytesWritten=0x593f294*=0x800, lpOverlapped=0x0) returned 1
	[0127.146] CloseHandle (hObject=0x5dc) returned 1
	[0127.147] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0127.147] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa3
	[0127.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.147] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x861dcaea, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x800)) returned 1
	[0127.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.147] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77
	[0127.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.148] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x27020c8 | out: lpFileInformation=0x27020c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14)) returned 1
	[0127.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77
	[0127.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.148] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.148] GetFileType (hFile=0x5dc) returned 0x1
	[0127.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.148] GetFileType (hFile=0x5dc) returned 0x1
	[0127.149] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x3f14
	[0127.149] ReadFile (in: hFile=0x5dc, lpBuffer=0x2702468, nNumberOfBytesToRead=0x3f14, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2702468*, lpNumberOfBytesRead=0x593f2cc*=0x3f14, lpOverlapped=0x0) returned 1
	[0127.287] CloseHandle (hObject=0x5dc) returned 1
	[0127.287] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0127.287] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.287] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2706418, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b100) returned 1
	[0127.287] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.287] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.287] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b2c0) returned 1
	[0127.287] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.287] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x27064d0*=0x1, dwFlags=0x0) returned 1
	[0127.287] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x270649c, dwFlags=0x0) returned 1
	[0127.288] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27064e0*, pdwDataLen=0x593f2d4*=0x3f20, dwBufLen=0x3f20 | out: pbData=0x27064e0*, pdwDataLen=0x593f2d4*=0x3f20) returned 1
	[0127.288] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270a40c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x270a40c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.288] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0127.288] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.288] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.288] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77
	[0127.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.288] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.289] GetFileType (hFile=0x5dc) returned 0x1
	[0127.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.290] GetFileType (hFile=0x5dc) returned 0x1
	[0127.290] WriteFile (in: hFile=0x5dc, lpBuffer=0x27064e0*, nNumberOfBytesToWrite=0x3f20, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27064e0*, lpNumberOfBytesWritten=0x593f2c0*=0x3f20, lpOverlapped=0x0) returned 1
	[0127.291] CloseHandle (hObject=0x5dc) returned 1
	[0127.291] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77
	[0127.291] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa6
	[0127.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.291] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86333f91, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3f20)) returned 1
	[0127.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.292] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6e
	[0127.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.293] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x270aac0 | out: lpFileInformation=0x270aac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a)) returned 1
	[0127.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6e
	[0127.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.294] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.294] GetFileType (hFile=0x5dc) returned 0x1
	[0127.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.294] GetFileType (hFile=0x5dc) returned 0x1
	[0127.294] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x265a
	[0127.294] ReadFile (in: hFile=0x5dc, lpBuffer=0x270ae18, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x270ae18*, lpNumberOfBytesRead=0x593f2cc*=0x265a, lpOverlapped=0x0) returned 1
	[0127.360] CloseHandle (hObject=0x5dc) returned 1
	[0127.360] CryptDestroyKey (hKey=0x82b100) returned 1
	[0127.360] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.360] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270d510, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0127.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.361] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b480) returned 1
	[0127.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.361] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x270d5c8*=0x1, dwFlags=0x0) returned 1
	[0127.361] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x270d594, dwFlags=0x0) returned 1
	[0127.361] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270d5d8*, pdwDataLen=0x593f2d4*=0x2660, dwBufLen=0x2660 | out: pbData=0x270d5d8*, pdwDataLen=0x593f2d4*=0x2660) returned 1
	[0127.361] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270fc44*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x270fc44*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.361] CryptDestroyKey (hKey=0x82b480) returned 1
	[0127.361] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.361] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.361] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6e
	[0127.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.361] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.362] GetFileType (hFile=0x5dc) returned 0x1
	[0127.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.362] GetFileType (hFile=0x5dc) returned 0x1
	[0127.362] WriteFile (in: hFile=0x5dc, lpBuffer=0x270d5d8*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x270d5d8*, lpNumberOfBytesWritten=0x593f2c0*=0x2660, lpOverlapped=0x0) returned 1
	[0127.363] CloseHandle (hObject=0x5dc) returned 1
	[0127.364] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6e
	[0127.364] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9d
	[0127.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.364] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x863f296e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2660)) returned 1
	[0127.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.364] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0127.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.365] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2710288 | out: lpFileInformation=0x2710288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c)) returned 1
	[0127.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.367] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0127.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.367] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.367] GetFileType (hFile=0x5dc) returned 0x1
	[0127.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.367] GetFileType (hFile=0x5dc) returned 0x1
	[0127.367] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x39d9c
	[0127.368] ReadFile (in: hFile=0x5dc, lpBuffer=0x7abf878, nNumberOfBytesToRead=0x39d9c, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x7abf878*, lpNumberOfBytesRead=0x593f2cc*=0x39d9c, lpOverlapped=0x0) returned 1
	[0127.446] CloseHandle (hObject=0x5dc) returned 1
	[0127.446] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0127.446] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.446] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27106d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b4c0) returned 1
	[0127.446] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.447] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.447] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0127.447] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.447] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2710790*=0x1, dwFlags=0x0) returned 1
	[0127.447] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x271075c, dwFlags=0x0) returned 1
	[0127.450] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7af9630*, pdwDataLen=0x593f2d4*=0x39da0, dwBufLen=0x39da0 | out: pbData=0x7af9630*, pdwDataLen=0x593f2d4*=0x39da0) returned 1
	[0127.450] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27107a0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27107a0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.450] CryptDestroyKey (hKey=0x82b540) returned 1
	[0127.450] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.450] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.450] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0127.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.451] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.453] GetFileType (hFile=0x5dc) returned 0x1
	[0127.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.453] GetFileType (hFile=0x5dc) returned 0x1
	[0127.453] WriteFile (in: hFile=0x5dc, lpBuffer=0x7af9630*, nNumberOfBytesToWrite=0x39da0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x7af9630*, lpNumberOfBytesWritten=0x593f2c0*=0x39da0, lpOverlapped=0x0) returned 1
	[0127.458] CloseHandle (hObject=0x5dc) returned 1
	[0127.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0127.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xaa
	[0127.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.458] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x864d7808, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x39da0)) returned 1
	[0127.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.459] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.460] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0127.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.460] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2710e84 | out: lpFileInformation=0x2710e84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70)) returned 1
	[0127.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.478] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0127.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.478] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.479] GetFileType (hFile=0x5dc) returned 0x1
	[0127.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.479] GetFileType (hFile=0x5dc) returned 0x1
	[0127.479] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x8f70
	[0127.479] ReadFile (in: hFile=0x5dc, lpBuffer=0x27111ec, nNumberOfBytesToRead=0x8f70, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27111ec*, lpNumberOfBytesRead=0x593f2cc*=0x8f70, lpOverlapped=0x0) returned 1
	[0127.572] CloseHandle (hObject=0x5dc) returned 1
	[0127.572] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0127.572] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.572] CryptImportKey (in: hProv=0x7f93c0, pbData=0x271a1f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b100) returned 1
	[0127.573] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.573] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.573] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b480) returned 1
	[0127.573] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.573] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x271a2b0*=0x1, dwFlags=0x0) returned 1
	[0127.573] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x271a27c, dwFlags=0x0) returned 1
	[0127.573] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x271a2c0*, pdwDataLen=0x593f2d4*=0x8f80, dwBufLen=0x8f80 | out: pbData=0x271a2c0*, pdwDataLen=0x593f2d4*=0x8f80) returned 1
	[0127.573] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272324c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x272324c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.573] CryptDestroyKey (hKey=0x82b480) returned 1
	[0127.573] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.573] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.573] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0127.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.574] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.575] GetFileType (hFile=0x5dc) returned 0x1
	[0127.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.575] GetFileType (hFile=0x5dc) returned 0x1
	[0127.576] WriteFile (in: hFile=0x5dc, lpBuffer=0x271a2c0*, nNumberOfBytesToWrite=0x8f80, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x271a2c0*, lpNumberOfBytesWritten=0x593f2c0*=0x8f80, lpOverlapped=0x0) returned 1
	[0127.577] CloseHandle (hObject=0x5dc) returned 1
	[0127.577] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0127.577] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9f
	[0127.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.578] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x865e28ab, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8f80)) returned 1
	[0127.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.578] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.583] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0127.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.583] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x27238a8 | out: lpFileInformation=0x27238a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e)) returned 1
	[0127.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.584] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0127.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.584] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.585] GetFileType (hFile=0x5dc) returned 0x1
	[0127.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.585] GetFileType (hFile=0x5dc) returned 0x1
	[0127.585] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x8f8e
	[0127.585] ReadFile (in: hFile=0x5dc, lpBuffer=0x2723c78, nNumberOfBytesToRead=0x8f8e, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2723c78*, lpNumberOfBytesRead=0x593f2cc*=0x8f8e, lpOverlapped=0x0) returned 1
	[0127.620] CloseHandle (hObject=0x5dc) returned 1
	[0127.620] CryptDestroyKey (hKey=0x82b100) returned 1
	[0127.620] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.621] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272cca4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0127.621] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.621] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.621] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0127.621] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.621] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x272cd5c*=0x1, dwFlags=0x0) returned 1
	[0127.621] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x272cd28, dwFlags=0x0) returned 1
	[0127.621] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272cd6c*, pdwDataLen=0x593f2d4*=0x8f90, dwBufLen=0x8f90 | out: pbData=0x272cd6c*, pdwDataLen=0x593f2d4*=0x8f90) returned 1
	[0127.621] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2735d08*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2735d08*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.621] CryptDestroyKey (hKey=0x82b280) returned 1
	[0127.621] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.621] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.621] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0127.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.622] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.623] GetFileType (hFile=0x5dc) returned 0x1
	[0127.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.623] GetFileType (hFile=0x5dc) returned 0x1
	[0127.623] WriteFile (in: hFile=0x5dc, lpBuffer=0x272cd6c*, nNumberOfBytesToWrite=0x8f90, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x272cd6c*, lpNumberOfBytesWritten=0x593f2c0*=0x8f90, lpOverlapped=0x0) returned 1
	[0127.625] CloseHandle (hObject=0x5dc) returned 1
	[0127.633] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0127.633] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xac
	[0127.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.633] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x866550e1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x8f90)) returned 1
	[0127.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.633] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.634] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71
	[0127.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.634] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2736404 | out: lpFileInformation=0x2736404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e)) returned 1
	[0127.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.636] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71
	[0127.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.636] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.636] GetFileType (hFile=0x5dc) returned 0x1
	[0127.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.636] GetFileType (hFile=0x5dc) returned 0x1
	[0127.636] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x180e
	[0127.636] ReadFile (in: hFile=0x5dc, lpBuffer=0x2736774, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2736774*, lpNumberOfBytesRead=0x593f2cc*=0x180e, lpOverlapped=0x0) returned 1
	[0127.718] CloseHandle (hObject=0x5dc) returned 1
	[0127.718] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0127.718] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.718] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2738020, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b1c0) returned 1
	[0127.718] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.718] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.719] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b0c0) returned 1
	[0127.719] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.719] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27380d8*=0x1, dwFlags=0x0) returned 1
	[0127.719] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x27380a4, dwFlags=0x0) returned 1
	[0127.719] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27380e8*, pdwDataLen=0x593f2d4*=0x1810, dwBufLen=0x1810 | out: pbData=0x27380e8*, pdwDataLen=0x593f2d4*=0x1810) returned 1
	[0127.719] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2739904*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2739904*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.719] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0127.719] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.719] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71
	[0127.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.719] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.745] GetFileType (hFile=0x5dc) returned 0x1
	[0127.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.745] GetFileType (hFile=0x5dc) returned 0x1
	[0127.745] WriteFile (in: hFile=0x5dc, lpBuffer=0x27380e8*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27380e8*, lpNumberOfBytesWritten=0x593f2c0*=0x1810, lpOverlapped=0x0) returned 1
	[0127.746] CloseHandle (hObject=0x5dc) returned 1
	[0127.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71
	[0127.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa0
	[0127.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.747] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8678624d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1810)) returned 1
	[0127.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.748] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x79
	[0127.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.749] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2739f70 | out: lpFileInformation=0x2739f70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c)) returned 1
	[0127.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.749] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x79
	[0127.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.749] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.749] GetFileType (hFile=0x5dc) returned 0x1
	[0127.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.750] GetFileType (hFile=0x5dc) returned 0x1
	[0127.750] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x1979c
	[0127.750] ReadFile (in: hFile=0x5dc, lpBuffer=0x7b333f0, nNumberOfBytesToRead=0x1979c, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x7b333f0*, lpNumberOfBytesRead=0x593f2cc*=0x1979c, lpOverlapped=0x0) returned 1
	[0127.797] CloseHandle (hObject=0x5dc) returned 1
	[0127.801] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0127.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.801] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273a3b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b100) returned 1
	[0127.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.801] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b480) returned 1
	[0127.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.801] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x273a468*=0x1, dwFlags=0x0) returned 1
	[0127.801] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x273a434, dwFlags=0x0) returned 1
	[0127.803] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7b4cba8*, pdwDataLen=0x593f2d4*=0x197a0, dwBufLen=0x197a0 | out: pbData=0x7b4cba8*, pdwDataLen=0x593f2d4*=0x197a0) returned 1
	[0127.803] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273a478*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x273a478*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.803] CryptDestroyKey (hKey=0x82b480) returned 1
	[0127.803] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.803] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x79
	[0127.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.804] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.806] GetFileType (hFile=0x5dc) returned 0x1
	[0127.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.806] GetFileType (hFile=0x5dc) returned 0x1
	[0127.806] WriteFile (in: hFile=0x5dc, lpBuffer=0x7b4cba8*, nNumberOfBytesToWrite=0x197a0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x7b4cba8*, lpNumberOfBytesWritten=0x593f2c0*=0x197a0, lpOverlapped=0x0) returned 1
	[0127.808] CloseHandle (hObject=0x5dc) returned 1
	[0127.809] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x79
	[0127.809] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa8
	[0127.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.809] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8681ebcb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x197a0)) returned 1
	[0127.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.809] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.810] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6f
	[0127.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.810] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x273ab44 | out: lpFileInformation=0x273ab44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94)) returned 1
	[0127.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.811] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6f
	[0127.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.811] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.811] GetFileType (hFile=0x5dc) returned 0x1
	[0127.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.811] GetFileType (hFile=0x5dc) returned 0x1
	[0127.812] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x5b94
	[0127.812] ReadFile (in: hFile=0x5dc, lpBuffer=0x273aea4, nNumberOfBytesToRead=0x5b94, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x273aea4*, lpNumberOfBytesRead=0x593f2cc*=0x5b94, lpOverlapped=0x0) returned 1
	[0127.830] CloseHandle (hObject=0x5dc) returned 1
	[0127.830] CryptDestroyKey (hKey=0x82b100) returned 1
	[0127.830] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.830] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2740ad4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0127.831] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.831] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.831] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b380) returned 1
	[0127.831] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.831] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2740b8c*=0x1, dwFlags=0x0) returned 1
	[0127.831] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2740b58, dwFlags=0x0) returned 1
	[0127.831] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2740b9c*, pdwDataLen=0x593f2d4*=0x5ba0, dwBufLen=0x5ba0 | out: pbData=0x2740b9c*, pdwDataLen=0x593f2d4*=0x5ba0) returned 1
	[0127.831] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2746748*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2746748*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.831] CryptDestroyKey (hKey=0x82b380) returned 1
	[0127.831] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.831] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.831] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6f
	[0127.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.832] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.833] GetFileType (hFile=0x5dc) returned 0x1
	[0127.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.834] GetFileType (hFile=0x5dc) returned 0x1
	[0127.834] WriteFile (in: hFile=0x5dc, lpBuffer=0x2740b9c*, nNumberOfBytesToWrite=0x5ba0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x2740b9c*, lpNumberOfBytesWritten=0x593f2c0*=0x5ba0, lpOverlapped=0x0) returned 1
	[0127.835] CloseHandle (hObject=0x5dc) returned 1
	[0127.835] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6f
	[0127.835] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9e
	[0127.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.836] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8686b031, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5ba0)) returned 1
	[0127.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.836] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.837] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73
	[0127.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.837] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2746d9c | out: lpFileInformation=0x2746d9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a)) returned 1
	[0127.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.839] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73
	[0127.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.839] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.839] GetFileType (hFile=0x5dc) returned 0x1
	[0127.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.839] GetFileType (hFile=0x5dc) returned 0x1
	[0127.839] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x6b4a
	[0127.839] ReadFile (in: hFile=0x5dc, lpBuffer=0x274711c, nNumberOfBytesToRead=0x6b4a, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x274711c*, lpNumberOfBytesRead=0x593f2cc*=0x6b4a, lpOverlapped=0x0) returned 1
	[0127.871] CloseHandle (hObject=0x5dc) returned 1
	[0127.871] CryptDestroyKey (hKey=0x82b300) returned 1
	[0127.871] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.871] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274dd04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b380) returned 1
	[0127.871] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.871] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.871] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0127.871] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.872] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x274ddbc*=0x1, dwFlags=0x0) returned 1
	[0127.872] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x274dd88, dwFlags=0x0) returned 1
	[0127.872] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274ddcc*, pdwDataLen=0x593f2d4*=0x6b50, dwBufLen=0x6b50 | out: pbData=0x274ddcc*, pdwDataLen=0x593f2d4*=0x6b50) returned 1
	[0127.872] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2754928*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2754928*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.872] CryptDestroyKey (hKey=0x82b280) returned 1
	[0127.872] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.872] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73
	[0127.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.872] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.874] GetFileType (hFile=0x5dc) returned 0x1
	[0127.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.874] GetFileType (hFile=0x5dc) returned 0x1
	[0127.874] WriteFile (in: hFile=0x5dc, lpBuffer=0x274ddcc*, nNumberOfBytesToWrite=0x6b50, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x274ddcc*, lpNumberOfBytesWritten=0x593f2c0*=0x6b50, lpOverlapped=0x0) returned 1
	[0127.876] CloseHandle (hObject=0x5dc) returned 1
	[0127.876] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73
	[0127.876] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa2
	[0127.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.876] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868dd7a1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x6b50)) returned 1
	[0127.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.877] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", lpFilePart=0x0) returned 0x73
	[0127.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.878] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2754fac | out: lpFileInformation=0x2754fac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4)) returned 1
	[0127.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.879] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", lpFilePart=0x0) returned 0x73
	[0127.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.879] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.879] GetFileType (hFile=0x5dc) returned 0x1
	[0127.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.879] GetFileType (hFile=0x5dc) returned 0x1
	[0127.879] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4f3f4
	[0127.880] ReadFile (in: hFile=0x5dc, lpBuffer=0x7b66368, nNumberOfBytesToRead=0x4f3f4, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x7b66368*, lpNumberOfBytesRead=0x593f2cc*=0x4f3f4, lpOverlapped=0x0) returned 1
	[0127.895] CloseHandle (hObject=0x5dc) returned 1
	[0127.895] CryptDestroyKey (hKey=0x82b380) returned 1
	[0127.896] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.896] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27553bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b340) returned 1
	[0127.896] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.896] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.896] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0127.896] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.896] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2755474*=0x1, dwFlags=0x0) returned 1
	[0127.896] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2755440, dwFlags=0x0) returned 1
	[0127.901] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7bb5778*, pdwDataLen=0x593f2d4*=0x4f400, dwBufLen=0x4f400 | out: pbData=0x7bb5778*, pdwDataLen=0x593f2d4*=0x4f400) returned 1
	[0127.901] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2755484*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2755484*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.901] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0127.901] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.902] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.902] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", lpFilePart=0x0) returned 0x73
	[0127.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.902] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.906] GetFileType (hFile=0x5dc) returned 0x1
	[0127.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.906] GetFileType (hFile=0x5dc) returned 0x1
	[0127.906] WriteFile (in: hFile=0x5dc, lpBuffer=0x7bb5778*, nNumberOfBytesToWrite=0x4f400, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x7bb5778*, lpNumberOfBytesWritten=0x593f2c0*=0x4f400, lpOverlapped=0x0) returned 1
	[0127.913] CloseHandle (hObject=0x5dc) returned 1
	[0127.913] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", lpFilePart=0x0) returned 0x73
	[0127.913] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa2
	[0127.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.913] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86929c47, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4f400)) returned 1
	[0127.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.913] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71
	[0127.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.914] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2755b08 | out: lpFileInformation=0x2755b08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870)) returned 1
	[0127.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71
	[0127.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.916] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.916] GetFileType (hFile=0x5dc) returned 0x1
	[0127.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.916] GetFileType (hFile=0x5dc) returned 0x1
	[0127.916] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x19870
	[0127.917] ReadFile (in: hFile=0x5dc, lpBuffer=0x7c04b98, nNumberOfBytesToRead=0x19870, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x7c04b98*, lpNumberOfBytesRead=0x593f2cc*=0x19870, lpOverlapped=0x0) returned 1
	[0127.934] CloseHandle (hObject=0x5dc) returned 1
	[0127.935] CryptDestroyKey (hKey=0x82b340) returned 1
	[0127.935] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.935] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2755f08, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b400) returned 1
	[0127.935] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.935] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.935] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0127.935] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.935] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2755fc0*=0x1, dwFlags=0x0) returned 1
	[0127.935] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2755f8c, dwFlags=0x0) returned 1
	[0127.937] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1e428*, pdwDataLen=0x593f2d4*=0x19880, dwBufLen=0x19880 | out: pbData=0x7c1e428*, pdwDataLen=0x593f2d4*=0x19880) returned 1
	[0127.937] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2755fd0*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2755fd0*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.937] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0127.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.937] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.937] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71
	[0127.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.938] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.940] GetFileType (hFile=0x5dc) returned 0x1
	[0127.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.941] GetFileType (hFile=0x5dc) returned 0x1
	[0127.941] WriteFile (in: hFile=0x5dc, lpBuffer=0x7c1e428*, nNumberOfBytesToWrite=0x19880, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x7c1e428*, lpNumberOfBytesWritten=0x593f2c0*=0x19880, lpOverlapped=0x0) returned 1
	[0127.943] CloseHandle (hObject=0x5dc) returned 1
	[0127.944] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71
	[0127.944] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa0
	[0127.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.944] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x869760c3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x19880)) returned 1
	[0127.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.944] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.945] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0127.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.946] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x275663c | out: lpFileInformation=0x275663c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa)) returned 1
	[0127.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.947] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0127.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.947] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.947] GetFileType (hFile=0x5dc) returned 0x1
	[0127.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.947] GetFileType (hFile=0x5dc) returned 0x1
	[0127.947] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x7fa
	[0127.948] ReadFile (in: hFile=0x5dc, lpBuffer=0x27571cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27571cc*, lpNumberOfBytesRead=0x593f2cc*=0x7fa, lpOverlapped=0x0) returned 1
	[0127.962] CloseHandle (hObject=0x5dc) returned 1
	[0127.962] CryptDestroyKey (hKey=0x82b400) returned 1
	[0127.962] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.962] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2758268, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0127.962] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.962] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.962] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b1c0) returned 1
	[0127.962] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.962] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2758320*=0x1, dwFlags=0x0) returned 1
	[0127.963] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27582ec, dwFlags=0x0) returned 1
	[0127.963] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2758330*, pdwDataLen=0x593f2d4*=0x800, dwBufLen=0x800 | out: pbData=0x2758330*, pdwDataLen=0x593f2d4*=0x800) returned 1
	[0127.963] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2758b3c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2758b3c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.963] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0127.963] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.963] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.963] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0127.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.963] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.965] GetFileType (hFile=0x5dc) returned 0x1
	[0127.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.965] GetFileType (hFile=0x5dc) returned 0x1
	[0127.965] WriteFile (in: hFile=0x5dc, lpBuffer=0x2758d0c*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2758d0c*, lpNumberOfBytesWritten=0x593f294*=0x800, lpOverlapped=0x0) returned 1
	[0127.966] CloseHandle (hObject=0x5dc) returned 1
	[0127.966] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0127.966] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa3
	[0127.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.966] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8699c366, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x800)) returned 1
	[0127.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.967] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.968] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0127.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.968] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x275a1d4 | out: lpFileInformation=0x275a1d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c)) returned 1
	[0127.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.970] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0127.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.970] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.970] GetFileType (hFile=0x5dc) returned 0x1
	[0127.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.970] GetFileType (hFile=0x5dc) returned 0x1
	[0127.970] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x17b3c
	[0127.971] ReadFile (in: hFile=0x5dc, lpBuffer=0x7c37cc8, nNumberOfBytesToRead=0x17b3c, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x7c37cc8*, lpNumberOfBytesRead=0x593f2cc*=0x17b3c, lpOverlapped=0x0) returned 1
	[0127.981] CloseHandle (hObject=0x5dc) returned 1
	[0127.981] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0127.981] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.981] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275a644, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b280) returned 1
	[0127.981] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.981] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.981] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b440) returned 1
	[0127.981] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0127.981] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x275a6fc*=0x1, dwFlags=0x0) returned 1
	[0127.981] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x275a6c8, dwFlags=0x0) returned 1
	[0127.983] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c4f820*, pdwDataLen=0x593f2d4*=0x17b40, dwBufLen=0x17b40 | out: pbData=0x7c4f820*, pdwDataLen=0x593f2d4*=0x17b40) returned 1
	[0127.983] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275a70c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x275a70c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0127.983] CryptDestroyKey (hKey=0x82b440) returned 1
	[0127.983] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.983] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0127.983] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0127.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0127.983] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.986] GetFileType (hFile=0x5dc) returned 0x1
	[0127.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0127.986] GetFileType (hFile=0x5dc) returned 0x1
	[0127.986] WriteFile (in: hFile=0x5dc, lpBuffer=0x7c4f820*, nNumberOfBytesToWrite=0x17b40, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x7c4f820*, lpNumberOfBytesWritten=0x593f2c0*=0x17b40, lpOverlapped=0x0) returned 1
	[0127.989] CloseHandle (hObject=0x5dc) returned 1
	[0127.989] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0127.989] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xae
	[0127.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0127.989] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x869e8870, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x17b40)) returned 1
	[0127.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0127.989] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0127.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0127.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0127.990] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x275ae20 | out: lpFileInformation=0x275ae20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a)) returned 1
	[0127.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0127.991] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0127.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0127.991] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0127.991] GetFileType (hFile=0x5dc) returned 0x1
	[0127.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0127.991] GetFileType (hFile=0x5dc) returned 0x1
	[0127.991] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x4a4a
	[0127.991] ReadFile (in: hFile=0x5dc, lpBuffer=0x275b198, nNumberOfBytesToRead=0x4a4a, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x275b198*, lpNumberOfBytesRead=0x593f2cc*=0x4a4a, lpOverlapped=0x0) returned 1
	[0128.011] CloseHandle (hObject=0x5dc) returned 1
	[0128.011] CryptDestroyKey (hKey=0x82b280) returned 1
	[0128.011] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.011] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275fc80, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0128.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.012] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.012] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b280) returned 1
	[0128.012] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.012] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x275fd38*=0x1, dwFlags=0x0) returned 1
	[0128.012] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x275fd04, dwFlags=0x0) returned 1
	[0128.012] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275fd48*, pdwDataLen=0x593f2d4*=0x4a50, dwBufLen=0x4a50 | out: pbData=0x275fd48*, pdwDataLen=0x593f2d4*=0x4a50) returned 1
	[0128.012] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27647a4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x27647a4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0128.012] CryptDestroyKey (hKey=0x82b280) returned 1
	[0128.012] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.012] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.012] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0128.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0128.012] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.014] GetFileType (hFile=0x5dc) returned 0x1
	[0128.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0128.014] GetFileType (hFile=0x5dc) returned 0x1
	[0128.014] WriteFile (in: hFile=0x5dc, lpBuffer=0x275fd48*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x275fd48*, lpNumberOfBytesWritten=0x593f2c0*=0x4a50, lpOverlapped=0x0) returned 1
	[0128.016] CloseHandle (hObject=0x5dc) returned 1
	[0128.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0128.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa1
	[0128.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0128.016] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a0ead0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4a50)) returned 1
	[0128.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0128.017] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.018] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77
	[0128.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0128.018] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2764e18 | out: lpFileInformation=0x2764e18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6)) returned 1
	[0128.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0128.019] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77
	[0128.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0128.019] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.020] GetFileType (hFile=0x5dc) returned 0x1
	[0128.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0128.020] GetFileType (hFile=0x5dc) returned 0x1
	[0128.020] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x5f6
	[0128.020] ReadFile (in: hFile=0x5dc, lpBuffer=0x27657bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27657bc*, lpNumberOfBytesRead=0x593f2cc*=0x5f6, lpOverlapped=0x0) returned 1
	[0128.022] CloseHandle (hObject=0x5dc) returned 1
	[0128.022] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0128.022] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.022] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2766858, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b6c0) returned 1
	[0128.022] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.022] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.022] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b540) returned 1
	[0128.022] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.023] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2766910*=0x1, dwFlags=0x0) returned 1
	[0128.023] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27668dc, dwFlags=0x0) returned 1
	[0128.023] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2766920*, pdwDataLen=0x593f2d4*=0x600, dwBufLen=0x600 | out: pbData=0x2766920*, pdwDataLen=0x593f2d4*=0x600) returned 1
	[0128.023] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2766f2c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2766f2c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0128.023] CryptDestroyKey (hKey=0x82b540) returned 1
	[0128.023] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.023] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77
	[0128.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0128.023] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.025] GetFileType (hFile=0x5dc) returned 0x1
	[0128.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0128.025] GetFileType (hFile=0x5dc) returned 0x1
	[0128.025] WriteFile (in: hFile=0x5dc, lpBuffer=0x2767108*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2767108*, lpNumberOfBytesWritten=0x593f294*=0x600, lpOverlapped=0x0) returned 1
	[0128.026] CloseHandle (hObject=0x5dc) returned 1
	[0128.026] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77
	[0128.026] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa6
	[0128.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0128.027] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a34cda, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x600)) returned 1
	[0128.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0128.027] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.028] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6e
	[0128.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0128.028] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x27685ec | out: lpFileInformation=0x27685ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28)) returned 1
	[0128.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0128.029] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6e
	[0128.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0128.029] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.029] GetFileType (hFile=0x5dc) returned 0x1
	[0128.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0128.029] GetFileType (hFile=0x5dc) returned 0x1
	[0128.029] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2b28
	[0128.029] ReadFile (in: hFile=0x5dc, lpBuffer=0x2768944, nNumberOfBytesToRead=0x2b28, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2768944*, lpNumberOfBytesRead=0x593f2cc*=0x2b28, lpOverlapped=0x0) returned 1
	[0128.040] CloseHandle (hObject=0x5dc) returned 1
	[0128.040] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0128.041] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.041] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276b508, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b100) returned 1
	[0128.041] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.041] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.041] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b4c0) returned 1
	[0128.041] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.041] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x276b5c0*=0x1, dwFlags=0x0) returned 1
	[0128.041] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x276b58c, dwFlags=0x0) returned 1
	[0128.041] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276b5d0*, pdwDataLen=0x593f2d4*=0x2b30, dwBufLen=0x2b30 | out: pbData=0x276b5d0*, pdwDataLen=0x593f2d4*=0x2b30) returned 1
	[0128.041] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276e10c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x276e10c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0128.041] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0128.042] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.042] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6e
	[0128.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0128.042] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.044] GetFileType (hFile=0x5dc) returned 0x1
	[0128.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0128.044] GetFileType (hFile=0x5dc) returned 0x1
	[0128.044] WriteFile (in: hFile=0x5dc, lpBuffer=0x276b5d0*, nNumberOfBytesToWrite=0x2b30, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x276b5d0*, lpNumberOfBytesWritten=0x593f2c0*=0x2b30, lpOverlapped=0x0) returned 1
	[0128.046] CloseHandle (hObject=0x5dc) returned 1
	[0128.046] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6e
	[0128.046] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9d
	[0128.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0128.046] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a5adb8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2b30)) returned 1
	[0128.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0128.046] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.053] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0128.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0128.053] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x276e750 | out: lpFileInformation=0x276e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906)) returned 1
	[0128.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0128.054] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0128.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0128.054] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.054] GetFileType (hFile=0x5dc) returned 0x1
	[0128.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0128.054] GetFileType (hFile=0x5dc) returned 0x1
	[0128.054] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x906
	[0128.054] ReadFile (in: hFile=0x5dc, lpBuffer=0x276f424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x276f424*, lpNumberOfBytesRead=0x593f2cc*=0x906, lpOverlapped=0x0) returned 1
	[0128.056] CloseHandle (hObject=0x5dc) returned 1
	[0128.056] CryptDestroyKey (hKey=0x82b100) returned 1
	[0128.056] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.056] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27704c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b440) returned 1
	[0128.056] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.057] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.057] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0128.057] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.057] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x2770578*=0x1, dwFlags=0x0) returned 1
	[0128.057] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x2770544, dwFlags=0x0) returned 1
	[0128.057] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2770588*, pdwDataLen=0x593f2d4*=0x910, dwBufLen=0x910 | out: pbData=0x2770588*, pdwDataLen=0x593f2d4*=0x910) returned 1
	[0128.057] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2770ea4*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2770ea4*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0128.057] CryptDestroyKey (hKey=0x82b340) returned 1
	[0128.057] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.057] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.057] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0128.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0128.057] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.059] GetFileType (hFile=0x5dc) returned 0x1
	[0128.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0128.059] GetFileType (hFile=0x5dc) returned 0x1
	[0128.059] WriteFile (in: hFile=0x5dc, lpBuffer=0x2771090*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x593f294, lpOverlapped=0x0 | out: lpBuffer=0x2771090*, lpNumberOfBytesWritten=0x593f294*=0x910, lpOverlapped=0x0) returned 1
	[0128.060] CloseHandle (hObject=0x5dc) returned 1
	[0128.061] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0128.061] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xaa
	[0128.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0128.061] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a811f2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x910)) returned 1
	[0128.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0128.061] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.062] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0128.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0128.062] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2772594 | out: lpFileInformation=0x2772594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a)) returned 1
	[0128.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0128.071] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0128.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0128.071] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.071] GetFileType (hFile=0x5dc) returned 0x1
	[0128.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0128.072] GetFileType (hFile=0x5dc) returned 0x1
	[0128.072] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x2b8a
	[0128.072] ReadFile (in: hFile=0x5dc, lpBuffer=0x27728fc, nNumberOfBytesToRead=0x2b8a, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27728fc*, lpNumberOfBytesRead=0x593f2cc*=0x2b8a, lpOverlapped=0x0) returned 1
	[0128.084] CloseHandle (hObject=0x5dc) returned 1
	[0128.084] CryptDestroyKey (hKey=0x82b440) returned 1
	[0128.084] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.084] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2775524, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b300) returned 1
	[0128.084] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.084] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.084] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b340) returned 1
	[0128.084] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.084] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27755dc*=0x1, dwFlags=0x0) returned 1
	[0128.084] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27755a8, dwFlags=0x0) returned 1
	[0128.084] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27755ec*, pdwDataLen=0x593f2d4*=0x2b90, dwBufLen=0x2b90 | out: pbData=0x27755ec*, pdwDataLen=0x593f2d4*=0x2b90) returned 1
	[0128.085] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2778188*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2778188*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0128.085] CryptDestroyKey (hKey=0x82b340) returned 1
	[0128.085] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.085] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.085] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0128.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0128.085] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.087] GetFileType (hFile=0x5dc) returned 0x1
	[0128.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0128.087] GetFileType (hFile=0x5dc) returned 0x1
	[0128.087] WriteFile (in: hFile=0x5dc, lpBuffer=0x27755ec*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x27755ec*, lpNumberOfBytesWritten=0x593f2c0*=0x2b90, lpOverlapped=0x0) returned 1
	[0128.088] CloseHandle (hObject=0x5dc) returned 1
	[0128.088] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70
	[0128.088] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9f
	[0128.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0128.089] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86acd628, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2b90)) returned 1
	[0128.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0128.089] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.090] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0128.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0128.090] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x27787e4 | out: lpFileInformation=0x27787e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194)) returned 1
	[0128.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0128.091] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0128.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0128.091] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.092] GetFileType (hFile=0x5dc) returned 0x1
	[0128.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0128.092] GetFileType (hFile=0x5dc) returned 0x1
	[0128.092] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x17194
	[0128.092] ReadFile (in: hFile=0x5dc, lpBuffer=0x7c67380, nNumberOfBytesToRead=0x17194, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x7c67380*, lpNumberOfBytesRead=0x593f2cc*=0x17194, lpOverlapped=0x0) returned 1
	[0128.110] CloseHandle (hObject=0x5dc) returned 1
	[0128.110] CryptDestroyKey (hKey=0x82b300) returned 1
	[0128.110] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.110] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2778c54, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b100) returned 1
	[0128.110] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.110] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.110] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b440) returned 1
	[0128.111] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.111] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2778d0c*=0x1, dwFlags=0x0) returned 1
	[0128.111] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2778cd8, dwFlags=0x0) returned 1
	[0128.112] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7e530*, pdwDataLen=0x593f2d4*=0x171a0, dwBufLen=0x171a0 | out: pbData=0x7c7e530*, pdwDataLen=0x593f2d4*=0x171a0) returned 1
	[0128.112] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2778d1c*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2778d1c*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0128.112] CryptDestroyKey (hKey=0x82b440) returned 1
	[0128.112] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.112] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.112] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0128.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0128.112] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.114] GetFileType (hFile=0x5dc) returned 0x1
	[0128.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0128.115] GetFileType (hFile=0x5dc) returned 0x1
	[0128.115] WriteFile (in: hFile=0x5dc, lpBuffer=0x7c7e530*, nNumberOfBytesToWrite=0x171a0, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x7c7e530*, lpNumberOfBytesWritten=0x593f2c0*=0x171a0, lpOverlapped=0x0) returned 1
	[0128.117] CloseHandle (hObject=0x5dc) returned 1
	[0128.117] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0128.117] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xae
	[0128.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0128.118] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86b19ac9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x171a0)) returned 1
	[0128.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0128.118] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.119] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0128.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0128.120] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2779430 | out: lpFileInformation=0x2779430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984)) returned 1
	[0128.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0128.121] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593ece0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0128.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f224) returned 1
	[0128.121] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.121] GetFileType (hFile=0x5dc) returned 0x1
	[0128.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f220) returned 1
	[0128.121] GetFileType (hFile=0x5dc) returned 0x1
	[0128.121] GetFileSize (in: hFile=0x5dc, lpFileSizeHigh=0x593f320 | out: lpFileSizeHigh=0x593f320*=0x0) returned 0x17984
	[0128.122] ReadFile (in: hFile=0x5dc, lpBuffer=0x7c956f0, nNumberOfBytesToRead=0x17984, lpNumberOfBytesRead=0x593f2cc, lpOverlapped=0x0 | out: lpBuffer=0x7c956f0*, lpNumberOfBytesRead=0x593f2cc*=0x17984, lpOverlapped=0x0) returned 1
	[0128.133] CloseHandle (hObject=0x5dc) returned 1
	[0128.134] CryptDestroyKey (hKey=0x82b100) returned 1
	[0128.134] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.134] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2779838, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x593f278 | out: phKey=0x593f278*=0x82b5c0) returned 1
	[0128.134] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.134] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.134] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x593f268 | out: phKey=0x593f268*=0x82b6c0) returned 1
	[0128.134] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0128.134] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27798f0*=0x1, dwFlags=0x0) returned 1
	[0128.134] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27798bc, dwFlags=0x0) returned 1
	[0128.136] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7cad090*, pdwDataLen=0x593f2d4*=0x17990, dwBufLen=0x17990 | out: pbData=0x7cad090*, pdwDataLen=0x593f2d4*=0x17990) returned 1
	[0128.136] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2779900*, pdwDataLen=0x593f2dc*=0x0, dwBufLen=0x10 | out: pbData=0x2779900*, pdwDataLen=0x593f2dc*=0x10) returned 1
	[0128.136] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0128.136] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.136] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0128.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593eccc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0128.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f210) returned 1
	[0128.136] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5dc
	[0128.138] GetFileType (hFile=0x5dc) returned 0x1
	[0128.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f20c) returned 1
	[0128.138] GetFileType (hFile=0x5dc) returned 0x1
	[0128.138] WriteFile (in: hFile=0x5dc, lpBuffer=0x7cad090*, nNumberOfBytesToWrite=0x17990, lpNumberOfBytesWritten=0x593f2c0, lpOverlapped=0x0 | out: lpBuffer=0x7cad090*, lpNumberOfBytesWritten=0x593f2c0*=0x17990, lpOverlapped=0x0) returned 1
	[0128.141] CloseHandle (hObject=0x5dc) returned 1
	[0128.318] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0128.318] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x593edf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa1
	[0128.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f2a4) returned 1
	[0128.318] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x593f320 | out: lpFileInformation=0x593f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86b3fcf0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x17990)) returned 1
	[0128.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f2a0) returned 1
	[0128.319] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0128.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x593ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x85
	[0128.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x593f1c0) returned 1
	[0128.320] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2779f74 | out: lpFileInformation=0x2779f74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc)) returned 1
	[0128.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x593f1bc) returned 1
	[0131.291] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.309] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.323] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.357] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.367] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.403] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.433] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.488] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.510] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.531] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.595] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.658] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.673] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.676] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.677] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.678] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.678] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.679] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.680] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.684] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.695] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.696] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.708] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.715] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.716] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.716] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.719] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.722] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.738] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.739] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.748] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.750] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.750] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.751] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.753] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.753] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.756] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.772] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.774] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.782] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.789] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.790] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.791] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.793] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.805] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.815] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.816] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.820] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.841] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.845] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.847] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.848] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.849] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.850] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.850] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.851] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.851] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.902] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.905] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.907] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.908] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.909] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.910] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.910] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.912] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.913] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.940] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.942] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.943] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.945] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.952] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0131.978] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.039] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.047] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.201] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.205] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.218] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.243] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.275] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.279] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.284] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.305] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.318] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.318] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.320] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.323] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.356] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.359] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.365] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.367] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.368] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.374] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.385] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.400] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.428] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.428] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.434] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.448] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.451] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.453] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.458] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.459] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.460] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.460] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.462] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.484] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.488] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.489] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.490] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.491] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.498] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.498] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.499] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0132.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.115] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.117] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.118] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.119] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.120] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.121] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.125] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.125] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.126] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.126] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.126] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.127] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.127] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.129] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.133] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.135] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.136] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.136] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.137] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.142] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.146] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.147] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.148] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.149] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.150] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.150] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0133.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0153.573] CoUninitialize () 

Thread:
	id = 21
	os_tid = 0xc38


Thread:
	id = 22
	os_tid = 0xdf8


Thread:
	id = 23
	os_tid = 0xfd0


Thread:
	id = 24
	os_tid = 0x9c0

	[0155.220] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0155.221] CoGetContextToken (in: pToken=0x57ff914 | out: pToken=0x57ff914) returned 0x0
	[0155.221] CObjectContext::QueryInterface () returned 0x0
	[0155.221] CObjectContext::GetCurrentThreadType () returned 0x0
	[0155.221] Release () returned 0x0
	[0155.221] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1
	[0155.221] CoUninitialize () 
	[0155.221] RoInitialize () returned 0x1
	[0155.221] RoUninitialize () returned 0x0
	[0155.221] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.261] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.357] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.089] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.230] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.328] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.699] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.988] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0157.082] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0157.131] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt", lpFilePart=0x0) returned 0x38
	[0157.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0157.131] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xguwmsdy8czxlsgkjkhz.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.131] GetFileType (hFile=0x47c) returned 0x1
	[0157.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0157.131] GetFileType (hFile=0x47c) returned 0x1
	[0157.131] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x11fd2
	[0157.131] ReadFile (in: hFile=0x47c, lpBuffer=0x2761f98, nNumberOfBytesToRead=0x11fd2, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2761f98*, lpNumberOfBytesRead=0x57ff3fc*=0x11fd2, lpOverlapped=0x0) returned 1
	[0157.132] CloseHandle (hObject=0x47c) returned 1
	[0157.132] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0157.132] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.132] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2774008, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b480) returned 1
	[0157.132] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.132] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.132] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0157.132] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.132] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27740c0*=0x1, dwFlags=0x0) returned 1
	[0157.132] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x277408c, dwFlags=0x0) returned 1
	[0157.132] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27740d0*, pdwDataLen=0x57ff404*=0x11fe0, dwBufLen=0x11fe0 | out: pbData=0x27740d0*, pdwDataLen=0x57ff404*=0x11fe0) returned 1
	[0157.133] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27860bc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27860bc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0157.133] CryptDestroyKey (hKey=0x82b080) returned 1
	[0157.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.133] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt", lpFilePart=0x0) returned 0x38
	[0157.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0157.133] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xguwmsdy8czxlsgkjkhz.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.134] GetFileType (hFile=0x47c) returned 0x1
	[0157.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0157.134] GetFileType (hFile=0x47c) returned 0x1
	[0157.134] WriteFile (in: hFile=0x47c, lpBuffer=0x27740d0*, nNumberOfBytesToWrite=0x11fe0, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x27740d0*, lpNumberOfBytesWritten=0x57ff3f0*=0x11fe0, lpOverlapped=0x0) returned 1
	[0157.136] CloseHandle (hObject=0x47c) returned 1
	[0157.136] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt", lpFilePart=0x0) returned 0x38
	[0157.136] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0157.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0157.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xguwmsdy8czxlsgkjkhz.odt"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba988c0, ftCreationTime.dwHighDateTime=0x1d4cf91, ftLastAccessTime.dwLowDateTime=0x62b19c10, ftLastAccessTime.dwHighDateTime=0x1d4ce8b, ftLastWriteTime.dwLowDateTime=0x97fd5b75, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11fe0)) returned 1
	[0157.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0157.136] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xguwmsdy8czxlsgkjkhz.odt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XgUwMSDy8CzxLSGkjkhZ.odt id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xguwmsdy8czxlsgkjkhz.odt id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0157.137] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a", lpFilePart=0x0) returned 0x2f
	[0157.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0157.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yar6_gpci0e.m4a"), fInfoLevelId=0x0, lpFileInformation=0x27864d0 | out: lpFileInformation=0x27864d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf237b990, ftCreationTime.dwHighDateTime=0x1d4ca36, ftLastAccessTime.dwLowDateTime=0xa907fe90, ftLastAccessTime.dwHighDateTime=0x1d4d343, ftLastWriteTime.dwLowDateTime=0xa907fe90, ftLastWriteTime.dwHighDateTime=0x1d4d343, nFileSizeHigh=0x0, nFileSizeLow=0xfc68)) returned 1
	[0157.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0157.137] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a", lpFilePart=0x0) returned 0x2f
	[0157.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0157.137] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yar6_gpci0e.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.137] GetFileType (hFile=0x47c) returned 0x1
	[0157.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0157.137] GetFileType (hFile=0x47c) returned 0x1
	[0157.137] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0xfc68
	[0157.137] ReadFile (in: hFile=0x47c, lpBuffer=0x27866d8, nNumberOfBytesToRead=0xfc68, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27866d8*, lpNumberOfBytesRead=0x57ff3fc*=0xfc68, lpOverlapped=0x0) returned 1
	[0157.138] CloseHandle (hObject=0x47c) returned 1
	[0157.138] CryptDestroyKey (hKey=0x82b480) returned 1
	[0157.138] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.138] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27963dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0157.138] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.138] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.139] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0157.139] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.139] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2796494*=0x1, dwFlags=0x0) returned 1
	[0157.139] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2796460, dwFlags=0x0) returned 1
	[0157.139] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27964a4*, pdwDataLen=0x57ff404*=0xfc70, dwBufLen=0xfc70 | out: pbData=0x27964a4*, pdwDataLen=0x57ff404*=0xfc70) returned 1
	[0157.139] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a6120*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27a6120*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0157.139] CryptDestroyKey (hKey=0x82b540) returned 1
	[0157.139] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.139] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.139] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a", lpFilePart=0x0) returned 0x2f
	[0157.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0157.139] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yar6_gpci0e.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.140] GetFileType (hFile=0x47c) returned 0x1
	[0157.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0157.140] GetFileType (hFile=0x47c) returned 0x1
	[0157.140] WriteFile (in: hFile=0x47c, lpBuffer=0x27964a4*, nNumberOfBytesToWrite=0xfc70, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x27964a4*, lpNumberOfBytesWritten=0x57ff3f0*=0xfc70, lpOverlapped=0x0) returned 1
	[0157.142] CloseHandle (hObject=0x47c) returned 1
	[0157.142] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a", lpFilePart=0x0) returned 0x2f
	[0157.142] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0157.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0157.142] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yar6_gpci0e.m4a"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf237b990, ftCreationTime.dwHighDateTime=0x1d4ca36, ftLastAccessTime.dwLowDateTime=0xa907fe90, ftLastAccessTime.dwHighDateTime=0x1d4d343, ftLastWriteTime.dwLowDateTime=0x97fd5b75, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xfc70)) returned 1
	[0157.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0157.142] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yar6_gpci0e.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YAR6_GPCI0E.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yar6_gpci0e.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0157.143] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv", lpFilePart=0x0) returned 0x29
	[0157.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0157.143] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yjrtm.csv"), fInfoLevelId=0x0, lpFileInformation=0x27a64c8 | out: lpFileInformation=0x27a64c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee92370, ftCreationTime.dwHighDateTime=0x1d4d49a, ftLastAccessTime.dwLowDateTime=0x602bad90, ftLastAccessTime.dwHighDateTime=0x1d4d085, ftLastWriteTime.dwLowDateTime=0x602bad90, ftLastWriteTime.dwHighDateTime=0x1d4d085, nFileSizeHigh=0x0, nFileSizeLow=0x7e32)) returned 1
	[0157.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0157.143] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv", lpFilePart=0x0) returned 0x29
	[0157.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0157.143] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yjrtm.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.144] GetFileType (hFile=0x47c) returned 0x1
	[0157.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0157.144] GetFileType (hFile=0x47c) returned 0x1
	[0157.144] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x7e32
	[0157.144] ReadFile (in: hFile=0x47c, lpBuffer=0x27a66a0, nNumberOfBytesToRead=0x7e32, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27a66a0*, lpNumberOfBytesRead=0x57ff3fc*=0x7e32, lpOverlapped=0x0) returned 1
	[0157.144] CloseHandle (hObject=0x47c) returned 1
	[0157.144] CryptDestroyKey (hKey=0x82b100) returned 1
	[0157.145] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.145] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ae570, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0157.145] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.145] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.145] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b400) returned 1
	[0157.145] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.145] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x27ae628*=0x1, dwFlags=0x0) returned 1
	[0157.145] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x27ae5f4, dwFlags=0x0) returned 1
	[0157.145] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ae638*, pdwDataLen=0x57ff404*=0x7e40, dwBufLen=0x7e40 | out: pbData=0x27ae638*, pdwDataLen=0x57ff404*=0x7e40) returned 1
	[0157.145] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b6484*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27b6484*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0157.145] CryptDestroyKey (hKey=0x82b400) returned 1
	[0157.145] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.145] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.145] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv", lpFilePart=0x0) returned 0x29
	[0157.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0157.145] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yjrtm.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.146] GetFileType (hFile=0x47c) returned 0x1
	[0157.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0157.146] GetFileType (hFile=0x47c) returned 0x1
	[0157.146] WriteFile (in: hFile=0x47c, lpBuffer=0x27ae638*, nNumberOfBytesToWrite=0x7e40, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x27ae638*, lpNumberOfBytesWritten=0x57ff3f0*=0x7e40, lpOverlapped=0x0) returned 1
	[0157.147] CloseHandle (hObject=0x47c) returned 1
	[0157.147] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv", lpFilePart=0x0) returned 0x29
	[0157.148] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x58
	[0157.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0157.148] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yjrtm.csv"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee92370, ftCreationTime.dwHighDateTime=0x1d4d49a, ftLastAccessTime.dwLowDateTime=0x602bad90, ftLastAccessTime.dwHighDateTime=0x1d4d085, ftLastWriteTime.dwLowDateTime=0x97ffbe39, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x7e40)) returned 1
	[0157.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0157.148] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yjrtm.csv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yjRtm.csv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yjrtm.csv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0157.149] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif", lpFilePart=0x0) returned 0x2e
	[0157.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0157.149] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ylhdozet41.gif"), fInfoLevelId=0x0, lpFileInformation=0x27b67e4 | out: lpFileInformation=0x27b67e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea439e10, ftCreationTime.dwHighDateTime=0x1d4d27a, ftLastAccessTime.dwLowDateTime=0x381da250, ftLastAccessTime.dwHighDateTime=0x1d4d516, ftLastWriteTime.dwLowDateTime=0x381da250, ftLastWriteTime.dwHighDateTime=0x1d4d516, nFileSizeHigh=0x0, nFileSizeLow=0x17493)) returned 1
	[0157.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0157.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif", lpFilePart=0x0) returned 0x2e
	[0157.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0157.150] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ylhdozet41.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.150] GetFileType (hFile=0x47c) returned 0x1
	[0157.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0157.150] GetFileType (hFile=0x47c) returned 0x1
	[0157.150] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x17493
	[0157.150] ReadFile (in: hFile=0x47c, lpBuffer=0x91531e8, nNumberOfBytesToRead=0x17493, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x91531e8*, lpNumberOfBytesRead=0x57ff3fc*=0x17493, lpOverlapped=0x0) returned 1
	[0157.152] CloseHandle (hObject=0x47c) returned 1
	[0157.152] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0157.152] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.152] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b6a7c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0157.152] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.152] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.152] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b400) returned 1
	[0157.152] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.152] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x27b6b34*=0x1, dwFlags=0x0) returned 1
	[0157.152] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x27b6b00, dwFlags=0x0) returned 1
	[0157.153] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x916a698*, pdwDataLen=0x57ff404*=0x174a0, dwBufLen=0x174a0 | out: pbData=0x916a698*, pdwDataLen=0x57ff404*=0x174a0) returned 1
	[0157.153] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b6b44*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27b6b44*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0157.153] CryptDestroyKey (hKey=0x82b400) returned 1
	[0157.153] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.154] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.154] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif", lpFilePart=0x0) returned 0x2e
	[0157.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0157.154] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ylhdozet41.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.156] GetFileType (hFile=0x47c) returned 0x1
	[0157.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0157.156] GetFileType (hFile=0x47c) returned 0x1
	[0157.156] WriteFile (in: hFile=0x47c, lpBuffer=0x916a698*, nNumberOfBytesToWrite=0x174a0, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x916a698*, lpNumberOfBytesWritten=0x57ff3f0*=0x174a0, lpOverlapped=0x0) returned 1
	[0157.158] CloseHandle (hObject=0x47c) returned 1
	[0157.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif", lpFilePart=0x0) returned 0x2e
	[0157.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0157.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0157.158] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ylhdozet41.gif"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea439e10, ftCreationTime.dwHighDateTime=0x1d4d27a, ftLastAccessTime.dwLowDateTime=0x381da250, ftLastAccessTime.dwHighDateTime=0x1d4d516, ftLastWriteTime.dwLowDateTime=0x97ffbe39, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x174a0)) returned 1
	[0157.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0157.158] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ylhdozet41.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ylhdOZEt41.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ylhdozet41.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0157.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc", lpFilePart=0x0) returned 0x2c
	[0157.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0157.159] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zlvldqui.doc"), fInfoLevelId=0x0, lpFileInformation=0x27b6ee0 | out: lpFileInformation=0x27b6ee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5ffc10, ftCreationTime.dwHighDateTime=0x1d4c9cb, ftLastAccessTime.dwLowDateTime=0xb75f22b0, ftLastAccessTime.dwHighDateTime=0x1d4d4ed, ftLastWriteTime.dwLowDateTime=0xb75f22b0, ftLastWriteTime.dwHighDateTime=0x1d4d4ed, nFileSizeHigh=0x0, nFileSizeLow=0x186a7)) returned 1
	[0157.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0157.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc", lpFilePart=0x0) returned 0x2c
	[0157.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0157.159] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zlvldqui.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.159] GetFileType (hFile=0x47c) returned 0x1
	[0157.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0157.159] GetFileType (hFile=0x47c) returned 0x1
	[0157.159] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x186a7
	[0157.160] ReadFile (in: hFile=0x47c, lpBuffer=0x9181b58, nNumberOfBytesToRead=0x186a7, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x9181b58*, lpNumberOfBytesRead=0x57ff3fc*=0x186a7, lpOverlapped=0x0) returned 1
	[0157.161] CloseHandle (hObject=0x47c) returned 1
	[0157.162] CryptDestroyKey (hKey=0x82b540) returned 1
	[0157.162] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.162] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b7168, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0157.162] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.162] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.162] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0157.162] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.162] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27b7220*=0x1, dwFlags=0x0) returned 1
	[0157.162] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27b71ec, dwFlags=0x0) returned 1
	[0157.163] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x919a220*, pdwDataLen=0x57ff404*=0x186b0, dwBufLen=0x186b0 | out: pbData=0x919a220*, pdwDataLen=0x57ff404*=0x186b0) returned 1
	[0157.163] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b7230*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27b7230*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0157.163] CryptDestroyKey (hKey=0x82b480) returned 1
	[0157.163] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.163] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.163] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc", lpFilePart=0x0) returned 0x2c
	[0157.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0157.163] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zlvldqui.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.165] GetFileType (hFile=0x47c) returned 0x1
	[0157.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0157.165] GetFileType (hFile=0x47c) returned 0x1
	[0157.165] WriteFile (in: hFile=0x47c, lpBuffer=0x919a220*, nNumberOfBytesToWrite=0x186b0, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x919a220*, lpNumberOfBytesWritten=0x57ff3f0*=0x186b0, lpOverlapped=0x0) returned 1
	[0157.167] CloseHandle (hObject=0x47c) returned 1
	[0157.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc", lpFilePart=0x0) returned 0x2c
	[0157.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0157.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0157.167] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zlvldqui.doc"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5ffc10, ftCreationTime.dwHighDateTime=0x1d4c9cb, ftLastAccessTime.dwLowDateTime=0xb75f22b0, ftLastAccessTime.dwHighDateTime=0x1d4d4ed, ftLastWriteTime.dwLowDateTime=0x9802214a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x186b0)) returned 1
	[0157.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0157.167] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zlvldqui.doc"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZLvldQuI.doc id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zlvldqui.doc id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0157.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png", lpFilePart=0x0) returned 0x39
	[0157.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0157.169] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\-bz-ppo9k6vnaqnuo_.png"), fInfoLevelId=0x0, lpFileInformation=0x27b75b4 | out: lpFileInformation=0x27b75b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920d6860, ftCreationTime.dwHighDateTime=0x1d4cfa6, ftLastAccessTime.dwLowDateTime=0xae782b10, ftLastAccessTime.dwHighDateTime=0x1d4d312, ftLastWriteTime.dwLowDateTime=0xae782b10, ftLastWriteTime.dwHighDateTime=0x1d4d312, nFileSizeHigh=0x0, nFileSizeLow=0x391d)) returned 1
	[0157.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0157.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png", lpFilePart=0x0) returned 0x39
	[0157.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0157.169] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\-bz-ppo9k6vnaqnuo_.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.169] GetFileType (hFile=0x47c) returned 0x1
	[0157.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0157.169] GetFileType (hFile=0x47c) returned 0x1
	[0157.169] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x391d
	[0157.169] ReadFile (in: hFile=0x47c, lpBuffer=0x27b7804, nNumberOfBytesToRead=0x391d, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27b7804*, lpNumberOfBytesRead=0x57ff3fc*=0x391d, lpOverlapped=0x0) returned 1
	[0157.170] CloseHandle (hObject=0x47c) returned 1
	[0157.170] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0157.170] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.170] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27bb1c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0157.170] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.170] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.170] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0157.171] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.171] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27bb278*=0x1, dwFlags=0x0) returned 1
	[0157.171] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27bb244, dwFlags=0x0) returned 1
	[0157.171] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27bb288*, pdwDataLen=0x57ff404*=0x3920, dwBufLen=0x3920 | out: pbData=0x27bb288*, pdwDataLen=0x57ff404*=0x3920) returned 1
	[0157.171] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27bebb4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27bebb4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0157.171] CryptDestroyKey (hKey=0x82b480) returned 1
	[0157.171] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.171] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.171] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png", lpFilePart=0x0) returned 0x39
	[0157.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0157.171] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\-bz-ppo9k6vnaqnuo_.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.172] GetFileType (hFile=0x47c) returned 0x1
	[0157.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0157.172] GetFileType (hFile=0x47c) returned 0x1
	[0157.172] WriteFile (in: hFile=0x47c, lpBuffer=0x27bb288*, nNumberOfBytesToWrite=0x3920, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x27bb288*, lpNumberOfBytesWritten=0x57ff3f0*=0x3920, lpOverlapped=0x0) returned 1
	[0157.173] CloseHandle (hObject=0x47c) returned 1
	[0157.173] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png", lpFilePart=0x0) returned 0x39
	[0157.173] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0157.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0157.173] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\-bz-ppo9k6vnaqnuo_.png"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920d6860, ftCreationTime.dwHighDateTime=0x1d4cfa6, ftLastAccessTime.dwLowDateTime=0xae782b10, ftLastAccessTime.dwHighDateTime=0x1d4d312, ftLastWriteTime.dwLowDateTime=0x9802214a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3920)) returned 1
	[0157.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0157.173] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\-bz-ppo9k6vnaqnuo_.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\-bz-pPO9k6vNaqNUo_.png id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\-bz-ppo9k6vnaqnuo_.png id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0157.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc", lpFilePart=0x0) returned 0x3a
	[0157.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0157.174] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\7 pnoe67vbgbccxlegc.doc"), fInfoLevelId=0x0, lpFileInformation=0x27befd0 | out: lpFileInformation=0x27befd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd08c4cd0, ftCreationTime.dwHighDateTime=0x1d4c661, ftLastAccessTime.dwLowDateTime=0xc5695f50, ftLastAccessTime.dwHighDateTime=0x1d4cf44, ftLastWriteTime.dwLowDateTime=0xc5695f50, ftLastWriteTime.dwHighDateTime=0x1d4cf44, nFileSizeHigh=0x0, nFileSizeLow=0x69fc)) returned 1
	[0157.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0157.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc", lpFilePart=0x0) returned 0x3a
	[0157.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0157.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\7 pnoe67vbgbccxlegc.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.174] GetFileType (hFile=0x47c) returned 0x1
	[0157.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0157.219] GetFileType (hFile=0x47c) returned 0x1
	[0157.219] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x69fc
	[0157.219] ReadFile (in: hFile=0x47c, lpBuffer=0x27bf228, nNumberOfBytesToRead=0x69fc, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27bf228*, lpNumberOfBytesRead=0x57ff3fc*=0x69fc, lpOverlapped=0x0) returned 1
	[0157.219] CloseHandle (hObject=0x47c) returned 1
	[0157.220] CryptDestroyKey (hKey=0x82b340) returned 1
	[0157.220] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.220] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c5cc0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0157.220] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.220] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.220] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0157.220] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.220] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27c5d78*=0x1, dwFlags=0x0) returned 1
	[0157.220] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27c5d44, dwFlags=0x0) returned 1
	[0157.220] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c5d88*, pdwDataLen=0x57ff404*=0x6a00, dwBufLen=0x6a00 | out: pbData=0x27c5d88*, pdwDataLen=0x57ff404*=0x6a00) returned 1
	[0157.220] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cc794*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27cc794*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0157.220] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0157.220] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.220] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.220] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc", lpFilePart=0x0) returned 0x3a
	[0157.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0157.220] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\7 pnoe67vbgbccxlegc.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.285] GetFileType (hFile=0x47c) returned 0x1
	[0157.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0157.285] GetFileType (hFile=0x47c) returned 0x1
	[0157.285] WriteFile (in: hFile=0x47c, lpBuffer=0x27c5d88*, nNumberOfBytesToWrite=0x6a00, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x27c5d88*, lpNumberOfBytesWritten=0x57ff3f0*=0x6a00, lpOverlapped=0x0) returned 1
	[0157.286] CloseHandle (hObject=0x47c) returned 1
	[0157.342] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc", lpFilePart=0x0) returned 0x3a
	[0157.342] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0157.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0157.342] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\7 pnoe67vbgbccxlegc.doc"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd08c4cd0, ftCreationTime.dwHighDateTime=0x1d4c661, ftLastAccessTime.dwLowDateTime=0xc5695f50, ftLastAccessTime.dwHighDateTime=0x1d4cf44, ftLastWriteTime.dwLowDateTime=0x9815338b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x6a00)) returned 1
	[0157.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0157.342] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\7 pnoe67vbgbccxlegc.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\7 PNOE67vbgbcCxlEgc.doc id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\7 pnoe67vbgbccxlegc.doc id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0157.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf", lpFilePart=0x0) returned 0x2f
	[0157.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0157.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\bk_cgmqe.swf"), fInfoLevelId=0x0, lpFileInformation=0x27ccbb8 | out: lpFileInformation=0x27ccbb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4174e780, ftCreationTime.dwHighDateTime=0x1d4c654, ftLastAccessTime.dwLowDateTime=0x86e0fb20, ftLastAccessTime.dwHighDateTime=0x1d4cdab, ftLastWriteTime.dwLowDateTime=0x86e0fb20, ftLastWriteTime.dwHighDateTime=0x1d4cdab, nFileSizeHigh=0x0, nFileSizeLow=0x157bf)) returned 1
	[0157.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0157.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf", lpFilePart=0x0) returned 0x2f
	[0157.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0157.428] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\bk_cgmqe.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.428] GetFileType (hFile=0x47c) returned 0x1
	[0157.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0157.428] GetFileType (hFile=0x47c) returned 0x1
	[0157.428] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x157bf
	[0157.428] ReadFile (in: hFile=0x47c, lpBuffer=0x91b28f0, nNumberOfBytesToRead=0x157bf, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x91b28f0*, lpNumberOfBytesRead=0x57ff3fc*=0x157bf, lpOverlapped=0x0) returned 1
	[0157.431] CloseHandle (hObject=0x47c) returned 1
	[0157.431] CryptDestroyKey (hKey=0x82b280) returned 1
	[0157.431] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.431] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27cce48, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b0c0) returned 1
	[0157.431] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.431] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.431] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0157.431] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0157.431] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27ccf00*=0x1, dwFlags=0x0) returned 1
	[0157.431] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27ccecc, dwFlags=0x0) returned 1
	[0157.433] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x91c80d0*, pdwDataLen=0x57ff404*=0x157c0, dwBufLen=0x157c0 | out: pbData=0x91c80d0*, pdwDataLen=0x57ff404*=0x157c0) returned 1
	[0157.433] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ccf10*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27ccf10*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0157.433] CryptDestroyKey (hKey=0x82b480) returned 1
	[0157.433] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.433] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0157.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf", lpFilePart=0x0) returned 0x2f
	[0157.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0157.433] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\bk_cgmqe.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0157.708] GetFileType (hFile=0x47c) returned 0x1
	[0157.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0157.708] GetFileType (hFile=0x47c) returned 0x1
	[0157.708] WriteFile (in: hFile=0x47c, lpBuffer=0x91c80d0*, nNumberOfBytesToWrite=0x157c0, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x91c80d0*, lpNumberOfBytesWritten=0x57ff3f0*=0x157c0, lpOverlapped=0x0) returned 1
	[0157.710] CloseHandle (hObject=0x47c) returned 1
	[0157.755] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf", lpFilePart=0x0) returned 0x2f
	[0157.755] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0157.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0157.755] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\bk_cgmqe.swf"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4174e780, ftCreationTime.dwHighDateTime=0x1d4c654, ftLastAccessTime.dwLowDateTime=0x86e0fb20, ftLastAccessTime.dwHighDateTime=0x1d4cdab, ftLastWriteTime.dwLowDateTime=0x985592bb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x157c0)) returned 1
	[0157.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0157.755] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\bk_cgmqe.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\bK_cgmqE.swf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\bk_cgmqe.swf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0158.066] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg", lpFilePart=0x0) returned 0x37
	[0158.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0158.066] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\db6rvdyhdtxtd-ys.jpg"), fInfoLevelId=0x0, lpFileInformation=0x27cd2b4 | out: lpFileInformation=0x27cd2b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f4503b0, ftCreationTime.dwHighDateTime=0x1d4cf5e, ftLastAccessTime.dwLowDateTime=0x20da30c0, ftLastAccessTime.dwHighDateTime=0x1d4c59b, ftLastWriteTime.dwLowDateTime=0x20da30c0, ftLastWriteTime.dwHighDateTime=0x1d4c59b, nFileSizeHigh=0x0, nFileSizeLow=0x1268d)) returned 1
	[0158.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0158.067] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg", lpFilePart=0x0) returned 0x37
	[0158.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0158.068] ReadFile (in: hFile=0x47c, lpBuffer=0x27cd4f4, nNumberOfBytesToRead=0x1268d, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27cd4f4*, lpNumberOfBytesRead=0x57ff3fc*=0x1268d, lpOverlapped=0x0) returned 1
	[0158.069] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0158.069] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0158.069] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27dfc20, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0158.069] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0158.069] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0158.069] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0158.069] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0158.070] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27dfcd8*=0x1, dwFlags=0x0) returned 1
	[0158.070] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27dfca4, dwFlags=0x0) returned 1
	[0158.070] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27dfce8*, pdwDataLen=0x57ff404*=0x12690, dwBufLen=0x12690 | out: pbData=0x27dfce8*, pdwDataLen=0x57ff404*=0x12690) returned 1
	[0158.070] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f2384*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27f2384*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0158.070] CryptDestroyKey (hKey=0x82b280) returned 1
	[0158.070] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0158.070] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0158.070] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg", lpFilePart=0x0) returned 0x37
	[0158.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0158.070] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\db6rvdyhdtxtd-ys.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0158.144] GetFileType (hFile=0x47c) returned 0x1
	[0158.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0158.144] GetFileType (hFile=0x47c) returned 0x1
	[0158.144] WriteFile (in: hFile=0x47c, lpBuffer=0x27dfce8*, nNumberOfBytesToWrite=0x12690, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x27dfce8*, lpNumberOfBytesWritten=0x57ff3f0*=0x12690, lpOverlapped=0x0) returned 1
	[0158.146] CloseHandle (hObject=0x47c) returned 1
	[0158.222] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg", lpFilePart=0x0) returned 0x37
	[0158.222] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0158.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0158.222] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\db6rvdyhdtxtd-ys.jpg"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f4503b0, ftCreationTime.dwHighDateTime=0x1d4cf5e, ftLastAccessTime.dwLowDateTime=0x20da30c0, ftLastAccessTime.dwHighDateTime=0x1d4c59b, ftLastWriteTime.dwLowDateTime=0x9898549d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x12690)) returned 1
	[0158.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0158.222] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\db6rvdyhdtxtd-ys.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\db6rvdyhdTxtD-YS.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\db6rvdyhdtxtd-ys.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0158.347] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv", lpFilePart=0x0) returned 0x35
	[0158.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0158.348] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\eyw6oow_vr-rfy.mkv"), fInfoLevelId=0x0, lpFileInformation=0x27f2788 | out: lpFileInformation=0x27f2788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc5ee510, ftCreationTime.dwHighDateTime=0x1d4d073, ftLastAccessTime.dwLowDateTime=0xcadf4130, ftLastAccessTime.dwHighDateTime=0x1d4d010, ftLastWriteTime.dwLowDateTime=0xcadf4130, ftLastWriteTime.dwHighDateTime=0x1d4d010, nFileSizeHigh=0x0, nFileSizeLow=0x1495e)) returned 1
	[0158.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0158.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv", lpFilePart=0x0) returned 0x35
	[0158.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0158.348] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\eyw6oow_vr-rfy.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0158.348] GetFileType (hFile=0x47c) returned 0x1
	[0158.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0158.349] GetFileType (hFile=0x47c) returned 0x1
	[0158.349] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1495e
	[0158.349] ReadFile (in: hFile=0x47c, lpBuffer=0x27f29b8, nNumberOfBytesToRead=0x1495e, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27f29b8*, lpNumberOfBytesRead=0x57ff3fc*=0x1495e, lpOverlapped=0x0) returned 1
	[0158.350] CloseHandle (hObject=0x47c) returned 1
	[0158.350] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0158.350] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0158.350] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28073b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0158.351] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0158.351] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0158.351] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b200) returned 1
	[0158.351] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0158.351] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x280746c*=0x1, dwFlags=0x0) returned 1
	[0158.351] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2807438, dwFlags=0x0) returned 1
	[0158.351] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x280747c*, pdwDataLen=0x57ff404*=0x14960, dwBufLen=0x14960 | out: pbData=0x280747c*, pdwDataLen=0x57ff404*=0x14960) returned 1
	[0158.351] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x281bde8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x281bde8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0158.351] CryptDestroyKey (hKey=0x82b200) returned 1
	[0158.352] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0158.352] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0158.352] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv", lpFilePart=0x0) returned 0x35
	[0158.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0158.352] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\eyw6oow_vr-rfy.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0158.410] GetFileType (hFile=0x47c) returned 0x1
	[0158.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0158.410] GetFileType (hFile=0x47c) returned 0x1
	[0158.410] WriteFile (in: hFile=0x47c, lpBuffer=0x280747c*, nNumberOfBytesToWrite=0x14960, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x280747c*, lpNumberOfBytesWritten=0x57ff3f0*=0x14960, lpOverlapped=0x0) returned 1
	[0158.412] CloseHandle (hObject=0x47c) returned 1
	[0158.709] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv", lpFilePart=0x0) returned 0x35
	[0158.709] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0158.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0158.709] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\eyw6oow_vr-rfy.mkv"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc5ee510, ftCreationTime.dwHighDateTime=0x1d4d073, ftLastAccessTime.dwLowDateTime=0xcadf4130, ftLastAccessTime.dwHighDateTime=0x1d4d010, ftLastWriteTime.dwLowDateTime=0x98c0dd3e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x14960)) returned 1
	[0158.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0158.710] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\eyw6oow_vr-rfy.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\eyw6oOw_Vr-rFY.mkv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\eyw6oow_vr-rfy.mkv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0158.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg", lpFilePart=0x0) returned 0x32
	[0158.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0158.957] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\hie 4mlx pz.jpg"), fInfoLevelId=0x0, lpFileInformation=0x281c1d4 | out: lpFileInformation=0x281c1d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afa3b0, ftCreationTime.dwHighDateTime=0x1d4d05c, ftLastAccessTime.dwLowDateTime=0xdf79c9a0, ftLastAccessTime.dwHighDateTime=0x1d4c5ff, ftLastWriteTime.dwLowDateTime=0xdf79c9a0, ftLastWriteTime.dwHighDateTime=0x1d4c5ff, nFileSizeHigh=0x0, nFileSizeLow=0xc483)) returned 1
	[0158.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0158.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg", lpFilePart=0x0) returned 0x32
	[0158.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0158.958] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\hie 4mlx pz.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0158.958] GetFileType (hFile=0x47c) returned 0x1
	[0158.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0158.958] GetFileType (hFile=0x47c) returned 0x1
	[0158.958] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0xc483
	[0158.959] ReadFile (in: hFile=0x47c, lpBuffer=0x281c3ec, nNumberOfBytesToRead=0xc483, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x281c3ec*, lpNumberOfBytesRead=0x57ff3fc*=0xc483, lpOverlapped=0x0) returned 1
	[0158.960] CloseHandle (hObject=0x47c) returned 1
	[0158.960] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0158.960] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0158.960] CryptImportKey (in: hProv=0x7f93c0, pbData=0x282890c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0158.960] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0158.960] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0158.960] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0158.960] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0158.960] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x28289c4*=0x1, dwFlags=0x0) returned 1
	[0158.960] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2828990, dwFlags=0x0) returned 1
	[0158.960] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28289d4*, pdwDataLen=0x57ff404*=0xc490, dwBufLen=0xc490 | out: pbData=0x28289d4*, pdwDataLen=0x57ff404*=0xc490) returned 1
	[0158.960] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2834e70*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2834e70*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0158.960] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0158.960] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0158.960] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0158.961] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg", lpFilePart=0x0) returned 0x32
	[0158.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0158.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\hie 4mlx pz.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0159.019] GetFileType (hFile=0x47c) returned 0x1
	[0159.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0159.019] GetFileType (hFile=0x47c) returned 0x1
	[0159.019] WriteFile (in: hFile=0x47c, lpBuffer=0x28289d4*, nNumberOfBytesToWrite=0xc490, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x28289d4*, lpNumberOfBytesWritten=0x57ff3f0*=0xc490, lpOverlapped=0x0) returned 1
	[0159.021] CloseHandle (hObject=0x47c) returned 1
	[0159.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg", lpFilePart=0x0) returned 0x32
	[0159.066] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0159.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0159.066] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\hie 4mlx pz.jpg"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afa3b0, ftCreationTime.dwHighDateTime=0x1d4d05c, ftLastAccessTime.dwLowDateTime=0xdf79c9a0, ftLastAccessTime.dwHighDateTime=0x1d4c5ff, ftLastWriteTime.dwLowDateTime=0x991dd8ac, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xc490)) returned 1
	[0159.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0159.066] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\hie 4mlx pz.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\HIE 4mLx pz.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\hie 4mlx pz.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0159.138] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav", lpFilePart=0x0) returned 0x34
	[0159.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0159.139] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\jcjbemkkmj1vq.wav"), fInfoLevelId=0x0, lpFileInformation=0x2835234 | out: lpFileInformation=0x2835234*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8612ba0, ftCreationTime.dwHighDateTime=0x1d4cac2, ftLastAccessTime.dwLowDateTime=0xe7c19b60, ftLastAccessTime.dwHighDateTime=0x1d4d03b, ftLastWriteTime.dwLowDateTime=0xe7c19b60, ftLastWriteTime.dwHighDateTime=0x1d4d03b, nFileSizeHigh=0x0, nFileSizeLow=0x9c31)) returned 1
	[0159.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0159.139] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav", lpFilePart=0x0) returned 0x34
	[0159.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0159.139] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\jcjbemkkmj1vq.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0159.139] GetFileType (hFile=0x47c) returned 0x1
	[0159.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0159.139] GetFileType (hFile=0x47c) returned 0x1
	[0159.139] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x9c31
	[0159.141] ReadFile (in: hFile=0x47c, lpBuffer=0x2602350, nNumberOfBytesToRead=0x9c31, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2602350*, lpNumberOfBytesRead=0x57ff3fc*=0x9c31, lpOverlapped=0x0) returned 1
	[0159.142] CloseHandle (hObject=0x47c) returned 1
	[0159.143] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0159.143] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0159.143] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260c020, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0159.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0159.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0159.143] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0159.143] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0159.143] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x260c0d8*=0x1, dwFlags=0x0) returned 1
	[0159.143] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x260c0a4, dwFlags=0x0) returned 1
	[0159.143] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260c0e8*, pdwDataLen=0x57ff404*=0x9c40, dwBufLen=0x9c40 | out: pbData=0x260c0e8*, pdwDataLen=0x57ff404*=0x9c40) returned 1
	[0159.143] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2615d34*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2615d34*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0159.143] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0159.143] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0159.143] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0159.143] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav", lpFilePart=0x0) returned 0x34
	[0159.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0159.143] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\jcjbemkkmj1vq.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0159.197] GetFileType (hFile=0x47c) returned 0x1
	[0159.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0159.197] GetFileType (hFile=0x47c) returned 0x1
	[0159.197] WriteFile (in: hFile=0x47c, lpBuffer=0x260c0e8*, nNumberOfBytesToWrite=0x9c40, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x260c0e8*, lpNumberOfBytesWritten=0x57ff3f0*=0x9c40, lpOverlapped=0x0) returned 1
	[0159.199] CloseHandle (hObject=0x47c) returned 1
	[0159.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav", lpFilePart=0x0) returned 0x34
	[0159.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x63
	[0159.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0159.300] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\jcjbemkkmj1vq.wav"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8612ba0, ftCreationTime.dwHighDateTime=0x1d4cac2, ftLastAccessTime.dwLowDateTime=0xe7c19b60, ftLastAccessTime.dwHighDateTime=0x1d4d03b, ftLastWriteTime.dwLowDateTime=0x99381258, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9c40)) returned 1
	[0159.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0159.300] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\jcjbemkkmj1vq.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\JCjBeMKKmJ1vQ.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\jcjbemkkmj1vq.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0159.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv", lpFilePart=0x0) returned 0x2e
	[0159.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0159.319] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\kunll-o.flv"), fInfoLevelId=0x0, lpFileInformation=0x2616110 | out: lpFileInformation=0x2616110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed7eb60, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0x453336b0, ftLastAccessTime.dwHighDateTime=0x1d4cbf4, ftLastWriteTime.dwLowDateTime=0x453336b0, ftLastWriteTime.dwHighDateTime=0x1d4cbf4, nFileSizeHigh=0x0, nFileSizeLow=0x1e90)) returned 1
	[0159.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0159.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv", lpFilePart=0x0) returned 0x2e
	[0159.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0159.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\kunll-o.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0159.319] GetFileType (hFile=0x47c) returned 0x1
	[0159.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0159.319] GetFileType (hFile=0x47c) returned 0x1
	[0159.319] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1e90
	[0159.319] ReadFile (in: hFile=0x47c, lpBuffer=0x2616308, nNumberOfBytesToRead=0x1e90, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2616308*, lpNumberOfBytesRead=0x57ff3fc*=0x1e90, lpOverlapped=0x0) returned 1
	[0159.320] CloseHandle (hObject=0x47c) returned 1
	[0159.320] CryptDestroyKey (hKey=0x82b540) returned 1
	[0159.320] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0159.320] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2618234, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0159.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0159.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0159.320] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0159.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0159.320] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26182ec*=0x1, dwFlags=0x0) returned 1
	[0159.320] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26182b8, dwFlags=0x0) returned 1
	[0159.320] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26182fc*, pdwDataLen=0x57ff404*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x26182fc*, pdwDataLen=0x57ff404*=0x1ea0) returned 1
	[0159.321] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261a1a8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x261a1a8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0159.321] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0159.321] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0159.321] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0159.321] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv", lpFilePart=0x0) returned 0x2e
	[0159.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0159.321] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\kunll-o.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0159.363] GetFileType (hFile=0x47c) returned 0x1
	[0159.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0159.363] GetFileType (hFile=0x47c) returned 0x1
	[0159.363] WriteFile (in: hFile=0x47c, lpBuffer=0x26182fc*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x26182fc*, lpNumberOfBytesWritten=0x57ff3f0*=0x1ea0, lpOverlapped=0x0) returned 1
	[0159.364] CloseHandle (hObject=0x47c) returned 1
	[0159.425] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv", lpFilePart=0x0) returned 0x2e
	[0159.425] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0159.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0159.426] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\kunll-o.flv"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed7eb60, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0x453336b0, ftLastAccessTime.dwHighDateTime=0x1d4cbf4, ftLastWriteTime.dwLowDateTime=0x99524c2b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1ea0)) returned 1
	[0159.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0159.426] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\kunll-o.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\KUNLL-O.flv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\kunll-o.flv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0159.530] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp", lpFilePart=0x0) returned 0x39
	[0159.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0159.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\uwqtbwdq9di0xnrx3g.odp"), fInfoLevelId=0x0, lpFileInformation=0x261a53c | out: lpFileInformation=0x261a53c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aae9700, ftCreationTime.dwHighDateTime=0x1d4cf08, ftLastAccessTime.dwLowDateTime=0x209ac50, ftLastAccessTime.dwHighDateTime=0x1d4d5f1, ftLastWriteTime.dwLowDateTime=0x209ac50, ftLastWriteTime.dwHighDateTime=0x1d4d5f1, nFileSizeHigh=0x0, nFileSizeLow=0x113a8)) returned 1
	[0159.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0159.530] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp", lpFilePart=0x0) returned 0x39
	[0159.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0159.530] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\uwqtbwdq9di0xnrx3g.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0159.531] GetFileType (hFile=0x47c) returned 0x1
	[0159.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0159.531] GetFileType (hFile=0x47c) returned 0x1
	[0159.531] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x113a8
	[0159.531] ReadFile (in: hFile=0x47c, lpBuffer=0x261a78c, nNumberOfBytesToRead=0x113a8, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x261a78c*, lpNumberOfBytesRead=0x57ff3fc*=0x113a8, lpOverlapped=0x0) returned 1
	[0159.532] CloseHandle (hObject=0x47c) returned 1
	[0159.532] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0159.532] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0159.532] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262bbd0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0159.532] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0159.532] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0159.532] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0159.532] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0159.532] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x262bc88*=0x1, dwFlags=0x0) returned 1
	[0159.532] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x262bc54, dwFlags=0x0) returned 1
	[0159.532] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262bc98*, pdwDataLen=0x57ff404*=0x113b0, dwBufLen=0x113b0 | out: pbData=0x262bc98*, pdwDataLen=0x57ff404*=0x113b0) returned 1
	[0159.532] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263d054*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x263d054*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0159.532] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0159.533] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0159.533] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0159.533] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp", lpFilePart=0x0) returned 0x39
	[0159.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0159.533] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\uwqtbwdq9di0xnrx3g.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0159.915] GetFileType (hFile=0x47c) returned 0x1
	[0159.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0159.915] GetFileType (hFile=0x47c) returned 0x1
	[0159.915] WriteFile (in: hFile=0x47c, lpBuffer=0x262bc98*, nNumberOfBytesToWrite=0x113b0, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x262bc98*, lpNumberOfBytesWritten=0x57ff3f0*=0x113b0, lpOverlapped=0x0) returned 1
	[0159.917] CloseHandle (hObject=0x47c) returned 1
	[0159.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp", lpFilePart=0x0) returned 0x39
	[0159.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0159.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0159.977] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\uwqtbwdq9di0xnrx3g.odp"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aae9700, ftCreationTime.dwHighDateTime=0x1d4cf08, ftLastAccessTime.dwLowDateTime=0x209ac50, ftLastAccessTime.dwHighDateTime=0x1d4d5f1, ftLastWriteTime.dwLowDateTime=0x99a5bf32, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x113b0)) returned 1
	[0159.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0159.977] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\uwqtbwdq9di0xnrx3g.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\uWqtBWdq9DI0XNRX3G.odp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\uwqtbwdq9di0xnrx3g.odp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a", lpFilePart=0x0) returned 0x36
	[0160.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0160.082] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\vqxdae1ehmgjzyo.m4a"), fInfoLevelId=0x0, lpFileInformation=0x263d470 | out: lpFileInformation=0x263d470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x232102b0, ftCreationTime.dwHighDateTime=0x1d4cb5d, ftLastAccessTime.dwLowDateTime=0x105a25f0, ftLastAccessTime.dwHighDateTime=0x1d4ca43, ftLastWriteTime.dwLowDateTime=0x105a25f0, ftLastWriteTime.dwHighDateTime=0x1d4ca43, nFileSizeHigh=0x0, nFileSizeLow=0x8ff7)) returned 1
	[0160.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0160.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a", lpFilePart=0x0) returned 0x36
	[0160.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0160.082] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\vqxdae1ehmgjzyo.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.082] GetFileType (hFile=0x47c) returned 0x1
	[0160.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0160.083] GetFileType (hFile=0x47c) returned 0x1
	[0160.083] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x8ff7
	[0160.083] ReadFile (in: hFile=0x47c, lpBuffer=0x263d6a8, nNumberOfBytesToRead=0x8ff7, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x263d6a8*, lpNumberOfBytesRead=0x57ff3fc*=0x8ff7, lpOverlapped=0x0) returned 1
	[0160.084] CloseHandle (hObject=0x47c) returned 1
	[0160.084] CryptDestroyKey (hKey=0x82b100) returned 1
	[0160.084] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.084] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264673c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b400) returned 1
	[0160.084] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.084] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.084] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0160.084] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.084] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26467f4*=0x1, dwFlags=0x0) returned 1
	[0160.084] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26467c0, dwFlags=0x0) returned 1
	[0160.084] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2646804*, pdwDataLen=0x57ff404*=0x9000, dwBufLen=0x9000 | out: pbData=0x2646804*, pdwDataLen=0x57ff404*=0x9000) returned 1
	[0160.084] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264f810*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x264f810*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0160.085] CryptDestroyKey (hKey=0x82b300) returned 1
	[0160.085] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.085] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.085] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a", lpFilePart=0x0) returned 0x36
	[0160.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0160.085] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\vqxdae1ehmgjzyo.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.175] GetFileType (hFile=0x47c) returned 0x1
	[0160.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0160.175] GetFileType (hFile=0x47c) returned 0x1
	[0160.175] WriteFile (in: hFile=0x47c, lpBuffer=0x2646804*, nNumberOfBytesToWrite=0x9000, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x2646804*, lpNumberOfBytesWritten=0x57ff3f0*=0x9000, lpOverlapped=0x0) returned 1
	[0160.177] CloseHandle (hObject=0x47c) returned 1
	[0160.331] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a", lpFilePart=0x0) returned 0x36
	[0160.331] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0160.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0160.331] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\vqxdae1ehmgjzyo.m4a"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x232102b0, ftCreationTime.dwHighDateTime=0x1d4cb5d, ftLastAccessTime.dwLowDateTime=0x105a25f0, ftLastAccessTime.dwHighDateTime=0x1d4ca43, ftLastWriteTime.dwLowDateTime=0x99ce4707, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9000)) returned 1
	[0160.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0160.332] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\vqxdae1ehmgjzyo.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tD103ArYxJ\\vqXdae1ehmGjzYo.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\desktop\\td103aryxj\\vqxdae1ehmgjzyo.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", lpFilePart=0x0) returned 0x2f
	[0160.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0160.431] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x264fc04 | out: lpFileInformation=0x264fc04*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8)) returned 1
	[0160.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0160.432] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", lpFilePart=0x0) returned 0x2f
	[0160.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0160.432] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.432] GetFileType (hFile=0x47c) returned 0x1
	[0160.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0160.432] GetFileType (hFile=0x47c) returned 0x1
	[0160.432] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0xd8
	[0160.432] ReadFile (in: hFile=0x47c, lpBuffer=0x264fee0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x264fee0*, lpNumberOfBytesRead=0x57ff3fc*=0xd8, lpOverlapped=0x0) returned 1
	[0160.433] CloseHandle (hObject=0x47c) returned 1
	[0160.433] CryptDestroyKey (hKey=0x82b400) returned 1
	[0160.433] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.433] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2650f7c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b000) returned 1
	[0160.433] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.433] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.433] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0160.433] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.433] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2651034*=0x1, dwFlags=0x0) returned 1
	[0160.433] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2651000, dwFlags=0x0) returned 1
	[0160.433] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2651044*, pdwDataLen=0x57ff404*=0xe0, dwBufLen=0xe0 | out: pbData=0x2651044*, pdwDataLen=0x57ff404*=0xe0) returned 1
	[0160.434] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2651130*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2651130*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0160.434] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0160.434] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.434] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.434] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", lpFilePart=0x0) returned 0x2f
	[0160.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0160.434] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0160.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57fdd20) returned 1
	[0160.435] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", lpFilePart=0x0) returned 0x32
	[0160.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0160.436] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), fInfoLevelId=0x0, lpFileInformation=0x265176c | out: lpFileInformation=0x265176c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0160.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0160.436] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", lpFilePart=0x0) returned 0x32
	[0160.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0160.436] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.436] GetFileType (hFile=0x47c) returned 0x1
	[0160.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0160.436] GetFileType (hFile=0x47c) returned 0x1
	[0160.436] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x0
	[0160.436] CloseHandle (hObject=0x47c) returned 1
	[0160.436] CryptDestroyKey (hKey=0x82b000) returned 1
	[0160.436] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.436] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2651a20, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b2c0) returned 1
	[0160.436] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.436] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.436] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b040) returned 1
	[0160.437] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.437] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2651ad8*=0x1, dwFlags=0x0) returned 1
	[0160.437] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2651aa4, dwFlags=0x0) returned 1
	[0160.437] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2651ae8*, pdwDataLen=0x57ff404*=0x10, dwBufLen=0x10 | out: pbData=0x2651ae8*, pdwDataLen=0x57ff404*=0x10) returned 1
	[0160.437] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2651b04*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2651b04*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0160.437] CryptDestroyKey (hKey=0x82b040) returned 1
	[0160.437] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.437] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.437] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", lpFilePart=0x0) returned 0x32
	[0160.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0160.437] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.437] GetFileType (hFile=0x47c) returned 0x1
	[0160.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0160.437] GetFileType (hFile=0x47c) returned 0x1
	[0160.437] WriteFile (in: hFile=0x47c, lpBuffer=0x2651c1c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2651c1c*, lpNumberOfBytesWritten=0x57ff3c4*=0x10, lpOverlapped=0x0) returned 1
	[0160.438] CloseHandle (hObject=0x47c) returned 1
	[0160.438] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", lpFilePart=0x0) returned 0x32
	[0160.438] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0160.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0160.439] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x99f46cc8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1
	[0160.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0160.439] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.443] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", lpFilePart=0x0) returned 0x38
	[0160.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0160.443] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), fInfoLevelId=0x0, lpFileInformation=0x2652ed4 | out: lpFileInformation=0x2652ed4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400)) returned 1
	[0160.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0160.443] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", lpFilePart=0x0) returned 0x38
	[0160.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0160.443] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.444] GetFileType (hFile=0x47c) returned 0x1
	[0160.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0160.444] GetFileType (hFile=0x47c) returned 0x1
	[0160.444] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x42400
	[0160.445] ReadFile (in: hFile=0x47c, lpBuffer=0x91dd8b0, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x91dd8b0*, lpNumberOfBytesRead=0x57ff3fc*=0x42400, lpOverlapped=0x0) returned 1
	[0160.569] CloseHandle (hObject=0x47c) returned 1
	[0160.569] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0160.569] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.569] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265319c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0160.569] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.569] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.569] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0160.569] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.569] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2653254*=0x1, dwFlags=0x0) returned 1
	[0160.569] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2653220, dwFlags=0x0) returned 1
	[0160.574] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x921fcd0*, pdwDataLen=0x57ff404*=0x42410, dwBufLen=0x42410 | out: pbData=0x921fcd0*, pdwDataLen=0x57ff404*=0x42410) returned 1
	[0160.574] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2653264*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2653264*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0160.574] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0160.574] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.574] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.574] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", lpFilePart=0x0) returned 0x38
	[0160.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0160.574] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.578] GetFileType (hFile=0x47c) returned 0x1
	[0160.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0160.578] GetFileType (hFile=0x47c) returned 0x1
	[0160.578] WriteFile (in: hFile=0x47c, lpBuffer=0x921fcd0*, nNumberOfBytesToWrite=0x42410, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x921fcd0*, lpNumberOfBytesWritten=0x57ff3f0*=0x42410, lpOverlapped=0x0) returned 1
	[0160.584] CloseHandle (hObject=0x47c) returned 1
	[0160.584] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", lpFilePart=0x0) returned 0x38
	[0160.585] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0160.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0160.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x9a0c43ee, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x42410)) returned 1
	[0160.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0160.585] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.586] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx", lpFilePart=0x0) returned 0x37
	[0160.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0160.586] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\hdpu5plbjwwmidt_.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2653668 | out: lpFileInformation=0x2653668*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59dcb080, ftCreationTime.dwHighDateTime=0x1d4c8b8, ftLastAccessTime.dwLowDateTime=0x544a6f10, ftLastAccessTime.dwHighDateTime=0x1d4c983, ftLastWriteTime.dwLowDateTime=0x544a6f10, ftLastWriteTime.dwHighDateTime=0x1d4c983, nFileSizeHigh=0x0, nFileSizeLow=0x97b7)) returned 1
	[0160.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0160.586] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx", lpFilePart=0x0) returned 0x37
	[0160.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0160.586] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\hdpu5plbjwwmidt_.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.586] GetFileType (hFile=0x47c) returned 0x1
	[0160.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0160.586] GetFileType (hFile=0x47c) returned 0x1
	[0160.586] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x97b7
	[0160.587] ReadFile (in: hFile=0x47c, lpBuffer=0x26538a8, nNumberOfBytesToRead=0x97b7, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26538a8*, lpNumberOfBytesRead=0x57ff3fc*=0x97b7, lpOverlapped=0x0) returned 1
	[0160.587] CloseHandle (hObject=0x47c) returned 1
	[0160.588] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0160.588] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.588] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265d0fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0160.588] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.588] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.588] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0160.588] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.588] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x265d1b4*=0x1, dwFlags=0x0) returned 1
	[0160.588] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x265d180, dwFlags=0x0) returned 1
	[0160.588] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265d1c4*, pdwDataLen=0x57ff404*=0x97c0, dwBufLen=0x97c0 | out: pbData=0x265d1c4*, pdwDataLen=0x57ff404*=0x97c0) returned 1
	[0160.588] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2666990*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2666990*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0160.588] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0160.588] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.588] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.588] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx", lpFilePart=0x0) returned 0x37
	[0160.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0160.588] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\hdpu5plbjwwmidt_.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.590] GetFileType (hFile=0x47c) returned 0x1
	[0160.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0160.590] GetFileType (hFile=0x47c) returned 0x1
	[0160.590] WriteFile (in: hFile=0x47c, lpBuffer=0x265d1c4*, nNumberOfBytesToWrite=0x97c0, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x265d1c4*, lpNumberOfBytesWritten=0x57ff3f0*=0x97c0, lpOverlapped=0x0) returned 1
	[0160.592] CloseHandle (hObject=0x47c) returned 1
	[0160.592] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx", lpFilePart=0x0) returned 0x37
	[0160.592] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0160.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0160.592] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\hdpu5plbjwwmidt_.pptx"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59dcb080, ftCreationTime.dwHighDateTime=0x1d4c8b8, ftLastAccessTime.dwLowDateTime=0x544a6f10, ftLastAccessTime.dwHighDateTime=0x1d4c983, ftLastWriteTime.dwLowDateTime=0x9a0c43ee, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x97c0)) returned 1
	[0160.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0160.592] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\hdpu5plbjwwmidt_.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\HDpu5plBjwWMidt_.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\hdpu5plbjwwmidt_.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.593] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp", lpFilePart=0x0) returned 0x3a
	[0160.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0160.593] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\mittzgyinaehuqfzzt9h.odp"), fInfoLevelId=0x0, lpFileInformation=0x2666d94 | out: lpFileInformation=0x2666d94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d920e60, ftCreationTime.dwHighDateTime=0x1d4c8cd, ftLastAccessTime.dwLowDateTime=0x35f75dd0, ftLastAccessTime.dwHighDateTime=0x1d4c85b, ftLastWriteTime.dwLowDateTime=0x35f75dd0, ftLastWriteTime.dwHighDateTime=0x1d4c85b, nFileSizeHigh=0x0, nFileSizeLow=0x12882)) returned 1
	[0160.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0160.593] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp", lpFilePart=0x0) returned 0x3a
	[0160.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0160.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\mittzgyinaehuqfzzt9h.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.593] GetFileType (hFile=0x47c) returned 0x1
	[0160.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0160.593] GetFileType (hFile=0x47c) returned 0x1
	[0160.593] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x12882
	[0160.594] ReadFile (in: hFile=0x47c, lpBuffer=0x2666ff4, nNumberOfBytesToRead=0x12882, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2666ff4*, lpNumberOfBytesRead=0x57ff3fc*=0x12882, lpOverlapped=0x0) returned 1
	[0160.595] CloseHandle (hObject=0x47c) returned 1
	[0160.595] CryptDestroyKey (hKey=0x82b100) returned 1
	[0160.595] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.595] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2679914, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0160.595] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.595] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.595] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0160.595] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.595] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26799cc*=0x1, dwFlags=0x0) returned 1
	[0160.595] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2679998, dwFlags=0x0) returned 1
	[0160.595] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26799dc*, pdwDataLen=0x57ff404*=0x12890, dwBufLen=0x12890 | out: pbData=0x26799dc*, pdwDataLen=0x57ff404*=0x12890) returned 1
	[0160.596] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268c278*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x268c278*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0160.596] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0160.596] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.596] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.596] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp", lpFilePart=0x0) returned 0x3a
	[0160.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0160.596] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\mittzgyinaehuqfzzt9h.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.598] GetFileType (hFile=0x47c) returned 0x1
	[0160.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0160.598] GetFileType (hFile=0x47c) returned 0x1
	[0160.598] WriteFile (in: hFile=0x47c, lpBuffer=0x26799dc*, nNumberOfBytesToWrite=0x12890, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x26799dc*, lpNumberOfBytesWritten=0x57ff3f0*=0x12890, lpOverlapped=0x0) returned 1
	[0160.600] CloseHandle (hObject=0x47c) returned 1
	[0160.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp", lpFilePart=0x0) returned 0x3a
	[0160.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0160.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0160.601] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\mittzgyinaehuqfzzt9h.odp"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d920e60, ftCreationTime.dwHighDateTime=0x1d4c8cd, ftLastAccessTime.dwLowDateTime=0x35f75dd0, ftLastAccessTime.dwHighDateTime=0x1d4c85b, ftLastWriteTime.dwLowDateTime=0x9a0eae5b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x12890)) returned 1
	[0160.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0160.601] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\mittzgyinaehuqfzzt9h.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\miTtzGYiNAehuqfzZt9h.odp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\mittzgyinaehuqfzzt9h.odp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.602] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx", lpFilePart=0x0) returned 0x34
	[0160.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0160.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\suhffqihhpl4o.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x268c6a0 | out: lpFileInformation=0x268c6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x441c51f0, ftCreationTime.dwHighDateTime=0x1d4c7e2, ftLastAccessTime.dwLowDateTime=0x6378c800, ftLastAccessTime.dwHighDateTime=0x1d4ce5c, ftLastWriteTime.dwLowDateTime=0x6378c800, ftLastWriteTime.dwHighDateTime=0x1d4ce5c, nFileSizeHigh=0x0, nFileSizeLow=0x12996)) returned 1
	[0160.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0160.602] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx", lpFilePart=0x0) returned 0x34
	[0160.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0160.602] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\suhffqihhpl4o.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.602] GetFileType (hFile=0x47c) returned 0x1
	[0160.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0160.602] GetFileType (hFile=0x47c) returned 0x1
	[0160.602] GetFileSize (in: hFile=0x47c, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x12996
	[0160.603] ReadFile (in: hFile=0x47c, lpBuffer=0x268c8d0, nNumberOfBytesToRead=0x12996, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x268c8d0*, lpNumberOfBytesRead=0x57ff3fc*=0x12996, lpOverlapped=0x0) returned 1
	[0160.604] CloseHandle (hObject=0x47c) returned 1
	[0160.604] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0160.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.604] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269f304, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b400) returned 1
	[0160.604] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.604] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.604] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0160.604] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0160.604] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x269f3bc*=0x1, dwFlags=0x0) returned 1
	[0160.604] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x269f388, dwFlags=0x0) returned 1
	[0160.604] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269f3cc*, pdwDataLen=0x57ff404*=0x129a0, dwBufLen=0x129a0 | out: pbData=0x269f3cc*, pdwDataLen=0x57ff404*=0x129a0) returned 1
	[0160.604] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b1d78*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26b1d78*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0160.604] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0160.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0160.604] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx", lpFilePart=0x0) returned 0x34
	[0160.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0160.605] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\suhffqihhpl4o.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x47c
	[0160.606] GetFileType (hFile=0x47c) returned 0x1
	[0160.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0160.606] GetFileType (hFile=0x47c) returned 0x1
	[0160.606] WriteFile (in: hFile=0x47c, lpBuffer=0x269f3cc*, nNumberOfBytesToWrite=0x129a0, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x269f3cc*, lpNumberOfBytesWritten=0x57ff3f0*=0x129a0, lpOverlapped=0x0) returned 1
	[0160.608] CloseHandle (hObject=0x47c) returned 1
	[0160.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx", lpFilePart=0x0) returned 0x34
	[0160.609] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x63
	[0160.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0160.609] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\suhffqihhpl4o.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x441c51f0, ftCreationTime.dwHighDateTime=0x1d4c7e2, ftLastAccessTime.dwLowDateTime=0x6378c800, ftLastAccessTime.dwHighDateTime=0x1d4ce5c, ftLastWriteTime.dwLowDateTime=0x9a0eae5b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x129a0)) returned 1
	[0160.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0160.609] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\suhffqihhpl4o.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\sUhFFQihHPl4O.xlsx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\suhffqihhpl4o.xlsx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0160.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp", lpFilePart=0x0) returned 0x2c
	[0160.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0160.816] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\Tdh5Gw.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\tdh5gw.odp"), fInfoLevelId=0x0, lpFileInformation=0x26b2158 | out: lpFileInformation=0x26b2158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21310e0, ftCreationTime.dwHighDateTime=0x1d4d4da, ftLastAccessTime.dwLowDateTime=0xf93222c0, ftLastAccessTime.dwHighDateTime=0x1d4c5d7, ftLastWriteTime.dwLowDateTime=0xf93222c0, ftLastWriteTime.dwHighDateTime=0x1d4c5d7, nFileSizeHigh=0x0, nFileSizeLow=0x16245)) returned 1
	[0160.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0160.868] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0160.972] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.207] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.331] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.474] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.519] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.644] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.957] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.004] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.207] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.304] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.348] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.381] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.456] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.487] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.520] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.597] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.575] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0166.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.526] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.624] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.660] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.661] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.679] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.680] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.694] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.695] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.711] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.716] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.719] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.720] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.723] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.724] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.729] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.731] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.825] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.827] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.376] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x6c
	[0168.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0168.376] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.376] GetFileType (hFile=0x318) returned 0x1
	[0168.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0168.376] GetFileType (hFile=0x318) returned 0x1
	[0168.376] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x564f
	[0168.376] ReadFile (in: hFile=0x318, lpBuffer=0x26028cc, nNumberOfBytesToRead=0x564f, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26028cc*, lpNumberOfBytesRead=0x57ff3fc*=0x564f, lpOverlapped=0x0) returned 1
	[0168.399] CloseHandle (hObject=0x318) returned 1
	[0168.399] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0168.399] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.400] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2607fb8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b040) returned 1
	[0168.400] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.400] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.400] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b200) returned 1
	[0168.400] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.400] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2608070*=0x1, dwFlags=0x0) returned 1
	[0168.400] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x260803c, dwFlags=0x0) returned 1
	[0168.400] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2608080*, pdwDataLen=0x57ff404*=0x5650, dwBufLen=0x5650 | out: pbData=0x2608080*, pdwDataLen=0x57ff404*=0x5650) returned 1
	[0168.400] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260d6dc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x260d6dc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0168.400] CryptDestroyKey (hKey=0x82b200) returned 1
	[0168.400] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.400] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x6c
	[0168.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0168.400] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.405] GetFileType (hFile=0x318) returned 0x1
	[0168.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0168.405] GetFileType (hFile=0x318) returned 0x1
	[0168.405] WriteFile (in: hFile=0x318, lpBuffer=0x2608080*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x57ff3f0, lpOverlapped=0x0 | out: lpBuffer=0x2608080*, lpNumberOfBytesWritten=0x57ff3f0*=0x5650, lpOverlapped=0x0) returned 1
	[0168.406] CloseHandle (hObject=0x318) returned 1
	[0168.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x6c
	[0168.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9b
	[0168.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0168.406] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9eb5f01a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5650)) returned 1
	[0168.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0168.407] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0168.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash", lpFilePart=0x0) returned 0x5e
	[0168.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0168.407] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash"), fInfoLevelId=0x0, lpFileInformation=0x260dcfc | out: lpFileInformation=0x260dcfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66)) returned 1
	[0168.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0171.139] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.176] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.260] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.273] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.275] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.276] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.291] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.292] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.294] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.296] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.298] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.299] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.301] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.303] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.363] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.364] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.366] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.366] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.502] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.639] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.640] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.640] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.654] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.685] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.686] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.721] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.731] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.734] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.735] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.737] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.738] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.740] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.741] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.752] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.753] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.755] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.756] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.758] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.759] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.852] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.910] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0171.975] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.039] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.167] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.201] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.247] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.328] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.334] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.451] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.472] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.476] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.495] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.497] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.500] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.540] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.543] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.545] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.575] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.598] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.666] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.737] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.741] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.852] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.904] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0172.960] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.104] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.148] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.202] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.326] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.327] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.351] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.357] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.453] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.470] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.473] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.474] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.478] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.481] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.485] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.486] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.487] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.488] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.491] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.492] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.540] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.616] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.617] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0173.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.364] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.376] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.443] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.444] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.446] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.447] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.448] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.449] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.451] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.452] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.459] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.517] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.518] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.519] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.520] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.527] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.575] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.587] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.596] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.643] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.716] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.854] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.911] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0174.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.012] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.039] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.040] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.042] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.044] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.046] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.047] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.049] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.051] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.052] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.054] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.058] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.060] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.063] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.064] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.067] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.070] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.071] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.074] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.075] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.077] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.079] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.081] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.082] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.085] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.086] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.088] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.090] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.092] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.093] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.095] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.096] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.101] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.102] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.106] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.107] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.109] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.110] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.112] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.234] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.434] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.527] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.780] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.932] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.970] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.973] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.975] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.978] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.982] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.985] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.986] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.988] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.990] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0175.994] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.034] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.090] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.137] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.246] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.349] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.377] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.378] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.380] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.480] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.527] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0176.668] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.256] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.319] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.381] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.421] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.442] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.446] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.447] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.510] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.631] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.694] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0177.697] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.657] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.718] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.772] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.773] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.777] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.779] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.782] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.783] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.791] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.793] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.796] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.797] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.800] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.801] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.806] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.814] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0179.817] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.274] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.276] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.278] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.279] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.280] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.283] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.285] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.286] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.290] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.292] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.293] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.295] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.296] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.300] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.302] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.366] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.396] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.497] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.533] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.546] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.547] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.550] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.551] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.553] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.553] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.555] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.556] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.560] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.587] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.588] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.595] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.598] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.599] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.601] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.601] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.603] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.604] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.607] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.608] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.610] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.611] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.614] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.616] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.617] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.625] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.626] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0180.628] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.061] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.105] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.162] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.178] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.179] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.183] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.184] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.189] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.198] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.207] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.208] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.212] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.213] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.234] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.235] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.256] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.258] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.259] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.264] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.265] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.269] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.270] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.278] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.279] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.284] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.285] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.290] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.293] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.295] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.295] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.300] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.301] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.306] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.307] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.317] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.615] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.629] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.641] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.642] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.646] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.647] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.660] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.661] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.673] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.675] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.680] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.681] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.685] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.699] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.704] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.705] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.709] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.710] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.715] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.716] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.735] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.743] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.744] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.749] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.750] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.754] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.755] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.760] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.761] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.818] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.904] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.909] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.910] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.915] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.916] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.920] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.921] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.926] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.927] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.931] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.932] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.942] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.943] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.134] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.198] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.243] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.253] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.254] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.262] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.262] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.269] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.270] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.275] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.276] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.281] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.286] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.287] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.314] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.931] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.937] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.945] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.946] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.968] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.976] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.983] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.010] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.023] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.027] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.045] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.106] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.128] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.130] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.293] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.323] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.398] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.461] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.472] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.479] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.511] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.512] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.524] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.524] GetFileType (hFile=0x318) returned 0x1
	[0183.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.524] GetFileType (hFile=0x318) returned 0x1
	[0183.524] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2da
	[0183.524] ReadFile (in: hFile=0x318, lpBuffer=0x266ed0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x266ed0c*, lpNumberOfBytesRead=0x57ff3fc*=0x2da, lpOverlapped=0x0) returned 1
	[0183.526] CloseHandle (hObject=0x318) returned 1
	[0183.526] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0183.526] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.526] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266fda8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0183.526] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.526] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.526] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0183.526] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.527] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x266fe60*=0x1, dwFlags=0x0) returned 1
	[0183.527] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x266fe2c, dwFlags=0x0) returned 1
	[0183.527] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266fe70*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x266fe70*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0183.527] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267015c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x267015c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.527] CryptDestroyKey (hKey=0x82b480) returned 1
	[0183.527] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.527] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.527] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.527] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.529] GetFileType (hFile=0x318) returned 0x1
	[0183.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.529] GetFileType (hFile=0x318) returned 0x1
	[0183.529] WriteFile (in: hFile=0x318, lpBuffer=0x26703d0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26703d0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.530] CloseHandle (hObject=0x318) returned 1
	[0183.530] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.530] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0183.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.530] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7b93f5c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.530] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.531] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.532] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2671a18 | out: lpFileInformation=0x2671a18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2df)) returned 1
	[0183.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.532] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.532] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.532] GetFileType (hFile=0x318) returned 0x1
	[0183.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.532] GetFileType (hFile=0x318) returned 0x1
	[0183.532] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2df
	[0183.532] ReadFile (in: hFile=0x318, lpBuffer=0x26721d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26721d4*, lpNumberOfBytesRead=0x57ff3fc*=0x2df, lpOverlapped=0x0) returned 1
	[0183.534] CloseHandle (hObject=0x318) returned 1
	[0183.534] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.534] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2673270, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0183.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.534] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0183.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.534] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2673328*=0x1, dwFlags=0x0) returned 1
	[0183.534] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26732f4, dwFlags=0x0) returned 1
	[0183.534] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2673338*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2673338*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0183.535] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2673624*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2673624*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.535] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0183.535] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.535] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.535] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.535] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.536] GetFileType (hFile=0x318) returned 0x1
	[0183.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.536] GetFileType (hFile=0x318) returned 0x1
	[0183.536] WriteFile (in: hFile=0x318, lpBuffer=0x2673898*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2673898*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.537] CloseHandle (hObject=0x318) returned 1
	[0183.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0183.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0183.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.537] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7b93f5c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.538] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.539] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.539] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2674ee0 | out: lpFileInformation=0x2674ee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0183.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.540] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.540] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.540] GetFileType (hFile=0x318) returned 0x1
	[0183.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.540] GetFileType (hFile=0x318) returned 0x1
	[0183.540] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1e0
	[0183.540] ReadFile (in: hFile=0x318, lpBuffer=0x26754ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26754ec*, lpNumberOfBytesRead=0x57ff3fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0183.541] CloseHandle (hObject=0x318) returned 1
	[0183.541] CryptDestroyKey (hKey=0x82b340) returned 1
	[0183.541] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.542] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2676588, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b380) returned 1
	[0183.542] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.542] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.542] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0183.542] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.542] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2676640*=0x1, dwFlags=0x0) returned 1
	[0183.542] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x267660c, dwFlags=0x0) returned 1
	[0183.542] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2676650*, pdwDataLen=0x57ff404*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x2676650*, pdwDataLen=0x57ff404*=0x1f0) returned 1
	[0183.542] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267684c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x267684c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.542] CryptDestroyKey (hKey=0x82b280) returned 1
	[0183.542] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.542] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.542] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.542] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.544] GetFileType (hFile=0x318) returned 0x1
	[0183.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.544] GetFileType (hFile=0x318) returned 0x1
	[0183.544] WriteFile (in: hFile=0x318, lpBuffer=0x2676a68*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2676a68*, lpNumberOfBytesWritten=0x57ff3c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0183.545] CloseHandle (hObject=0x318) returned 1
	[0183.545] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0183.545] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0183.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.545] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7bba0cd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0183.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.546] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.559] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0183.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.559] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x267800c | out: lpFileInformation=0x267800c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353)) returned 1
	[0183.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.560] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0183.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.560] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.560] GetFileType (hFile=0x318) returned 0x1
	[0183.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.560] GetFileType (hFile=0x318) returned 0x1
	[0183.560] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x353
	[0183.560] ReadFile (in: hFile=0x318, lpBuffer=0x267882c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x267882c*, lpNumberOfBytesRead=0x57ff3fc*=0x353, lpOverlapped=0x0) returned 1
	[0183.562] CloseHandle (hObject=0x318) returned 1
	[0183.562] CryptDestroyKey (hKey=0x82b380) returned 1
	[0183.562] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.562] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26798c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0183.562] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.562] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.562] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b380) returned 1
	[0183.562] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.562] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2679980*=0x1, dwFlags=0x0) returned 1
	[0183.563] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x267994c, dwFlags=0x0) returned 1
	[0183.563] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2679990*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x2679990*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0183.563] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2679cfc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2679cfc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.563] CryptDestroyKey (hKey=0x82b380) returned 1
	[0183.563] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.563] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.563] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0183.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.563] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.564] GetFileType (hFile=0x318) returned 0x1
	[0183.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.564] GetFileType (hFile=0x318) returned 0x1
	[0183.564] WriteFile (in: hFile=0x318, lpBuffer=0x2679f68*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2679f68*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0183.565] CloseHandle (hObject=0x318) returned 1
	[0183.566] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0183.566] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd2
	[0183.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.566] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7be03b8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0183.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.566] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.567] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.567] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x267b5ac | out: lpFileInformation=0x267b5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf)) returned 1
	[0183.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.567] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.568] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.568] GetFileType (hFile=0x318) returned 0x1
	[0183.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.568] GetFileType (hFile=0x318) returned 0x1
	[0183.568] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2bf
	[0183.568] ReadFile (in: hFile=0x318, lpBuffer=0x267bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x267bd08*, lpNumberOfBytesRead=0x57ff3fc*=0x2bf, lpOverlapped=0x0) returned 1
	[0183.588] CloseHandle (hObject=0x318) returned 1
	[0183.588] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.588] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.588] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267cda4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0183.588] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.588] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.588] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0183.588] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.588] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x267ce5c*=0x1, dwFlags=0x0) returned 1
	[0183.588] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x267ce28, dwFlags=0x0) returned 1
	[0183.588] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267ce6c*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x267ce6c*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0183.588] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267d138*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x267d138*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.589] CryptDestroyKey (hKey=0x82b280) returned 1
	[0183.589] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.589] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.589] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.589] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.590] GetFileType (hFile=0x318) returned 0x1
	[0183.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.590] GetFileType (hFile=0x318) returned 0x1
	[0183.590] WriteFile (in: hFile=0x318, lpBuffer=0x267d38c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x267d38c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0183.591] CloseHandle (hObject=0x318) returned 1
	[0183.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.592] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0183.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.592] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7c2c8e7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0183.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.592] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.593] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.593] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x267e9a0 | out: lpFileInformation=0x267e9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e)) returned 1
	[0183.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.594] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.594] GetFileType (hFile=0x318) returned 0x1
	[0183.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.594] GetFileType (hFile=0x318) returned 0x1
	[0183.594] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x28e
	[0183.594] ReadFile (in: hFile=0x318, lpBuffer=0x267f0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x267f0cc*, lpNumberOfBytesRead=0x57ff3fc*=0x28e, lpOverlapped=0x0) returned 1
	[0183.596] CloseHandle (hObject=0x318) returned 1
	[0183.596] CryptDestroyKey (hKey=0x82b340) returned 1
	[0183.596] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.596] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2680168, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0183.596] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.596] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.596] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0183.596] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.596] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2680220*=0x1, dwFlags=0x0) returned 1
	[0183.596] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26801ec, dwFlags=0x0) returned 1
	[0183.596] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2680230*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x2680230*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0183.596] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26804cc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26804cc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.597] CryptDestroyKey (hKey=0x82b540) returned 1
	[0183.597] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.597] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.597] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.597] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.598] GetFileType (hFile=0x318) returned 0x1
	[0183.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.598] GetFileType (hFile=0x318) returned 0x1
	[0183.598] WriteFile (in: hFile=0x318, lpBuffer=0x2680720*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2680720*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0183.599] CloseHandle (hObject=0x318) returned 1
	[0183.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0183.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.600] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7c2c8e7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0183.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.600] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0183.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.601] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2681d34 | out: lpFileInformation=0x2681d34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9)) returned 1
	[0183.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0183.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.602] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.602] GetFileType (hFile=0x318) returned 0x1
	[0183.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.602] GetFileType (hFile=0x318) returned 0x1
	[0183.602] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d9
	[0183.602] ReadFile (in: hFile=0x318, lpBuffer=0x26824dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26824dc*, lpNumberOfBytesRead=0x57ff3fc*=0x2d9, lpOverlapped=0x0) returned 1
	[0183.653] CloseHandle (hObject=0x318) returned 1
	[0183.653] CryptDestroyKey (hKey=0x82b280) returned 1
	[0183.653] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.653] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2683578, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0183.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.653] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0183.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.653] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2683630*=0x1, dwFlags=0x0) returned 1
	[0183.653] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26835fc, dwFlags=0x0) returned 1
	[0183.653] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2683640*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2683640*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0183.653] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268392c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x268392c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.653] CryptDestroyKey (hKey=0x82b280) returned 1
	[0183.653] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.653] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.653] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0183.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.654] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.655] GetFileType (hFile=0x318) returned 0x1
	[0183.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.655] GetFileType (hFile=0x318) returned 0x1
	[0183.655] WriteFile (in: hFile=0x318, lpBuffer=0x2683b98*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2683b98*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.657] CloseHandle (hObject=0x318) returned 1
	[0183.657] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0183.657] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0183.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.657] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7cc52f7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0183.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.657] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.659] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.659] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26851d0 | out: lpFileInformation=0x26851d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b)) returned 1
	[0183.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.659] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.659] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.660] GetFileType (hFile=0x318) returned 0x1
	[0183.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.660] GetFileType (hFile=0x318) returned 0x1
	[0183.660] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x28b
	[0183.660] ReadFile (in: hFile=0x318, lpBuffer=0x26858f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26858f8*, lpNumberOfBytesRead=0x57ff3fc*=0x28b, lpOverlapped=0x0) returned 1
	[0183.661] CloseHandle (hObject=0x318) returned 1
	[0183.662] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.662] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.662] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2686994, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0183.662] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.662] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.662] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b000) returned 1
	[0183.662] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.662] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2686a4c*=0x1, dwFlags=0x0) returned 1
	[0183.662] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2686a18, dwFlags=0x0) returned 1
	[0183.662] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2686a5c*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x2686a5c*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0183.662] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2686cf8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2686cf8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.662] CryptDestroyKey (hKey=0x82b000) returned 1
	[0183.662] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.662] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.662] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.662] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.664] GetFileType (hFile=0x318) returned 0x1
	[0183.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.664] GetFileType (hFile=0x318) returned 0x1
	[0183.664] WriteFile (in: hFile=0x318, lpBuffer=0x2686f4c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2686f4c*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0183.665] CloseHandle (hObject=0x318) returned 1
	[0183.665] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.665] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0183.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.665] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7cc52f7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0183.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.666] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.667] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2688554 | out: lpFileInformation=0x2688554*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a)) returned 1
	[0183.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.667] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.667] GetFileType (hFile=0x318) returned 0x1
	[0183.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.668] GetFileType (hFile=0x318) returned 0x1
	[0183.668] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x28a
	[0183.668] ReadFile (in: hFile=0x318, lpBuffer=0x2688c7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2688c7c*, lpNumberOfBytesRead=0x57ff3fc*=0x28a, lpOverlapped=0x0) returned 1
	[0183.669] CloseHandle (hObject=0x318) returned 1
	[0183.669] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.669] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.669] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2689d18, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0183.670] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.670] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.670] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0183.670] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.670] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2689dd0*=0x1, dwFlags=0x0) returned 1
	[0183.670] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2689d9c, dwFlags=0x0) returned 1
	[0183.670] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2689de0*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x2689de0*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0183.670] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268a07c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x268a07c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.670] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0183.670] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.670] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.670] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.670] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.671] GetFileType (hFile=0x318) returned 0x1
	[0183.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.672] GetFileType (hFile=0x318) returned 0x1
	[0183.672] WriteFile (in: hFile=0x318, lpBuffer=0x268a2d0*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x268a2d0*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0183.673] CloseHandle (hObject=0x318) returned 1
	[0183.673] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.673] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0183.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.673] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7ceb517, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0183.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.673] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.674] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.674] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x268b8d8 | out: lpFileInformation=0x268b8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0183.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.675] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.675] GetFileType (hFile=0x318) returned 0x1
	[0183.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.675] GetFileType (hFile=0x318) returned 0x1
	[0183.675] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c8
	[0183.675] ReadFile (in: hFile=0x318, lpBuffer=0x268c03c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x268c03c*, lpNumberOfBytesRead=0x57ff3fc*=0x2c8, lpOverlapped=0x0) returned 1
	[0183.690] CloseHandle (hObject=0x318) returned 1
	[0183.690] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.690] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.690] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268d0d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0183.691] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.691] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.691] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0183.691] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.691] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x268d190*=0x1, dwFlags=0x0) returned 1
	[0183.691] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x268d15c, dwFlags=0x0) returned 1
	[0183.691] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268d1a0*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x268d1a0*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0183.691] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268d47c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x268d47c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.691] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.691] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.691] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.691] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.691] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.693] GetFileType (hFile=0x318) returned 0x1
	[0183.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.693] GetFileType (hFile=0x318) returned 0x1
	[0183.693] WriteFile (in: hFile=0x318, lpBuffer=0x268d6d0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x268d6d0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.694] CloseHandle (hObject=0x318) returned 1
	[0183.694] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.694] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0183.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.694] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7d116c7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.694] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.696] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.696] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x268ecd8 | out: lpFileInformation=0x268ecd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be)) returned 1
	[0183.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.697] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.697] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.697] GetFileType (hFile=0x318) returned 0x1
	[0183.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.697] GetFileType (hFile=0x318) returned 0x1
	[0183.697] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2be
	[0183.697] ReadFile (in: hFile=0x318, lpBuffer=0x268f434, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x268f434*, lpNumberOfBytesRead=0x57ff3fc*=0x2be, lpOverlapped=0x0) returned 1
	[0183.703] CloseHandle (hObject=0x318) returned 1
	[0183.703] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0183.703] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.704] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26904d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0183.704] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.704] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.704] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b200) returned 1
	[0183.704] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.704] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2690588*=0x1, dwFlags=0x0) returned 1
	[0183.704] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2690554, dwFlags=0x0) returned 1
	[0183.704] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2690598*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x2690598*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0183.704] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690864*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2690864*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.704] CryptDestroyKey (hKey=0x82b200) returned 1
	[0183.704] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.704] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.704] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.706] GetFileType (hFile=0x318) returned 0x1
	[0183.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.706] GetFileType (hFile=0x318) returned 0x1
	[0183.706] WriteFile (in: hFile=0x318, lpBuffer=0x2690ab8*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2690ab8*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0183.711] CloseHandle (hObject=0x318) returned 1
	[0183.711] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.711] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0183.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.711] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7d37847, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0183.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.711] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.714] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26920c0 | out: lpFileInformation=0x26920c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0183.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.714] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.714] GetFileType (hFile=0x318) returned 0x1
	[0183.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.715] GetFileType (hFile=0x318) returned 0x1
	[0183.715] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cd
	[0183.715] ReadFile (in: hFile=0x318, lpBuffer=0x269282c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x269282c*, lpNumberOfBytesRead=0x57ff3fc*=0x2cd, lpOverlapped=0x0) returned 1
	[0183.716] CloseHandle (hObject=0x318) returned 1
	[0183.717] CryptDestroyKey (hKey=0x82b540) returned 1
	[0183.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.717] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26938c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0183.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.717] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0183.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.717] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2693980*=0x1, dwFlags=0x0) returned 1
	[0183.717] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x269394c, dwFlags=0x0) returned 1
	[0183.717] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2693990*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2693990*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0183.717] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2693c6c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2693c6c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.717] CryptDestroyKey (hKey=0x82b480) returned 1
	[0183.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.717] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.717] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.719] GetFileType (hFile=0x318) returned 0x1
	[0183.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.719] GetFileType (hFile=0x318) returned 0x1
	[0183.719] WriteFile (in: hFile=0x318, lpBuffer=0x2693ec0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2693ec0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.720] CloseHandle (hObject=0x318) returned 1
	[0183.720] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0183.720] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0183.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.720] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7d5dc20, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.721] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.722] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26954c8 | out: lpFileInformation=0x26954c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a)) returned 1
	[0183.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.722] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.722] GetFileType (hFile=0x318) returned 0x1
	[0183.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.722] GetFileType (hFile=0x318) returned 0x1
	[0183.723] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x28a
	[0183.723] ReadFile (in: hFile=0x318, lpBuffer=0x2695be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2695be0*, lpNumberOfBytesRead=0x57ff3fc*=0x28a, lpOverlapped=0x0) returned 1
	[0183.724] CloseHandle (hObject=0x318) returned 1
	[0183.724] CryptDestroyKey (hKey=0x82b540) returned 1
	[0183.725] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.725] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2696c7c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b000) returned 1
	[0183.725] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.725] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.725] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b2c0) returned 1
	[0183.725] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.725] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2696d34*=0x1, dwFlags=0x0) returned 1
	[0183.725] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2696d00, dwFlags=0x0) returned 1
	[0183.725] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2696d44*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x2696d44*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0183.725] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2696fe0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2696fe0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.725] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0183.725] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.725] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.725] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.728] GetFileType (hFile=0x318) returned 0x1
	[0183.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.728] GetFileType (hFile=0x318) returned 0x1
	[0183.728] WriteFile (in: hFile=0x318, lpBuffer=0x269722c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x269722c*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0183.729] CloseHandle (hObject=0x318) returned 1
	[0183.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0183.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.729] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7d83df0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0183.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.730] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.731] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.731] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2698830 | out: lpFileInformation=0x2698830*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x289)) returned 1
	[0183.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.731] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.732] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.732] GetFileType (hFile=0x318) returned 0x1
	[0183.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.732] GetFileType (hFile=0x318) returned 0x1
	[0183.732] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x289
	[0183.732] ReadFile (in: hFile=0x318, lpBuffer=0x2698f48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2698f48*, lpNumberOfBytesRead=0x57ff3fc*=0x289, lpOverlapped=0x0) returned 1
	[0183.733] CloseHandle (hObject=0x318) returned 1
	[0183.734] CryptDestroyKey (hKey=0x82b000) returned 1
	[0183.734] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.734] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2699fe4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0183.734] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.734] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.734] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b000) returned 1
	[0183.734] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.734] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x269a09c*=0x1, dwFlags=0x0) returned 1
	[0183.734] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x269a068, dwFlags=0x0) returned 1
	[0183.734] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269a0ac*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x269a0ac*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0183.734] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269a348*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x269a348*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.734] CryptDestroyKey (hKey=0x82b000) returned 1
	[0183.734] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.734] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.734] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.734] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.736] GetFileType (hFile=0x318) returned 0x1
	[0183.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.736] GetFileType (hFile=0x318) returned 0x1
	[0183.736] WriteFile (in: hFile=0x318, lpBuffer=0x269a594*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x269a594*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0183.737] CloseHandle (hObject=0x318) returned 1
	[0183.737] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0183.737] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0183.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.737] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7d83df0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0183.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.738] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0183.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.739] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x269bb98 | out: lpFileInformation=0x269bb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282)) returned 1
	[0183.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0183.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.739] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.739] GetFileType (hFile=0x318) returned 0x1
	[0183.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0183.740] GetFileType (hFile=0x318) returned 0x1
	[0183.740] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x282
	[0183.740] ReadFile (in: hFile=0x318, lpBuffer=0x269c2c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x269c2c8*, lpNumberOfBytesRead=0x57ff3fc*=0x282, lpOverlapped=0x0) returned 1
	[0183.741] CloseHandle (hObject=0x318) returned 1
	[0183.741] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0183.741] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.741] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269d364, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0183.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.742] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0183.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.742] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x269d41c*=0x1, dwFlags=0x0) returned 1
	[0183.742] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x269d3e8, dwFlags=0x0) returned 1
	[0183.742] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269d42c*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x269d42c*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0183.742] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269d6c8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x269d6c8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.742] CryptDestroyKey (hKey=0x82b280) returned 1
	[0183.742] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.742] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.742] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0183.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.742] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.744] GetFileType (hFile=0x318) returned 0x1
	[0183.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.744] GetFileType (hFile=0x318) returned 0x1
	[0183.744] WriteFile (in: hFile=0x318, lpBuffer=0x269d924*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x269d924*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0183.745] CloseHandle (hObject=0x318) returned 1
	[0183.745] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0183.745] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0183.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.745] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7daa47d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0183.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.746] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.747] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x269ef48 | out: lpFileInformation=0x269ef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0183.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0183.747] ReadFile (in: hFile=0x318, lpBuffer=0x269f6b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x269f6b0*, lpNumberOfBytesRead=0x57ff3fc*=0x2cb, lpOverlapped=0x0) returned 1
	[0183.772] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0183.772] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.772] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a074c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b440) returned 1
	[0183.772] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.772] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.772] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0183.772] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0183.772] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26a0804*=0x1, dwFlags=0x0) returned 1
	[0183.772] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26a07d0, dwFlags=0x0) returned 1
	[0183.772] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a0814*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26a0814*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0183.773] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a0af0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26a0af0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0183.773] CryptDestroyKey (hKey=0x82b280) returned 1
	[0183.773] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.773] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0183.773] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0183.773] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0183.774] GetFileType (hFile=0x318) returned 0x1
	[0183.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0183.774] GetFileType (hFile=0x318) returned 0x1
	[0183.774] WriteFile (in: hFile=0x318, lpBuffer=0x26a0d44*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26a0d44*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0183.775] CloseHandle (hObject=0x318) returned 1
	[0183.775] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.776] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0183.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0183.776] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa7df6543, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0183.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0183.776] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0183.777] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0183.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0183.777] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26a2358 | out: lpFileInformation=0x26a2358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0183.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0183.817] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.916] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.985] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.040] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.075] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.103] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.149] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.179] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.180] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.242] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.305] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.365] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.365] GetFileType (hFile=0x318) returned 0x1
	[0184.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.365] GetFileType (hFile=0x318) returned 0x1
	[0184.365] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1cc
	[0184.365] ReadFile (in: hFile=0x318, lpBuffer=0x272a490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x272a490*, lpNumberOfBytesRead=0x57ff3fc*=0x1cc, lpOverlapped=0x0) returned 1
	[0184.366] CloseHandle (hObject=0x318) returned 1
	[0184.367] CryptDestroyKey (hKey=0x82b340) returned 1
	[0184.367] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.367] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272b52c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0184.367] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.367] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.367] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b200) returned 1
	[0184.367] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.367] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x272b5e4*=0x1, dwFlags=0x0) returned 1
	[0184.367] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x272b5b0, dwFlags=0x0) returned 1
	[0184.367] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272b5f4*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x272b5f4*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0184.367] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272b7d0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x272b7d0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.367] CryptDestroyKey (hKey=0x82b200) returned 1
	[0184.367] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.367] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.367] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.367] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.369] GetFileType (hFile=0x318) returned 0x1
	[0184.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.369] GetFileType (hFile=0x318) returned 0x1
	[0184.369] WriteFile (in: hFile=0x318, lpBuffer=0x272b9ec*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x272b9ec*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0184.370] CloseHandle (hObject=0x318) returned 1
	[0184.370] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.370] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0184.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.370] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa83a05b1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0184.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.370] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.372] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.372] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x272cf90 | out: lpFileInformation=0x272cf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0184.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.372] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.372] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.372] GetFileType (hFile=0x318) returned 0x1
	[0184.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.373] GetFileType (hFile=0x318) returned 0x1
	[0184.373] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cd
	[0184.373] ReadFile (in: hFile=0x318, lpBuffer=0x272d70c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x272d70c*, lpNumberOfBytesRead=0x57ff3fc*=0x2cd, lpOverlapped=0x0) returned 1
	[0184.374] CloseHandle (hObject=0x318) returned 1
	[0184.374] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.374] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.374] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272e7a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0184.374] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.374] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.374] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b340) returned 1
	[0184.374] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.374] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x272e860*=0x1, dwFlags=0x0) returned 1
	[0184.375] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x272e82c, dwFlags=0x0) returned 1
	[0184.375] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272e870*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x272e870*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0184.375] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272eb4c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x272eb4c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.375] CryptDestroyKey (hKey=0x82b340) returned 1
	[0184.375] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.375] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.375] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.375] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.376] GetFileType (hFile=0x318) returned 0x1
	[0184.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.376] GetFileType (hFile=0x318) returned 0x1
	[0184.376] WriteFile (in: hFile=0x318, lpBuffer=0x272eda8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x272eda8*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.377] CloseHandle (hObject=0x318) returned 1
	[0184.377] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.377] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0184.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.377] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa83a05b1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.378] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.378] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.378] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27303cc | out: lpFileInformation=0x27303cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0184.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.379] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.379] GetFileType (hFile=0x318) returned 0x1
	[0184.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.379] GetFileType (hFile=0x318) returned 0x1
	[0184.379] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1e0
	[0184.379] ReadFile (in: hFile=0x318, lpBuffer=0x27309d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27309d8*, lpNumberOfBytesRead=0x57ff3fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0184.380] CloseHandle (hObject=0x318) returned 1
	[0184.380] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.380] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.380] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2731a74, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b2c0) returned 1
	[0184.380] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.380] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.380] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b040) returned 1
	[0184.380] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.381] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2731b2c*=0x1, dwFlags=0x0) returned 1
	[0184.381] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2731af8, dwFlags=0x0) returned 1
	[0184.381] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2731b3c*, pdwDataLen=0x57ff404*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x2731b3c*, pdwDataLen=0x57ff404*=0x1f0) returned 1
	[0184.381] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2731d38*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2731d38*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.381] CryptDestroyKey (hKey=0x82b040) returned 1
	[0184.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.381] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.382] GetFileType (hFile=0x318) returned 0x1
	[0184.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.382] GetFileType (hFile=0x318) returned 0x1
	[0184.382] WriteFile (in: hFile=0x318, lpBuffer=0x2731f54*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2731f54*, lpNumberOfBytesWritten=0x57ff3c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0184.383] CloseHandle (hObject=0x318) returned 1
	[0184.383] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0184.383] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0184.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.383] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa83a05b1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0184.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.383] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.407] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27334f8 | out: lpFileInformation=0x27334f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283)) returned 1
	[0184.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.407] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.407] GetFileType (hFile=0x318) returned 0x1
	[0184.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.408] GetFileType (hFile=0x318) returned 0x1
	[0184.408] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x283
	[0184.408] ReadFile (in: hFile=0x318, lpBuffer=0x2733bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2733bf8*, lpNumberOfBytesRead=0x57ff3fc*=0x283, lpOverlapped=0x0) returned 1
	[0184.424] CloseHandle (hObject=0x318) returned 1
	[0184.424] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0184.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.424] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2734c94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0184.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.424] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b200) returned 1
	[0184.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.424] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2734d4c*=0x1, dwFlags=0x0) returned 1
	[0184.424] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2734d18, dwFlags=0x0) returned 1
	[0184.424] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2734d5c*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x2734d5c*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0184.424] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2734ff8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2734ff8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.424] CryptDestroyKey (hKey=0x82b200) returned 1
	[0184.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.424] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.425] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.426] GetFileType (hFile=0x318) returned 0x1
	[0184.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.426] GetFileType (hFile=0x318) returned 0x1
	[0184.426] WriteFile (in: hFile=0x318, lpBuffer=0x273523c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x273523c*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0184.427] CloseHandle (hObject=0x318) returned 1
	[0184.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0184.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.427] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa841255b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0184.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.427] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.428] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.428] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2736824 | out: lpFileInformation=0x2736824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287)) returned 1
	[0184.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.429] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.429] GetFileType (hFile=0x318) returned 0x1
	[0184.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.429] GetFileType (hFile=0x318) returned 0x1
	[0184.429] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x287
	[0184.429] ReadFile (in: hFile=0x318, lpBuffer=0x2736f28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2736f28*, lpNumberOfBytesRead=0x57ff3fc*=0x287, lpOverlapped=0x0) returned 1
	[0184.430] CloseHandle (hObject=0x318) returned 1
	[0184.430] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.430] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.431] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2737fc4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b5c0) returned 1
	[0184.431] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.431] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.431] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0184.431] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.431] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x273807c*=0x1, dwFlags=0x0) returned 1
	[0184.431] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2738048, dwFlags=0x0) returned 1
	[0184.451] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273808c*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x273808c*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0184.451] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2738328*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2738328*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.451] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.451] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.451] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.451] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.451] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.452] GetFileType (hFile=0x318) returned 0x1
	[0184.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.452] GetFileType (hFile=0x318) returned 0x1
	[0184.452] WriteFile (in: hFile=0x318, lpBuffer=0x273856c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x273856c*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0184.453] CloseHandle (hObject=0x318) returned 1
	[0184.453] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.453] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0184.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.454] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa845e9d1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0184.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.454] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.455] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.455] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2739b54 | out: lpFileInformation=0x2739b54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x313)) returned 1
	[0184.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.456] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.456] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.456] GetFileType (hFile=0x318) returned 0x1
	[0184.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.456] GetFileType (hFile=0x318) returned 0x1
	[0184.456] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x313
	[0184.456] ReadFile (in: hFile=0x318, lpBuffer=0x273a2f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x273a2f4*, lpNumberOfBytesRead=0x57ff3fc*=0x313, lpOverlapped=0x0) returned 1
	[0184.457] CloseHandle (hObject=0x318) returned 1
	[0184.458] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0184.458] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.458] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273b390, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0184.458] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.458] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.458] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0184.458] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.458] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x273b448*=0x1, dwFlags=0x0) returned 1
	[0184.458] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x273b414, dwFlags=0x0) returned 1
	[0184.458] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273b458*, pdwDataLen=0x57ff404*=0x320, dwBufLen=0x320 | out: pbData=0x273b458*, pdwDataLen=0x57ff404*=0x320) returned 1
	[0184.458] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273b784*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x273b784*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.458] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0184.458] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.458] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.458] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.459] GetFileType (hFile=0x318) returned 0x1
	[0184.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.459] GetFileType (hFile=0x318) returned 0x1
	[0184.460] WriteFile (in: hFile=0x318, lpBuffer=0x273b9d0*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x273b9d0*, lpNumberOfBytesWritten=0x57ff3c4*=0x320, lpOverlapped=0x0) returned 1
	[0184.460] CloseHandle (hObject=0x318) returned 1
	[0184.460] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.461] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0184.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.461] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa845e9d1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1
	[0184.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.461] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.462] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.462] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x273cfd4 | out: lpFileInformation=0x273cfd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fb)) returned 1
	[0184.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.462] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.463] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.463] GetFileType (hFile=0x318) returned 0x1
	[0184.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.463] GetFileType (hFile=0x318) returned 0x1
	[0184.463] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2fb
	[0184.463] ReadFile (in: hFile=0x318, lpBuffer=0x273d75c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x273d75c*, lpNumberOfBytesRead=0x57ff3fc*=0x2fb, lpOverlapped=0x0) returned 1
	[0184.465] CloseHandle (hObject=0x318) returned 1
	[0184.465] CryptDestroyKey (hKey=0x82b340) returned 1
	[0184.465] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.465] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273e7f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b380) returned 1
	[0184.465] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.465] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.465] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0184.465] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.465] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x273e8b0*=0x1, dwFlags=0x0) returned 1
	[0184.465] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x273e87c, dwFlags=0x0) returned 1
	[0184.465] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273e8c0*, pdwDataLen=0x57ff404*=0x300, dwBufLen=0x300 | out: pbData=0x273e8c0*, pdwDataLen=0x57ff404*=0x300) returned 1
	[0184.465] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273ebcc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x273ebcc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.465] CryptDestroyKey (hKey=0x82b280) returned 1
	[0184.465] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.465] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.465] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.466] GetFileType (hFile=0x318) returned 0x1
	[0184.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.467] GetFileType (hFile=0x318) returned 0x1
	[0184.467] WriteFile (in: hFile=0x318, lpBuffer=0x273ee18*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x273ee18*, lpNumberOfBytesWritten=0x57ff3c4*=0x300, lpOverlapped=0x0) returned 1
	[0184.467] CloseHandle (hObject=0x318) returned 1
	[0184.467] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0184.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.468] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa84887bf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x300)) returned 1
	[0184.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.468] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.469] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x274041c | out: lpFileInformation=0x274041c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e4)) returned 1
	[0184.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.469] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.469] GetFileType (hFile=0x318) returned 0x1
	[0184.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.469] GetFileType (hFile=0x318) returned 0x1
	[0184.469] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2e4
	[0184.470] ReadFile (in: hFile=0x318, lpBuffer=0x2740bac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2740bac*, lpNumberOfBytesRead=0x57ff3fc*=0x2e4, lpOverlapped=0x0) returned 1
	[0184.471] CloseHandle (hObject=0x318) returned 1
	[0184.471] CryptDestroyKey (hKey=0x82b380) returned 1
	[0184.471] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.471] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2741c48, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0184.471] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.471] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.471] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0184.471] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.471] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2741d00*=0x1, dwFlags=0x0) returned 1
	[0184.471] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2741ccc, dwFlags=0x0) returned 1
	[0184.471] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2741d10*, pdwDataLen=0x57ff404*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x2741d10*, pdwDataLen=0x57ff404*=0x2f0) returned 1
	[0184.472] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274200c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x274200c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.472] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0184.472] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.472] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.472] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.472] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.473] GetFileType (hFile=0x318) returned 0x1
	[0184.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.473] GetFileType (hFile=0x318) returned 0x1
	[0184.473] WriteFile (in: hFile=0x318, lpBuffer=0x2742268*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2742268*, lpNumberOfBytesWritten=0x57ff3c4*=0x2f0, lpOverlapped=0x0) returned 1
	[0184.474] CloseHandle (hObject=0x318) returned 1
	[0184.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0184.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.474] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa84887bf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0184.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.474] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.475] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0184.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.475] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2743880 | out: lpFileInformation=0x2743880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee)) returned 1
	[0184.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.476] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0184.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.476] ReadFile (in: hFile=0x318, lpBuffer=0x2743f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2743f6c*, lpNumberOfBytesRead=0x57ff3fc*=0x1ee, lpOverlapped=0x0) returned 1
	[0184.485] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.485] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.485] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2745008, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b5c0) returned 1
	[0184.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.485] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0184.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.485] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27450c0*=0x1, dwFlags=0x0) returned 1
	[0184.485] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x274508c, dwFlags=0x0) returned 1
	[0184.485] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27450d0*, pdwDataLen=0x57ff404*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x27450d0*, pdwDataLen=0x57ff404*=0x1f0) returned 1
	[0184.485] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27452cc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27452cc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.485] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0184.485] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.485] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.485] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0184.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.485] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.486] GetFileType (hFile=0x318) returned 0x1
	[0184.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.487] GetFileType (hFile=0x318) returned 0x1
	[0184.487] WriteFile (in: hFile=0x318, lpBuffer=0x2745550*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2745550*, lpNumberOfBytesWritten=0x57ff3c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0184.487] CloseHandle (hObject=0x318) returned 1
	[0184.488] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0184.488] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0184.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.488] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa84aadff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0184.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.488] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.489] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.489] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2746bb8 | out: lpFileInformation=0x2746bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x312)) returned 1
	[0184.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.489] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.489] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.489] GetFileType (hFile=0x318) returned 0x1
	[0184.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.489] GetFileType (hFile=0x318) returned 0x1
	[0184.489] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x312
	[0184.489] ReadFile (in: hFile=0x318, lpBuffer=0x2747368, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2747368*, lpNumberOfBytesRead=0x57ff3fc*=0x312, lpOverlapped=0x0) returned 1
	[0184.493] CloseHandle (hObject=0x318) returned 1
	[0184.493] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0184.493] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.493] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2748404, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0184.493] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.493] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.493] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0184.493] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.493] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27484bc*=0x1, dwFlags=0x0) returned 1
	[0184.493] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2748488, dwFlags=0x0) returned 1
	[0184.493] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27484cc*, pdwDataLen=0x57ff404*=0x320, dwBufLen=0x320 | out: pbData=0x27484cc*, pdwDataLen=0x57ff404*=0x320) returned 1
	[0184.493] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27487f8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27487f8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.493] CryptDestroyKey (hKey=0x82b100) returned 1
	[0184.494] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.494] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.494] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.494] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.496] GetFileType (hFile=0x318) returned 0x1
	[0184.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.496] GetFileType (hFile=0x318) returned 0x1
	[0184.496] WriteFile (in: hFile=0x318, lpBuffer=0x2748a4c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2748a4c*, lpNumberOfBytesWritten=0x57ff3c4*=0x320, lpOverlapped=0x0) returned 1
	[0184.497] CloseHandle (hObject=0x318) returned 1
	[0184.497] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.497] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0184.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.497] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa84d10be, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1
	[0184.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.497] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.499] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x274a060 | out: lpFileInformation=0x274a060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0184.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.499] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.499] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.499] GetFileType (hFile=0x318) returned 0x1
	[0184.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.499] GetFileType (hFile=0x318) returned 0x1
	[0184.499] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ca
	[0184.499] ReadFile (in: hFile=0x318, lpBuffer=0x274a7b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x274a7b8*, lpNumberOfBytesRead=0x57ff3fc*=0x2ca, lpOverlapped=0x0) returned 1
	[0184.501] CloseHandle (hObject=0x318) returned 1
	[0184.501] CryptDestroyKey (hKey=0x82b340) returned 1
	[0184.501] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.501] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274b854, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0184.501] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.501] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.501] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0184.501] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.501] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x274b90c*=0x1, dwFlags=0x0) returned 1
	[0184.501] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x274b8d8, dwFlags=0x0) returned 1
	[0184.501] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274b91c*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x274b91c*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0184.501] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274bbf8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x274bbf8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.502] CryptDestroyKey (hKey=0x82b280) returned 1
	[0184.502] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.502] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.502] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.502] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.503] GetFileType (hFile=0x318) returned 0x1
	[0184.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.503] GetFileType (hFile=0x318) returned 0x1
	[0184.503] WriteFile (in: hFile=0x318, lpBuffer=0x274be44*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x274be44*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.504] CloseHandle (hObject=0x318) returned 1
	[0184.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0184.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.504] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa84d10be, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.504] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.505] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x274d43c | out: lpFileInformation=0x274d43c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de)) returned 1
	[0184.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.506] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.506] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.506] GetFileType (hFile=0x318) returned 0x1
	[0184.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.506] GetFileType (hFile=0x318) returned 0x1
	[0184.506] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2de
	[0184.506] ReadFile (in: hFile=0x318, lpBuffer=0x274dba8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x274dba8*, lpNumberOfBytesRead=0x57ff3fc*=0x2de, lpOverlapped=0x0) returned 1
	[0184.508] CloseHandle (hObject=0x318) returned 1
	[0184.508] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.508] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.508] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274ec44, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0184.508] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.508] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.508] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0184.508] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.508] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x274ecfc*=0x1, dwFlags=0x0) returned 1
	[0184.508] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x274ecc8, dwFlags=0x0) returned 1
	[0184.508] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274ed0c*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x274ed0c*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0184.508] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274eff8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x274eff8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.508] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.508] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.508] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.508] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.508] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.510] GetFileType (hFile=0x318) returned 0x1
	[0184.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.510] GetFileType (hFile=0x318) returned 0x1
	[0184.510] WriteFile (in: hFile=0x318, lpBuffer=0x274f244*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x274f244*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0184.511] CloseHandle (hObject=0x318) returned 1
	[0184.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0184.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.511] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa84f727f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0184.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.511] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.512] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.512] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x275083c | out: lpFileInformation=0x275083c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2)) returned 1
	[0184.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.513] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.513] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.513] GetFileType (hFile=0x318) returned 0x1
	[0184.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.513] GetFileType (hFile=0x318) returned 0x1
	[0184.513] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d2
	[0184.513] ReadFile (in: hFile=0x318, lpBuffer=0x2750f9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2750f9c*, lpNumberOfBytesRead=0x57ff3fc*=0x2d2, lpOverlapped=0x0) returned 1
	[0184.515] CloseHandle (hObject=0x318) returned 1
	[0184.515] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0184.515] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.515] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2752038, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b380) returned 1
	[0184.515] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.515] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.515] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0184.515] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.515] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27520f0*=0x1, dwFlags=0x0) returned 1
	[0184.515] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27520bc, dwFlags=0x0) returned 1
	[0184.515] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2752100*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2752100*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0184.515] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27523ec*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27523ec*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.515] CryptDestroyKey (hKey=0x82b280) returned 1
	[0184.515] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.515] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.516] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.517] GetFileType (hFile=0x318) returned 0x1
	[0184.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.517] GetFileType (hFile=0x318) returned 0x1
	[0184.517] WriteFile (in: hFile=0x318, lpBuffer=0x2752638*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2752638*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0184.518] CloseHandle (hObject=0x318) returned 1
	[0184.518] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.518] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0184.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.518] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa84f727f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0184.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.518] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.519] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.519] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2753c30 | out: lpFileInformation=0x2753c30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0184.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.520] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.520] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.520] GetFileType (hFile=0x318) returned 0x1
	[0184.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.520] GetFileType (hFile=0x318) returned 0x1
	[0184.520] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d3
	[0184.520] ReadFile (in: hFile=0x318, lpBuffer=0x2754390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2754390*, lpNumberOfBytesRead=0x57ff3fc*=0x2d3, lpOverlapped=0x0) returned 1
	[0184.522] CloseHandle (hObject=0x318) returned 1
	[0184.522] CryptDestroyKey (hKey=0x82b380) returned 1
	[0184.522] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.522] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275542c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0184.522] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.522] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.522] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b380) returned 1
	[0184.522] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.522] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27554e4*=0x1, dwFlags=0x0) returned 1
	[0184.522] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27554b0, dwFlags=0x0) returned 1
	[0184.522] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27554f4*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27554f4*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0184.522] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27557e0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27557e0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.522] CryptDestroyKey (hKey=0x82b380) returned 1
	[0184.523] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.523] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.523] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.523] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.524] GetFileType (hFile=0x318) returned 0x1
	[0184.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.524] GetFileType (hFile=0x318) returned 0x1
	[0184.524] WriteFile (in: hFile=0x318, lpBuffer=0x2755a2c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2755a2c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0184.526] CloseHandle (hObject=0x318) returned 1
	[0184.526] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.526] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0184.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.526] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa851d592, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0184.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.526] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.527] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.527] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2757024 | out: lpFileInformation=0x2757024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x343)) returned 1
	[0184.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.528] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.528] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.528] GetFileType (hFile=0x318) returned 0x1
	[0184.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.528] GetFileType (hFile=0x318) returned 0x1
	[0184.528] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x343
	[0184.528] ReadFile (in: hFile=0x318, lpBuffer=0x27577f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27577f4*, lpNumberOfBytesRead=0x57ff3fc*=0x343, lpOverlapped=0x0) returned 1
	[0184.553] CloseHandle (hObject=0x318) returned 1
	[0184.553] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.553] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.553] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2758890, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0184.553] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.553] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.553] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0184.553] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.553] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2758948*=0x1, dwFlags=0x0) returned 1
	[0184.553] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2758914, dwFlags=0x0) returned 1
	[0184.553] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2758958*, pdwDataLen=0x57ff404*=0x350, dwBufLen=0x350 | out: pbData=0x2758958*, pdwDataLen=0x57ff404*=0x350) returned 1
	[0184.553] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2758cb4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2758cb4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.553] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0184.553] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.554] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.554] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.554] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.555] GetFileType (hFile=0x318) returned 0x1
	[0184.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.555] GetFileType (hFile=0x318) returned 0x1
	[0184.555] WriteFile (in: hFile=0x318, lpBuffer=0x2758f00*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2758f00*, lpNumberOfBytesWritten=0x57ff3c4*=0x350, lpOverlapped=0x0) returned 1
	[0184.556] CloseHandle (hObject=0x318) returned 1
	[0184.556] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.556] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0184.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.556] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa854382e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0184.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.556] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.557] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.557] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x275a504 | out: lpFileInformation=0x275a504*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27c)) returned 1
	[0184.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.558] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.558] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.558] GetFileType (hFile=0x318) returned 0x1
	[0184.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.558] GetFileType (hFile=0x318) returned 0x1
	[0184.558] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x27c
	[0184.558] ReadFile (in: hFile=0x318, lpBuffer=0x275ac0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x275ac0c*, lpNumberOfBytesRead=0x57ff3fc*=0x27c, lpOverlapped=0x0) returned 1
	[0184.560] CloseHandle (hObject=0x318) returned 1
	[0184.560] CryptDestroyKey (hKey=0x82b280) returned 1
	[0184.560] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.560] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275bca8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0184.560] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.560] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.560] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0184.560] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.560] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x275bd60*=0x1, dwFlags=0x0) returned 1
	[0184.560] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x275bd2c, dwFlags=0x0) returned 1
	[0184.560] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275bd70*, pdwDataLen=0x57ff404*=0x280, dwBufLen=0x280 | out: pbData=0x275bd70*, pdwDataLen=0x57ff404*=0x280) returned 1
	[0184.560] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275bffc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x275bffc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.560] CryptDestroyKey (hKey=0x82b100) returned 1
	[0184.560] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.560] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.560] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.560] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.562] GetFileType (hFile=0x318) returned 0x1
	[0184.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.562] GetFileType (hFile=0x318) returned 0x1
	[0184.562] WriteFile (in: hFile=0x318, lpBuffer=0x275c248*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x275c248*, lpNumberOfBytesWritten=0x57ff3c4*=0x280, lpOverlapped=0x0) returned 1
	[0184.563] CloseHandle (hObject=0x318) returned 1
	[0184.563] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.563] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0184.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.563] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8569ae6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0184.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.563] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.564] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0184.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.564] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x275d84c | out: lpFileInformation=0x275d84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0184.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.565] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0184.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.565] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.565] GetFileType (hFile=0x318) returned 0x1
	[0184.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.565] GetFileType (hFile=0x318) returned 0x1
	[0184.565] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c8
	[0184.565] ReadFile (in: hFile=0x318, lpBuffer=0x275df90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x275df90*, lpNumberOfBytesRead=0x57ff3fc*=0x2c8, lpOverlapped=0x0) returned 1
	[0184.567] CloseHandle (hObject=0x318) returned 1
	[0184.567] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0184.567] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.567] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275f02c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b480) returned 1
	[0184.567] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.567] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.568] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0184.568] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.568] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x275f0e4*=0x1, dwFlags=0x0) returned 1
	[0184.568] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x275f0b0, dwFlags=0x0) returned 1
	[0184.568] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275f0f4*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x275f0f4*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0184.568] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275f3d0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x275f3d0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.568] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.568] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.568] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.568] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0184.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.568] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.569] GetFileType (hFile=0x318) returned 0x1
	[0184.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.569] GetFileType (hFile=0x318) returned 0x1
	[0184.569] WriteFile (in: hFile=0x318, lpBuffer=0x275f614*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x275f614*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.570] CloseHandle (hObject=0x318) returned 1
	[0184.570] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0184.570] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0184.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.570] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8569ae6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.571] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.572] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0184.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.572] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2760c08 | out: lpFileInformation=0x2760c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300)) returned 1
	[0184.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.572] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0184.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.572] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.572] GetFileType (hFile=0x318) returned 0x1
	[0184.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.572] GetFileType (hFile=0x318) returned 0x1
	[0184.572] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x300
	[0184.572] ReadFile (in: hFile=0x318, lpBuffer=0x2761384, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2761384*, lpNumberOfBytesRead=0x57ff3fc*=0x300, lpOverlapped=0x0) returned 1
	[0184.578] CloseHandle (hObject=0x318) returned 1
	[0184.578] CryptDestroyKey (hKey=0x82b480) returned 1
	[0184.578] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.578] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2762420, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b000) returned 1
	[0184.578] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.578] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.578] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0184.578] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.578] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27624d8*=0x1, dwFlags=0x0) returned 1
	[0184.578] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27624a4, dwFlags=0x0) returned 1
	[0184.578] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27624e8*, pdwDataLen=0x57ff404*=0x310, dwBufLen=0x310 | out: pbData=0x27624e8*, pdwDataLen=0x57ff404*=0x310) returned 1
	[0184.578] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2762804*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2762804*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.578] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.578] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.579] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.579] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0184.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.579] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.580] GetFileType (hFile=0x318) returned 0x1
	[0184.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.580] GetFileType (hFile=0x318) returned 0x1
	[0184.580] WriteFile (in: hFile=0x318, lpBuffer=0x2762a48*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2762a48*, lpNumberOfBytesWritten=0x57ff3c4*=0x310, lpOverlapped=0x0) returned 1
	[0184.581] CloseHandle (hObject=0x318) returned 1
	[0184.581] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0184.581] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0184.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.581] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa858fce8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0184.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.581] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.582] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.582] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x276403c | out: lpFileInformation=0x276403c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x376)) returned 1
	[0184.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.583] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.583] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.583] GetFileType (hFile=0x318) returned 0x1
	[0184.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.583] GetFileType (hFile=0x318) returned 0x1
	[0184.583] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x376
	[0184.583] ReadFile (in: hFile=0x318, lpBuffer=0x2764860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2764860*, lpNumberOfBytesRead=0x57ff3fc*=0x376, lpOverlapped=0x0) returned 1
	[0184.585] CloseHandle (hObject=0x318) returned 1
	[0184.585] CryptDestroyKey (hKey=0x82b000) returned 1
	[0184.585] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.585] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27658fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b440) returned 1
	[0184.585] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.585] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.585] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0184.586] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.586] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27659b4*=0x1, dwFlags=0x0) returned 1
	[0184.586] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2765980, dwFlags=0x0) returned 1
	[0184.586] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27659c4*, pdwDataLen=0x57ff404*=0x380, dwBufLen=0x380 | out: pbData=0x27659c4*, pdwDataLen=0x57ff404*=0x380) returned 1
	[0184.586] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2765d50*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2765d50*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.586] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.586] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.586] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.586] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.587] GetFileType (hFile=0x318) returned 0x1
	[0184.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.587] GetFileType (hFile=0x318) returned 0x1
	[0184.587] WriteFile (in: hFile=0x318, lpBuffer=0x2765fac*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2765fac*, lpNumberOfBytesWritten=0x57ff3c4*=0x380, lpOverlapped=0x0) returned 1
	[0184.588] CloseHandle (hObject=0x318) returned 1
	[0184.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0184.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.588] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa85b5e6f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1
	[0184.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.589] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.590] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.590] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27675c4 | out: lpFileInformation=0x27675c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x341)) returned 1
	[0184.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.590] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.590] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.590] GetFileType (hFile=0x318) returned 0x1
	[0184.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.590] GetFileType (hFile=0x318) returned 0x1
	[0184.591] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x341
	[0184.591] ReadFile (in: hFile=0x318, lpBuffer=0x2767da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2767da4*, lpNumberOfBytesRead=0x57ff3fc*=0x341, lpOverlapped=0x0) returned 1
	[0184.604] CloseHandle (hObject=0x318) returned 1
	[0184.604] CryptDestroyKey (hKey=0x82b440) returned 1
	[0184.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.604] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2768e40, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0184.604] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.604] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.604] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0184.604] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.604] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2768ef8*=0x1, dwFlags=0x0) returned 1
	[0184.604] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2768ec4, dwFlags=0x0) returned 1
	[0184.604] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2768f08*, pdwDataLen=0x57ff404*=0x350, dwBufLen=0x350 | out: pbData=0x2768f08*, pdwDataLen=0x57ff404*=0x350) returned 1
	[0184.604] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2769264*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2769264*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.604] CryptDestroyKey (hKey=0x82b100) returned 1
	[0184.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.604] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.605] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.606] GetFileType (hFile=0x318) returned 0x1
	[0184.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.606] GetFileType (hFile=0x318) returned 0x1
	[0184.606] WriteFile (in: hFile=0x318, lpBuffer=0x27694b8*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27694b8*, lpNumberOfBytesWritten=0x57ff3c4*=0x350, lpOverlapped=0x0) returned 1
	[0184.607] CloseHandle (hObject=0x318) returned 1
	[0184.607] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.607] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0184.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.607] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa85dc0ae, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0184.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.607] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.609] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0184.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.609] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x276aacc | out: lpFileInformation=0x276aacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29e)) returned 1
	[0184.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.609] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0184.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.609] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.609] GetFileType (hFile=0x318) returned 0x1
	[0184.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.609] GetFileType (hFile=0x318) returned 0x1
	[0184.609] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x29e
	[0184.609] ReadFile (in: hFile=0x318, lpBuffer=0x276b258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x276b258*, lpNumberOfBytesRead=0x57ff3fc*=0x29e, lpOverlapped=0x0) returned 1
	[0184.626] CloseHandle (hObject=0x318) returned 1
	[0184.626] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.626] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.626] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276c2f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0184.626] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.626] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.626] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0184.626] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.626] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x276c3ac*=0x1, dwFlags=0x0) returned 1
	[0184.627] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x276c378, dwFlags=0x0) returned 1
	[0184.627] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276c3bc*, pdwDataLen=0x57ff404*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x276c3bc*, pdwDataLen=0x57ff404*=0x2a0) returned 1
	[0184.627] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276c668*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x276c668*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.627] CryptDestroyKey (hKey=0x82b100) returned 1
	[0184.627] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.627] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.627] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0184.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.627] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.628] GetFileType (hFile=0x318) returned 0x1
	[0184.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.628] GetFileType (hFile=0x318) returned 0x1
	[0184.628] WriteFile (in: hFile=0x318, lpBuffer=0x276c8e4*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x276c8e4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2a0, lpOverlapped=0x0) returned 1
	[0184.629] CloseHandle (hObject=0x318) returned 1
	[0184.630] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0184.630] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0184.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.630] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa86023d4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0184.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.630] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.631] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.631] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x276df3c | out: lpFileInformation=0x276df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e)) returned 1
	[0184.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.632] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.632] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.632] GetFileType (hFile=0x318) returned 0x1
	[0184.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.632] GetFileType (hFile=0x318) returned 0x1
	[0184.632] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x28e
	[0184.633] ReadFile (in: hFile=0x318, lpBuffer=0x276e668, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x276e668*, lpNumberOfBytesRead=0x57ff3fc*=0x28e, lpOverlapped=0x0) returned 1
	[0184.635] CloseHandle (hObject=0x318) returned 1
	[0184.635] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.635] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.635] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276f704, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0184.635] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.635] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.635] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0184.635] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.635] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x276f7bc*=0x1, dwFlags=0x0) returned 1
	[0184.635] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x276f788, dwFlags=0x0) returned 1
	[0184.635] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276f7cc*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x276f7cc*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0184.635] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276fa68*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x276fa68*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.635] CryptDestroyKey (hKey=0x82b540) returned 1
	[0184.636] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.636] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.636] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.636] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.637] GetFileType (hFile=0x318) returned 0x1
	[0184.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.637] GetFileType (hFile=0x318) returned 0x1
	[0184.637] WriteFile (in: hFile=0x318, lpBuffer=0x276fcbc*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x276fcbc*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0184.638] CloseHandle (hObject=0x318) returned 1
	[0184.638] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.638] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0184.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.639] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8628661, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0184.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.639] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.640] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0184.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.640] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27712d0 | out: lpFileInformation=0x27712d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc)) returned 1
	[0184.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.640] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0184.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.640] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.640] GetFileType (hFile=0x318) returned 0x1
	[0184.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.641] GetFileType (hFile=0x318) returned 0x1
	[0184.641] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2bc
	[0184.641] ReadFile (in: hFile=0x318, lpBuffer=0x2771a08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2771a08*, lpNumberOfBytesRead=0x57ff3fc*=0x2bc, lpOverlapped=0x0) returned 1
	[0184.642] CloseHandle (hObject=0x318) returned 1
	[0184.643] CryptDestroyKey (hKey=0x82b100) returned 1
	[0184.643] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.643] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2772aa4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0184.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.643] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b400) returned 1
	[0184.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.643] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2772b5c*=0x1, dwFlags=0x0) returned 1
	[0184.643] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2772b28, dwFlags=0x0) returned 1
	[0184.643] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2772b6c*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x2772b6c*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0184.643] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2772e38*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2772e38*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.643] CryptDestroyKey (hKey=0x82b400) returned 1
	[0184.643] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.643] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.643] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0184.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.643] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.644] GetFileType (hFile=0x318) returned 0x1
	[0184.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.645] GetFileType (hFile=0x318) returned 0x1
	[0184.645] WriteFile (in: hFile=0x318, lpBuffer=0x277307c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x277307c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0184.645] CloseHandle (hObject=0x318) returned 1
	[0184.645] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0184.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0184.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.646] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8628661, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0184.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.646] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.647] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0184.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.647] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2774670 | out: lpFileInformation=0x2774670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0184.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.647] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0184.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.647] ReadFile (in: hFile=0x318, lpBuffer=0x2774df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2774df8*, lpNumberOfBytesRead=0x57ff3fc*=0x2ca, lpOverlapped=0x0) returned 1
	[0184.649] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.649] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.650] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2775e94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0184.650] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.650] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.650] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0184.650] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.650] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2775f4c*=0x1, dwFlags=0x0) returned 1
	[0184.650] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2775f18, dwFlags=0x0) returned 1
	[0184.650] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2775f5c*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2775f5c*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0184.650] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2776238*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2776238*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.650] CryptDestroyKey (hKey=0x82b280) returned 1
	[0184.650] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.650] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0184.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.650] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.652] GetFileType (hFile=0x318) returned 0x1
	[0184.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.652] GetFileType (hFile=0x318) returned 0x1
	[0184.652] WriteFile (in: hFile=0x318, lpBuffer=0x277649c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x277649c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.653] CloseHandle (hObject=0x318) returned 1
	[0184.653] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0184.653] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0184.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.653] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa864e8c7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.653] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.654] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.654] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2777ad0 | out: lpFileInformation=0x2777ad0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x383)) returned 1
	[0184.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.655] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.655] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.655] GetFileType (hFile=0x318) returned 0x1
	[0184.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.655] GetFileType (hFile=0x318) returned 0x1
	[0184.655] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x383
	[0184.655] ReadFile (in: hFile=0x318, lpBuffer=0x27782d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27782d0*, lpNumberOfBytesRead=0x57ff3fc*=0x383, lpOverlapped=0x0) returned 1
	[0184.674] CloseHandle (hObject=0x318) returned 1
	[0184.674] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0184.674] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.675] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277936c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b200) returned 1
	[0184.675] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.675] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.675] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0184.675] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.675] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2779424*=0x1, dwFlags=0x0) returned 1
	[0184.675] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27793f0, dwFlags=0x0) returned 1
	[0184.675] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2779434*, pdwDataLen=0x57ff404*=0x390, dwBufLen=0x390 | out: pbData=0x2779434*, pdwDataLen=0x57ff404*=0x390) returned 1
	[0184.675] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27797d0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27797d0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.675] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.675] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.675] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.675] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.676] GetFileType (hFile=0x318) returned 0x1
	[0184.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.676] GetFileType (hFile=0x318) returned 0x1
	[0184.676] WriteFile (in: hFile=0x318, lpBuffer=0x2779a14*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2779a14*, lpNumberOfBytesWritten=0x57ff3c4*=0x390, lpOverlapped=0x0) returned 1
	[0184.677] CloseHandle (hObject=0x318) returned 1
	[0184.677] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0184.677] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0184.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.678] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8674ade, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x390)) returned 1
	[0184.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.678] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.679] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x277affc | out: lpFileInformation=0x277affc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0184.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.679] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.679] GetFileType (hFile=0x318) returned 0x1
	[0184.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.680] GetFileType (hFile=0x318) returned 0x1
	[0184.680] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x310
	[0184.680] ReadFile (in: hFile=0x318, lpBuffer=0x277b798, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x277b798*, lpNumberOfBytesRead=0x57ff3fc*=0x310, lpOverlapped=0x0) returned 1
	[0184.681] CloseHandle (hObject=0x318) returned 1
	[0184.682] CryptDestroyKey (hKey=0x82b200) returned 1
	[0184.682] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.682] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277c834, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0184.682] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.682] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.682] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0184.682] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.682] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x277c8ec*=0x1, dwFlags=0x0) returned 1
	[0184.682] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x277c8b8, dwFlags=0x0) returned 1
	[0184.682] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277c8fc*, pdwDataLen=0x57ff404*=0x320, dwBufLen=0x320 | out: pbData=0x277c8fc*, pdwDataLen=0x57ff404*=0x320) returned 1
	[0184.682] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277cc28*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x277cc28*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.682] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0184.682] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.682] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.682] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.682] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.684] GetFileType (hFile=0x318) returned 0x1
	[0184.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.684] GetFileType (hFile=0x318) returned 0x1
	[0184.684] WriteFile (in: hFile=0x318, lpBuffer=0x277ce74*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x277ce74*, lpNumberOfBytesWritten=0x57ff3c4*=0x320, lpOverlapped=0x0) returned 1
	[0184.685] CloseHandle (hObject=0x318) returned 1
	[0184.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0184.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.685] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa869ac0d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1
	[0184.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.685] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.686] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.686] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x277e46c | out: lpFileInformation=0x277e46c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x309)) returned 1
	[0184.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.687] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.687] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.687] GetFileType (hFile=0x318) returned 0x1
	[0184.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.687] GetFileType (hFile=0x318) returned 0x1
	[0184.687] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x309
	[0184.687] ReadFile (in: hFile=0x318, lpBuffer=0x277ec04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x277ec04*, lpNumberOfBytesRead=0x57ff3fc*=0x309, lpOverlapped=0x0) returned 1
	[0184.689] CloseHandle (hObject=0x318) returned 1
	[0184.689] CryptDestroyKey (hKey=0x82b540) returned 1
	[0184.689] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.689] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277fca0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0184.689] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.689] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.689] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b380) returned 1
	[0184.689] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.689] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x277fd58*=0x1, dwFlags=0x0) returned 1
	[0184.689] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x277fd24, dwFlags=0x0) returned 1
	[0184.690] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277fd68*, pdwDataLen=0x57ff404*=0x310, dwBufLen=0x310 | out: pbData=0x277fd68*, pdwDataLen=0x57ff404*=0x310) returned 1
	[0184.690] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2780084*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2780084*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.690] CryptDestroyKey (hKey=0x82b380) returned 1
	[0184.690] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.690] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.690] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.690] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.691] GetFileType (hFile=0x318) returned 0x1
	[0184.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.691] GetFileType (hFile=0x318) returned 0x1
	[0184.691] WriteFile (in: hFile=0x318, lpBuffer=0x27802d0*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27802d0*, lpNumberOfBytesWritten=0x57ff3c4*=0x310, lpOverlapped=0x0) returned 1
	[0184.692] CloseHandle (hObject=0x318) returned 1
	[0184.692] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.692] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0184.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.693] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa869ac0d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0184.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.693] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.694] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.694] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27818c8 | out: lpFileInformation=0x27818c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908d698d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6)) returned 1
	[0184.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.694] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.694] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.694] GetFileType (hFile=0x318) returned 0x1
	[0184.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.694] GetFileType (hFile=0x318) returned 0x1
	[0184.694] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c6
	[0184.695] ReadFile (in: hFile=0x318, lpBuffer=0x278201c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x278201c*, lpNumberOfBytesRead=0x57ff3fc*=0x2c6, lpOverlapped=0x0) returned 1
	[0184.696] CloseHandle (hObject=0x318) returned 1
	[0184.696] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.696] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.696] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27830b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b440) returned 1
	[0184.696] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.696] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.697] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b380) returned 1
	[0184.697] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.697] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x2783170*=0x1, dwFlags=0x0) returned 1
	[0184.697] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x278313c, dwFlags=0x0) returned 1
	[0184.697] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2783180*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2783180*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0184.697] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278345c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x278345c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.697] CryptDestroyKey (hKey=0x82b380) returned 1
	[0184.697] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.697] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.697] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.697] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.698] GetFileType (hFile=0x318) returned 0x1
	[0184.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.698] GetFileType (hFile=0x318) returned 0x1
	[0184.699] WriteFile (in: hFile=0x318, lpBuffer=0x27836a8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27836a8*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.699] CloseHandle (hObject=0x318) returned 1
	[0184.700] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0184.700] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0184.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.700] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa86c0eeb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.700] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.701] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.701] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2784ca0 | out: lpFileInformation=0x2784ca0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908d698d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30e)) returned 1
	[0184.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.702] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.702] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.702] GetFileType (hFile=0x318) returned 0x1
	[0184.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.702] GetFileType (hFile=0x318) returned 0x1
	[0184.702] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x30e
	[0184.703] ReadFile (in: hFile=0x318, lpBuffer=0x278545c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x278545c*, lpNumberOfBytesRead=0x57ff3fc*=0x30e, lpOverlapped=0x0) returned 1
	[0184.713] CloseHandle (hObject=0x318) returned 1
	[0184.713] CryptDestroyKey (hKey=0x82b440) returned 1
	[0184.713] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.713] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27864f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0184.713] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.713] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.713] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0184.713] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.713] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27865b0*=0x1, dwFlags=0x0) returned 1
	[0184.713] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x278657c, dwFlags=0x0) returned 1
	[0184.713] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27865c0*, pdwDataLen=0x57ff404*=0x310, dwBufLen=0x310 | out: pbData=0x27865c0*, pdwDataLen=0x57ff404*=0x310) returned 1
	[0184.713] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27868dc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27868dc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.713] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.713] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.714] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.714] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.715] GetFileType (hFile=0x318) returned 0x1
	[0184.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.715] GetFileType (hFile=0x318) returned 0x1
	[0184.715] WriteFile (in: hFile=0x318, lpBuffer=0x2786b38*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2786b38*, lpNumberOfBytesWritten=0x57ff3c4*=0x310, lpOverlapped=0x0) returned 1
	[0184.716] CloseHandle (hObject=0x318) returned 1
	[0184.716] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.716] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0184.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.716] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa86e71b9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0184.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.717] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0184.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.721] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278815c | out: lpFileInformation=0x278815c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0184.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0184.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.721] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.722] GetFileType (hFile=0x318) returned 0x1
	[0184.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.722] GetFileType (hFile=0x318) returned 0x1
	[0184.722] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cc
	[0184.722] ReadFile (in: hFile=0x318, lpBuffer=0x27888f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27888f4*, lpNumberOfBytesRead=0x57ff3fc*=0x2cc, lpOverlapped=0x0) returned 1
	[0184.742] CloseHandle (hObject=0x318) returned 1
	[0184.742] CryptDestroyKey (hKey=0x82b540) returned 1
	[0184.742] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.742] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2789990, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b400) returned 1
	[0184.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.742] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0184.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.742] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2789a48*=0x1, dwFlags=0x0) returned 1
	[0184.743] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2789a14, dwFlags=0x0) returned 1
	[0184.743] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2789a58*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2789a58*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0184.743] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2789d34*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2789d34*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.743] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0184.743] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.743] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.743] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0184.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.743] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.745] GetFileType (hFile=0x318) returned 0x1
	[0184.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.745] GetFileType (hFile=0x318) returned 0x1
	[0184.745] WriteFile (in: hFile=0x318, lpBuffer=0x2789fa0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2789fa0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.746] CloseHandle (hObject=0x318) returned 1
	[0184.746] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0184.746] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0184.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.746] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa873367a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.746] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0184.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.747] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278b5d8 | out: lpFileInformation=0x278b5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908fcbf9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1)) returned 1
	[0184.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0184.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.748] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.748] GetFileType (hFile=0x318) returned 0x1
	[0184.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.748] GetFileType (hFile=0x318) returned 0x1
	[0184.748] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d1
	[0184.748] ReadFile (in: hFile=0x318, lpBuffer=0x278bd88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x278bd88*, lpNumberOfBytesRead=0x57ff3fc*=0x2d1, lpOverlapped=0x0) returned 1
	[0184.750] CloseHandle (hObject=0x318) returned 1
	[0184.750] CryptDestroyKey (hKey=0x82b400) returned 1
	[0184.750] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.750] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278ce24, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0184.750] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.750] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.750] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0184.750] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.750] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x278cedc*=0x1, dwFlags=0x0) returned 1
	[0184.750] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x278cea8, dwFlags=0x0) returned 1
	[0184.750] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278ceec*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x278ceec*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0184.750] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278d1d8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x278d1d8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.750] CryptDestroyKey (hKey=0x82b540) returned 1
	[0184.750] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.750] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.750] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0184.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.750] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.752] GetFileType (hFile=0x318) returned 0x1
	[0184.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.752] GetFileType (hFile=0x318) returned 0x1
	[0184.752] WriteFile (in: hFile=0x318, lpBuffer=0x278d44c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x278d44c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0184.753] CloseHandle (hObject=0x318) returned 1
	[0184.753] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0184.753] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0184.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.753] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa873367a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0184.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.753] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.754] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.754] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278eaa0 | out: lpFileInformation=0x278eaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908fcbf9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc)) returned 1
	[0184.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.755] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.755] GetFileType (hFile=0x318) returned 0x1
	[0184.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.755] GetFileType (hFile=0x318) returned 0x1
	[0184.755] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2bc
	[0184.755] ReadFile (in: hFile=0x318, lpBuffer=0x278f1e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x278f1e8*, lpNumberOfBytesRead=0x57ff3fc*=0x2bc, lpOverlapped=0x0) returned 1
	[0184.756] CloseHandle (hObject=0x318) returned 1
	[0184.757] CryptDestroyKey (hKey=0x82b280) returned 1
	[0184.757] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.757] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2790284, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0184.757] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.757] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.757] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0184.757] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.757] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x279033c*=0x1, dwFlags=0x0) returned 1
	[0184.757] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2790308, dwFlags=0x0) returned 1
	[0184.757] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279034c*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x279034c*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0184.757] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2790618*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2790618*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.757] CryptDestroyKey (hKey=0x82b080) returned 1
	[0184.757] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.757] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.757] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.759] WriteFile (in: hFile=0x318, lpBuffer=0x2790864*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2790864*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0184.761] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0184.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.762] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.762] GetFileType (hFile=0x318) returned 0x1
	[0184.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.763] GetFileType (hFile=0x318) returned 0x1
	[0184.763] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d3
	[0184.763] ReadFile (in: hFile=0x318, lpBuffer=0x2792628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2792628*, lpNumberOfBytesRead=0x57ff3fc*=0x2d3, lpOverlapped=0x0) returned 1
	[0184.764] CloseHandle (hObject=0x318) returned 1
	[0184.764] CryptDestroyKey (hKey=0x82b540) returned 1
	[0184.764] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.765] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27936c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0184.765] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.765] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.765] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0184.765] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.765] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x279377c*=0x1, dwFlags=0x0) returned 1
	[0184.765] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2793748, dwFlags=0x0) returned 1
	[0184.765] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279378c*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x279378c*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0184.765] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2793a78*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2793a78*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.765] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.765] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.765] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.765] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0184.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.765] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.767] GetFileType (hFile=0x318) returned 0x1
	[0184.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.767] GetFileType (hFile=0x318) returned 0x1
	[0184.767] WriteFile (in: hFile=0x318, lpBuffer=0x2793cf4*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2793cf4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0184.768] CloseHandle (hObject=0x318) returned 1
	[0184.768] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0184.768] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0184.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.768] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa87598d2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0184.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.768] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.769] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0184.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.769] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2795358 | out: lpFileInformation=0x2795358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0184.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0184.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.770] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.770] GetFileType (hFile=0x318) returned 0x1
	[0184.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.770] GetFileType (hFile=0x318) returned 0x1
	[0184.770] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cf
	[0184.770] ReadFile (in: hFile=0x318, lpBuffer=0x2795b04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2795b04*, lpNumberOfBytesRead=0x57ff3fc*=0x2cf, lpOverlapped=0x0) returned 1
	[0184.771] CloseHandle (hObject=0x318) returned 1
	[0184.772] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0184.772] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.772] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2796ba0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0184.772] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.772] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.772] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0184.772] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.772] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2796c58*=0x1, dwFlags=0x0) returned 1
	[0184.772] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2796c24, dwFlags=0x0) returned 1
	[0184.772] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2796c68*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2796c68*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0184.772] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2796f44*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2796f44*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.772] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.772] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.772] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.772] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0184.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.772] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.774] GetFileType (hFile=0x318) returned 0x1
	[0184.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.774] GetFileType (hFile=0x318) returned 0x1
	[0184.774] WriteFile (in: hFile=0x318, lpBuffer=0x27971b8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27971b8*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.775] CloseHandle (hObject=0x318) returned 1
	[0184.775] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0184.775] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0184.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.775] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa877fac4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.775] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.777] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.777] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2798800 | out: lpFileInformation=0x2798800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x302)) returned 1
	[0184.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.777] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.777] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.777] GetFileType (hFile=0x318) returned 0x1
	[0184.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.778] GetFileType (hFile=0x318) returned 0x1
	[0184.778] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x302
	[0184.778] ReadFile (in: hFile=0x318, lpBuffer=0x2798fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2798fb0*, lpNumberOfBytesRead=0x57ff3fc*=0x302, lpOverlapped=0x0) returned 1
	[0184.803] CloseHandle (hObject=0x318) returned 1
	[0184.803] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0184.803] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.803] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279a04c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0184.804] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.804] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.804] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0184.804] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.804] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x279a104*=0x1, dwFlags=0x0) returned 1
	[0184.804] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x279a0d0, dwFlags=0x0) returned 1
	[0184.804] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279a114*, pdwDataLen=0x57ff404*=0x310, dwBufLen=0x310 | out: pbData=0x279a114*, pdwDataLen=0x57ff404*=0x310) returned 1
	[0184.804] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279a430*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x279a430*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.804] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0184.804] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.804] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.804] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.805] GetFileType (hFile=0x318) returned 0x1
	[0184.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.805] GetFileType (hFile=0x318) returned 0x1
	[0184.805] WriteFile (in: hFile=0x318, lpBuffer=0x279a68c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x279a68c*, lpNumberOfBytesWritten=0x57ff3c4*=0x310, lpOverlapped=0x0) returned 1
	[0184.900] CloseHandle (hObject=0x318) returned 1
	[0184.901] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.901] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0184.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.901] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa88b0e11, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0184.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.901] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.902] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.902] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x279bcb0 | out: lpFileInformation=0x279bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.904] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.904] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.905] GetFileType (hFile=0x318) returned 0x1
	[0184.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.905] GetFileType (hFile=0x318) returned 0x1
	[0184.905] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d0
	[0184.905] ReadFile (in: hFile=0x318, lpBuffer=0x279c41c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x279c41c*, lpNumberOfBytesRead=0x57ff3fc*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.906] CloseHandle (hObject=0x318) returned 1
	[0184.906] CryptDestroyKey (hKey=0x82b280) returned 1
	[0184.906] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.906] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279d4b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0184.906] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.906] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.906] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0184.906] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.906] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x279d570*=0x1, dwFlags=0x0) returned 1
	[0184.906] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x279d53c, dwFlags=0x0) returned 1
	[0184.907] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279d580*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x279d580*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0184.907] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279d86c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x279d86c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.907] CryptDestroyKey (hKey=0x82b540) returned 1
	[0184.907] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.907] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.907] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.907] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.908] GetFileType (hFile=0x318) returned 0x1
	[0184.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.908] GetFileType (hFile=0x318) returned 0x1
	[0184.908] WriteFile (in: hFile=0x318, lpBuffer=0x279dac0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x279dac0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0184.909] CloseHandle (hObject=0x318) returned 1
	[0184.909] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.909] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0184.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.909] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa88b0e11, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0184.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.909] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.910] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.910] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x279f0d4 | out: lpFileInformation=0x279f0d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6)) returned 1
	[0184.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.910] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.911] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.911] GetFileType (hFile=0x318) returned 0x1
	[0184.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.911] GetFileType (hFile=0x318) returned 0x1
	[0184.911] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c6
	[0184.911] ReadFile (in: hFile=0x318, lpBuffer=0x279f838, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x279f838*, lpNumberOfBytesRead=0x57ff3fc*=0x2c6, lpOverlapped=0x0) returned 1
	[0184.912] CloseHandle (hObject=0x318) returned 1
	[0184.912] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0184.913] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.913] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a08d4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0184.913] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.913] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.913] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0184.913] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.913] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27a098c*=0x1, dwFlags=0x0) returned 1
	[0184.913] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27a0958, dwFlags=0x0) returned 1
	[0184.913] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a099c*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27a099c*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0184.913] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a0c78*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27a0c78*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.913] CryptDestroyKey (hKey=0x82b540) returned 1
	[0184.913] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.913] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.913] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.913] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.914] GetFileType (hFile=0x318) returned 0x1
	[0184.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.915] GetFileType (hFile=0x318) returned 0x1
	[0184.915] WriteFile (in: hFile=0x318, lpBuffer=0x27a0ecc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27a0ecc*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.916] CloseHandle (hObject=0x318) returned 1
	[0184.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0184.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0184.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.916] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa88d6fd3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.916] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.917] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.917] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a24e0 | out: lpFileInformation=0x27a24e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1
	[0184.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.918] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.918] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.918] GetFileType (hFile=0x318) returned 0x1
	[0184.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.918] GetFileType (hFile=0x318) returned 0x1
	[0184.918] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x340
	[0184.918] ReadFile (in: hFile=0x318, lpBuffer=0x27a2ccc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27a2ccc*, lpNumberOfBytesRead=0x57ff3fc*=0x340, lpOverlapped=0x0) returned 1
	[0184.920] CloseHandle (hObject=0x318) returned 1
	[0184.920] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0184.920] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.920] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a3d68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0184.920] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.920] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.920] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0184.920] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.920] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27a3e20*=0x1, dwFlags=0x0) returned 1
	[0184.920] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27a3dec, dwFlags=0x0) returned 1
	[0184.920] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a3e30*, pdwDataLen=0x57ff404*=0x350, dwBufLen=0x350 | out: pbData=0x27a3e30*, pdwDataLen=0x57ff404*=0x350) returned 1
	[0184.920] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a418c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27a418c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.920] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0184.920] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.921] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.921] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.921] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.922] GetFileType (hFile=0x318) returned 0x1
	[0184.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.922] GetFileType (hFile=0x318) returned 0x1
	[0184.922] WriteFile (in: hFile=0x318, lpBuffer=0x27a43e8*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27a43e8*, lpNumberOfBytesWritten=0x57ff3c4*=0x350, lpOverlapped=0x0) returned 1
	[0184.923] CloseHandle (hObject=0x318) returned 1
	[0184.923] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0184.923] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0184.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.923] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa88d6fd3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0184.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.923] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.924] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.924] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a5a00 | out: lpFileInformation=0x27a5a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0184.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.925] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.925] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.925] GetFileType (hFile=0x318) returned 0x1
	[0184.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.925] GetFileType (hFile=0x318) returned 0x1
	[0184.925] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cc
	[0184.925] ReadFile (in: hFile=0x318, lpBuffer=0x27a6178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27a6178*, lpNumberOfBytesRead=0x57ff3fc*=0x2cc, lpOverlapped=0x0) returned 1
	[0184.926] CloseHandle (hObject=0x318) returned 1
	[0184.926] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.927] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.927] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a7214, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0184.927] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.927] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.927] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b000) returned 1
	[0184.927] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.927] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x27a72cc*=0x1, dwFlags=0x0) returned 1
	[0184.927] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x27a7298, dwFlags=0x0) returned 1
	[0184.927] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a72dc*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27a72dc*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0184.927] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a75b8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27a75b8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.927] CryptDestroyKey (hKey=0x82b000) returned 1
	[0184.927] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.927] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.927] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.928] GetFileType (hFile=0x318) returned 0x1
	[0184.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.928] GetFileType (hFile=0x318) returned 0x1
	[0184.928] WriteFile (in: hFile=0x318, lpBuffer=0x27a7814*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27a7814*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.929] CloseHandle (hObject=0x318) returned 1
	[0184.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0184.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0184.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.930] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa88d6fd3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.930] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.931] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.931] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a8e38 | out: lpFileInformation=0x27a8e38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5)) returned 1
	[0184.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.931] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.932] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.932] GetFileType (hFile=0x318) returned 0x1
	[0184.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.932] GetFileType (hFile=0x318) returned 0x1
	[0184.932] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c5
	[0184.932] ReadFile (in: hFile=0x318, lpBuffer=0x27a958c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27a958c*, lpNumberOfBytesRead=0x57ff3fc*=0x2c5, lpOverlapped=0x0) returned 1
	[0184.957] CloseHandle (hObject=0x318) returned 1
	[0184.957] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0184.957] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.957] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27aa628, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0184.957] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.957] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.957] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0184.957] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.957] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27aa6e0*=0x1, dwFlags=0x0) returned 1
	[0184.957] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27aa6ac, dwFlags=0x0) returned 1
	[0184.957] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27aa6f0*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27aa6f0*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0184.957] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27aa9cc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27aa9cc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.957] CryptDestroyKey (hKey=0x82b540) returned 1
	[0184.957] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.957] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.958] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.959] GetFileType (hFile=0x318) returned 0x1
	[0184.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.959] GetFileType (hFile=0x318) returned 0x1
	[0184.959] WriteFile (in: hFile=0x318, lpBuffer=0x27aac18*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27aac18*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.960] CloseHandle (hObject=0x318) returned 1
	[0184.960] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.960] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0184.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.960] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8923547, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.960] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.961] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0184.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.961] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ac21c | out: lpFileInformation=0x27ac21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3)) returned 1
	[0184.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.963] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0184.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.963] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.963] GetFileType (hFile=0x318) returned 0x1
	[0184.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.963] GetFileType (hFile=0x318) returned 0x1
	[0184.963] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1d3
	[0184.963] ReadFile (in: hFile=0x318, lpBuffer=0x27ac88c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27ac88c*, lpNumberOfBytesRead=0x57ff3fc*=0x1d3, lpOverlapped=0x0) returned 1
	[0184.964] CloseHandle (hObject=0x318) returned 1
	[0184.964] CryptDestroyKey (hKey=0x82b280) returned 1
	[0184.964] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.964] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ad928, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0184.964] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.964] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.965] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0184.965] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.965] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27ad9e0*=0x1, dwFlags=0x0) returned 1
	[0184.965] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27ad9ac, dwFlags=0x0) returned 1
	[0184.965] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ad9f0*, pdwDataLen=0x57ff404*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x27ad9f0*, pdwDataLen=0x57ff404*=0x1e0) returned 1
	[0184.965] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27adbdc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27adbdc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.965] CryptDestroyKey (hKey=0x82b100) returned 1
	[0184.965] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.965] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.965] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0184.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.965] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.966] GetFileType (hFile=0x318) returned 0x1
	[0184.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.966] GetFileType (hFile=0x318) returned 0x1
	[0184.966] WriteFile (in: hFile=0x318, lpBuffer=0x27ade30*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27ade30*, lpNumberOfBytesWritten=0x57ff3c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0184.967] CloseHandle (hObject=0x318) returned 1
	[0184.967] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0184.967] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0184.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.967] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa894968e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0184.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.968] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.969] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.969] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27af444 | out: lpFileInformation=0x27af444*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283)) returned 1
	[0184.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.969] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.969] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.969] GetFileType (hFile=0x318) returned 0x1
	[0184.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.970] GetFileType (hFile=0x318) returned 0x1
	[0184.970] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x283
	[0184.970] ReadFile (in: hFile=0x318, lpBuffer=0x27afb54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27afb54*, lpNumberOfBytesRead=0x57ff3fc*=0x283, lpOverlapped=0x0) returned 1
	[0184.971] CloseHandle (hObject=0x318) returned 1
	[0184.971] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0184.971] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.971] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b0bf0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0184.971] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.971] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.971] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b200) returned 1
	[0184.971] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.971] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x27b0ca8*=0x1, dwFlags=0x0) returned 1
	[0184.972] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x27b0c74, dwFlags=0x0) returned 1
	[0184.972] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b0cb8*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x27b0cb8*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0184.972] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b0f54*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27b0f54*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.972] CryptDestroyKey (hKey=0x82b200) returned 1
	[0184.972] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.972] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.972] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.973] GetFileType (hFile=0x318) returned 0x1
	[0184.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.973] GetFileType (hFile=0x318) returned 0x1
	[0184.973] WriteFile (in: hFile=0x318, lpBuffer=0x27b11a0*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27b11a0*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0184.974] CloseHandle (hObject=0x318) returned 1
	[0184.974] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0184.974] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0184.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.974] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa894968e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0184.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.974] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0184.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.975] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b27a4 | out: lpFileInformation=0x27b27a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1)) returned 1
	[0184.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.976] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0184.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.976] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.976] GetFileType (hFile=0x318) returned 0x1
	[0184.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.976] GetFileType (hFile=0x318) returned 0x1
	[0184.976] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d1
	[0184.976] ReadFile (in: hFile=0x318, lpBuffer=0x27b2f54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27b2f54*, lpNumberOfBytesRead=0x57ff3fc*=0x2d1, lpOverlapped=0x0) returned 1
	[0184.977] CloseHandle (hObject=0x318) returned 1
	[0184.977] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.977] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.978] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b3ff0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0184.978] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.978] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.978] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0184.978] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.978] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27b40a8*=0x1, dwFlags=0x0) returned 1
	[0184.978] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27b4074, dwFlags=0x0) returned 1
	[0184.978] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b40b8*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27b40b8*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0184.978] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b43a4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27b43a4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.978] CryptDestroyKey (hKey=0x82b480) returned 1
	[0184.978] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.978] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.978] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0184.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.978] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.979] GetFileType (hFile=0x318) returned 0x1
	[0184.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.979] GetFileType (hFile=0x318) returned 0x1
	[0184.979] WriteFile (in: hFile=0x318, lpBuffer=0x27b4618*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27b4618*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0184.980] CloseHandle (hObject=0x318) returned 1
	[0184.980] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0184.980] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0184.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.980] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa896f968, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0184.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.981] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.981] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0184.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.982] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b5c6c | out: lpFileInformation=0x27b5c6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6)) returned 1
	[0184.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0184.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.982] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.982] GetFileType (hFile=0x318) returned 0x1
	[0184.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.982] GetFileType (hFile=0x318) returned 0x1
	[0184.982] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c6
	[0184.982] ReadFile (in: hFile=0x318, lpBuffer=0x27b63f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27b63f0*, lpNumberOfBytesRead=0x57ff3fc*=0x2c6, lpOverlapped=0x0) returned 1
	[0184.984] CloseHandle (hObject=0x318) returned 1
	[0184.984] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0184.984] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.984] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b748c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0184.984] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.984] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.984] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0184.984] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.984] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27b7544*=0x1, dwFlags=0x0) returned 1
	[0184.984] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27b7510, dwFlags=0x0) returned 1
	[0184.984] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b7554*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27b7554*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0184.984] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b7830*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27b7830*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.984] CryptDestroyKey (hKey=0x82b100) returned 1
	[0184.984] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.984] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.984] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0184.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.984] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.985] GetFileType (hFile=0x318) returned 0x1
	[0184.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.985] GetFileType (hFile=0x318) returned 0x1
	[0184.986] WriteFile (in: hFile=0x318, lpBuffer=0x27b7a94*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27b7a94*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0184.986] CloseHandle (hObject=0x318) returned 1
	[0184.987] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0184.987] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0184.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0184.987] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa896f968, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0184.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0184.987] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0184.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0184.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0184.988] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b90bc | out: lpFileInformation=0x27b90bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x361)) returned 1
	[0184.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0184.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0184.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0184.988] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.988] GetFileType (hFile=0x318) returned 0x1
	[0184.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0184.989] GetFileType (hFile=0x318) returned 0x1
	[0184.989] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x361
	[0184.989] ReadFile (in: hFile=0x318, lpBuffer=0x27b995c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27b995c*, lpNumberOfBytesRead=0x57ff3fc*=0x361, lpOverlapped=0x0) returned 1
	[0184.990] CloseHandle (hObject=0x318) returned 1
	[0184.990] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0184.990] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.990] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ba9f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b480) returned 1
	[0184.991] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.991] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.991] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b000) returned 1
	[0184.991] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0184.991] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x27baab0*=0x1, dwFlags=0x0) returned 1
	[0184.991] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x27baa7c, dwFlags=0x0) returned 1
	[0184.991] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27baac0*, pdwDataLen=0x57ff404*=0x370, dwBufLen=0x370 | out: pbData=0x27baac0*, pdwDataLen=0x57ff404*=0x370) returned 1
	[0184.991] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27bae3c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27bae3c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0184.991] CryptDestroyKey (hKey=0x82b000) returned 1
	[0184.991] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.991] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0184.991] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0184.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0184.991] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0184.992] GetFileType (hFile=0x318) returned 0x1
	[0184.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0184.992] GetFileType (hFile=0x318) returned 0x1
	[0184.993] WriteFile (in: hFile=0x318, lpBuffer=0x27bb0e0*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27bb0e0*, lpNumberOfBytesWritten=0x57ff3c4*=0x370, lpOverlapped=0x0) returned 1
	[0185.012] CloseHandle (hObject=0x318) returned 1
	[0185.013] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0185.013] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdf
	[0185.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.013] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa89bbe3b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1
	[0185.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.013] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0185.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.014] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27bc788 | out: lpFileInformation=0x27bc788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x368)) returned 1
	[0185.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0185.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.015] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.015] GetFileType (hFile=0x318) returned 0x1
	[0185.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.015] GetFileType (hFile=0x318) returned 0x1
	[0185.015] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x368
	[0185.015] ReadFile (in: hFile=0x318, lpBuffer=0x27bd02c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27bd02c*, lpNumberOfBytesRead=0x57ff3fc*=0x368, lpOverlapped=0x0) returned 1
	[0185.016] CloseHandle (hObject=0x318) returned 1
	[0185.016] CryptDestroyKey (hKey=0x82b480) returned 1
	[0185.016] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.017] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27be0c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b2c0) returned 1
	[0185.017] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.017] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.017] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0185.017] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.017] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27be180*=0x1, dwFlags=0x0) returned 1
	[0185.017] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27be14c, dwFlags=0x0) returned 1
	[0185.017] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27be190*, pdwDataLen=0x57ff404*=0x370, dwBufLen=0x370 | out: pbData=0x27be190*, pdwDataLen=0x57ff404*=0x370) returned 1
	[0185.017] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27be50c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27be50c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.017] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0185.017] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.017] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.017] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0185.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.017] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.018] GetFileType (hFile=0x318) returned 0x1
	[0185.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.018] GetFileType (hFile=0x318) returned 0x1
	[0185.018] WriteFile (in: hFile=0x318, lpBuffer=0x27be7b0*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27be7b0*, lpNumberOfBytesWritten=0x57ff3c4*=0x370, lpOverlapped=0x0) returned 1
	[0185.019] CloseHandle (hObject=0x318) returned 1
	[0185.019] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0185.019] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdf
	[0185.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.020] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa89bbe3b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1
	[0185.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.020] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.021] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.021] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27bfe58 | out: lpFileInformation=0x27bfe58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8)) returned 1
	[0185.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.021] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.021] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.021] GetFileType (hFile=0x318) returned 0x1
	[0185.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.021] GetFileType (hFile=0x318) returned 0x1
	[0185.021] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1d8
	[0185.021] ReadFile (in: hFile=0x318, lpBuffer=0x27c045c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27c045c*, lpNumberOfBytesRead=0x57ff3fc*=0x1d8, lpOverlapped=0x0) returned 1
	[0185.022] CloseHandle (hObject=0x318) returned 1
	[0185.022] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0185.022] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.023] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c14f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0185.023] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.023] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.023] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b000) returned 1
	[0185.023] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.023] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x27c15b0*=0x1, dwFlags=0x0) returned 1
	[0185.023] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x27c157c, dwFlags=0x0) returned 1
	[0185.023] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c15c0*, pdwDataLen=0x57ff404*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x27c15c0*, pdwDataLen=0x57ff404*=0x1e0) returned 1
	[0185.023] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c17ac*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27c17ac*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.023] CryptDestroyKey (hKey=0x82b000) returned 1
	[0185.023] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.023] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.023] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.024] GetFileType (hFile=0x318) returned 0x1
	[0185.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.024] GetFileType (hFile=0x318) returned 0x1
	[0185.024] WriteFile (in: hFile=0x318, lpBuffer=0x27c19c8*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c19c8*, lpNumberOfBytesWritten=0x57ff3c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0185.025] CloseHandle (hObject=0x318) returned 1
	[0185.026] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.026] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0185.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.026] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa89e20b0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0185.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.026] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.027] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0185.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.027] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c2f6c | out: lpFileInformation=0x27c2f6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2)) returned 1
	[0185.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.028] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0185.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.028] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.028] GetFileType (hFile=0x318) returned 0x1
	[0185.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.028] GetFileType (hFile=0x318) returned 0x1
	[0185.028] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d2
	[0185.028] ReadFile (in: hFile=0x318, lpBuffer=0x27c372c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27c372c*, lpNumberOfBytesRead=0x57ff3fc*=0x2d2, lpOverlapped=0x0) returned 1
	[0185.029] CloseHandle (hObject=0x318) returned 1
	[0185.029] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0185.030] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.030] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c47c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0185.030] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.030] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.030] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0185.030] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.030] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27c4880*=0x1, dwFlags=0x0) returned 1
	[0185.030] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27c484c, dwFlags=0x0) returned 1
	[0185.030] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c4890*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27c4890*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0185.030] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c4b7c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27c4b7c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.030] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0185.030] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.030] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.030] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0185.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.030] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.031] GetFileType (hFile=0x318) returned 0x1
	[0185.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.032] GetFileType (hFile=0x318) returned 0x1
	[0185.032] WriteFile (in: hFile=0x318, lpBuffer=0x27c4df8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c4df8*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.032] CloseHandle (hObject=0x318) returned 1
	[0185.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0185.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0185.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.033] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa89e20b0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.033] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.034] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0185.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.034] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c6450 | out: lpFileInformation=0x27c6450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0185.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.035] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0185.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.035] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.035] GetFileType (hFile=0x318) returned 0x1
	[0185.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.035] GetFileType (hFile=0x318) returned 0x1
	[0185.035] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x280
	[0185.035] ReadFile (in: hFile=0x318, lpBuffer=0x27c6b5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27c6b5c*, lpNumberOfBytesRead=0x57ff3fc*=0x280, lpOverlapped=0x0) returned 1
	[0185.036] CloseHandle (hObject=0x318) returned 1
	[0185.036] CryptDestroyKey (hKey=0x82b540) returned 1
	[0185.036] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.036] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c7bf8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b0c0) returned 1
	[0185.037] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.037] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.037] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b340) returned 1
	[0185.037] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.037] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x27c7cb0*=0x1, dwFlags=0x0) returned 1
	[0185.037] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x27c7c7c, dwFlags=0x0) returned 1
	[0185.037] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c7cc0*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x27c7cc0*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0185.037] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c7f5c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27c7f5c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.037] CryptDestroyKey (hKey=0x82b340) returned 1
	[0185.037] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.037] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.037] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0185.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.037] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.038] GetFileType (hFile=0x318) returned 0x1
	[0185.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.038] GetFileType (hFile=0x318) returned 0x1
	[0185.038] WriteFile (in: hFile=0x318, lpBuffer=0x27c81a8*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c81a8*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0185.039] CloseHandle (hObject=0x318) returned 1
	[0185.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0185.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0185.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.039] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa89e20b0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0185.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.039] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.040] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0185.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.041] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c97ac | out: lpFileInformation=0x27c97ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0185.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.041] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0185.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.041] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.041] GetFileType (hFile=0x318) returned 0x1
	[0185.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.041] GetFileType (hFile=0x318) returned 0x1
	[0185.041] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x280
	[0185.042] ReadFile (in: hFile=0x318, lpBuffer=0x27c9eb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27c9eb8*, lpNumberOfBytesRead=0x57ff3fc*=0x280, lpOverlapped=0x0) returned 1
	[0185.062] CloseHandle (hObject=0x318) returned 1
	[0185.062] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0185.062] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.063] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27caf54, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0185.063] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.063] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.063] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0185.063] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.063] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27cb00c*=0x1, dwFlags=0x0) returned 1
	[0185.063] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27cafd8, dwFlags=0x0) returned 1
	[0185.063] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27cb01c*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x27cb01c*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0185.063] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb2b8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27cb2b8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.063] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.063] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.063] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.063] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0185.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.063] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.065] GetFileType (hFile=0x318) returned 0x1
	[0185.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.065] GetFileType (hFile=0x318) returned 0x1
	[0185.065] WriteFile (in: hFile=0x318, lpBuffer=0x27cb504*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27cb504*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0185.066] CloseHandle (hObject=0x318) returned 1
	[0185.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0185.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0185.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.066] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8a2e58a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0185.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.066] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.067] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0185.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.067] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ccb08 | out: lpFileInformation=0x27ccb08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc)) returned 1
	[0185.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.067] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0185.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.068] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.068] GetFileType (hFile=0x318) returned 0x1
	[0185.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.068] GetFileType (hFile=0x318) returned 0x1
	[0185.068] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2bc
	[0185.068] ReadFile (in: hFile=0x318, lpBuffer=0x27cd260, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27cd260*, lpNumberOfBytesRead=0x57ff3fc*=0x2bc, lpOverlapped=0x0) returned 1
	[0185.071] CloseHandle (hObject=0x318) returned 1
	[0185.071] CryptDestroyKey (hKey=0x82b100) returned 1
	[0185.071] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.071] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ce2fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0185.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.071] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0185.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.071] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27ce3b4*=0x1, dwFlags=0x0) returned 1
	[0185.071] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x27ce380, dwFlags=0x0) returned 1
	[0185.071] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ce3c4*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x27ce3c4*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0185.071] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ce690*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27ce690*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.071] CryptDestroyKey (hKey=0x82b080) returned 1
	[0185.071] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.072] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.072] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0185.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.072] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.073] GetFileType (hFile=0x318) returned 0x1
	[0185.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.073] GetFileType (hFile=0x318) returned 0x1
	[0185.073] WriteFile (in: hFile=0x318, lpBuffer=0x27ce8e4*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27ce8e4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0185.074] CloseHandle (hObject=0x318) returned 1
	[0185.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0185.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0185.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.075] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8a54834, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0185.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.075] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0185.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.076] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27cfeec | out: lpFileInformation=0x27cfeec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0185.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0185.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.076] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.076] GetFileType (hFile=0x318) returned 0x1
	[0185.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.076] GetFileType (hFile=0x318) returned 0x1
	[0185.077] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1e0
	[0185.077] ReadFile (in: hFile=0x318, lpBuffer=0x27d04f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27d04f8*, lpNumberOfBytesRead=0x57ff3fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0185.078] CloseHandle (hObject=0x318) returned 1
	[0185.078] CryptDestroyKey (hKey=0x82b340) returned 1
	[0185.078] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.078] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d1594, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b040) returned 1
	[0185.078] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.078] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.078] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0185.078] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.078] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27d164c*=0x1, dwFlags=0x0) returned 1
	[0185.078] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27d1618, dwFlags=0x0) returned 1
	[0185.078] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d165c*, pdwDataLen=0x57ff404*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x27d165c*, pdwDataLen=0x57ff404*=0x1f0) returned 1
	[0185.078] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d1858*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27d1858*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.078] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0185.078] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.078] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.078] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0185.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.078] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.080] GetFileType (hFile=0x318) returned 0x1
	[0185.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.080] GetFileType (hFile=0x318) returned 0x1
	[0185.080] WriteFile (in: hFile=0x318, lpBuffer=0x27d1a74*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27d1a74*, lpNumberOfBytesWritten=0x57ff3c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0185.081] CloseHandle (hObject=0x318) returned 1
	[0185.081] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0185.081] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbd
	[0185.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.081] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8a54834, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0185.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.081] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0185.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.082] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d300c | out: lpFileInformation=0x27d300c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300)) returned 1
	[0185.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.083] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0185.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.083] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.083] GetFileType (hFile=0x318) returned 0x1
	[0185.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.083] GetFileType (hFile=0x318) returned 0x1
	[0185.083] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x300
	[0185.083] ReadFile (in: hFile=0x318, lpBuffer=0x27d37a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27d37a8*, lpNumberOfBytesRead=0x57ff3fc*=0x300, lpOverlapped=0x0) returned 1
	[0185.084] CloseHandle (hObject=0x318) returned 1
	[0185.085] CryptDestroyKey (hKey=0x82b040) returned 1
	[0185.085] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.085] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d4844, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0185.085] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.085] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.085] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0185.085] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.085] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27d48fc*=0x1, dwFlags=0x0) returned 1
	[0185.085] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27d48c8, dwFlags=0x0) returned 1
	[0185.085] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d490c*, pdwDataLen=0x57ff404*=0x310, dwBufLen=0x310 | out: pbData=0x27d490c*, pdwDataLen=0x57ff404*=0x310) returned 1
	[0185.085] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d4c28*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27d4c28*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.085] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0185.085] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.085] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.085] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0185.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.085] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.086] GetFileType (hFile=0x318) returned 0x1
	[0185.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.086] GetFileType (hFile=0x318) returned 0x1
	[0185.086] WriteFile (in: hFile=0x318, lpBuffer=0x27d4e7c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27d4e7c*, lpNumberOfBytesWritten=0x57ff3c4*=0x310, lpOverlapped=0x0) returned 1
	[0185.088] CloseHandle (hObject=0x318) returned 1
	[0185.088] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0185.088] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0185.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.088] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8a7a9ed, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0185.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.088] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.089] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0185.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.089] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d6484 | out: lpFileInformation=0x27d6484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf)) returned 1
	[0185.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.090] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0185.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.090] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.090] GetFileType (hFile=0x318) returned 0x1
	[0185.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.090] GetFileType (hFile=0x318) returned 0x1
	[0185.090] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2bf
	[0185.090] ReadFile (in: hFile=0x318, lpBuffer=0x27d6be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27d6be0*, lpNumberOfBytesRead=0x57ff3fc*=0x2bf, lpOverlapped=0x0) returned 1
	[0185.092] CloseHandle (hObject=0x318) returned 1
	[0185.092] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0185.092] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.092] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d7c7c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b440) returned 1
	[0185.092] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.092] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.092] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0185.092] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.092] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27d7d34*=0x1, dwFlags=0x0) returned 1
	[0185.092] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27d7d00, dwFlags=0x0) returned 1
	[0185.092] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d7d44*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x27d7d44*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0185.092] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d8010*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27d8010*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.092] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0185.092] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.092] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.092] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0185.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.092] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.093] GetFileType (hFile=0x318) returned 0x1
	[0185.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.093] GetFileType (hFile=0x318) returned 0x1
	[0185.093] WriteFile (in: hFile=0x318, lpBuffer=0x27d8264*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27d8264*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0185.094] CloseHandle (hObject=0x318) returned 1
	[0185.094] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0185.094] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0185.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.094] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8a7a9ed, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0185.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.095] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0185.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.096] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d986c | out: lpFileInformation=0x27d986c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a)) returned 1
	[0185.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.096] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0185.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.096] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.096] GetFileType (hFile=0x318) returned 0x1
	[0185.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.096] GetFileType (hFile=0x318) returned 0x1
	[0185.096] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x28a
	[0185.096] ReadFile (in: hFile=0x318, lpBuffer=0x27d9fa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27d9fa4*, lpNumberOfBytesRead=0x57ff3fc*=0x28a, lpOverlapped=0x0) returned 1
	[0185.097] CloseHandle (hObject=0x318) returned 1
	[0185.097] CryptDestroyKey (hKey=0x82b440) returned 1
	[0185.098] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.098] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27db040, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0185.098] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.098] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.098] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0185.098] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.098] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27db0f8*=0x1, dwFlags=0x0) returned 1
	[0185.098] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27db0c4, dwFlags=0x0) returned 1
	[0185.098] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27db108*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x27db108*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0185.098] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27db3a4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27db3a4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.098] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.098] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.098] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.098] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0185.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.098] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.099] GetFileType (hFile=0x318) returned 0x1
	[0185.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.099] GetFileType (hFile=0x318) returned 0x1
	[0185.099] WriteFile (in: hFile=0x318, lpBuffer=0x27db600*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27db600*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0185.100] CloseHandle (hObject=0x318) returned 1
	[0185.103] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0185.103] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0185.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.103] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8a7a9ed, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0185.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.103] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.104] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.104] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27dcc18 | out: lpFileInformation=0x27dcc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4)) returned 1
	[0185.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.104] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.104] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.105] GetFileType (hFile=0x318) returned 0x1
	[0185.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.105] GetFileType (hFile=0x318) returned 0x1
	[0185.105] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c4
	[0185.105] ReadFile (in: hFile=0x318, lpBuffer=0x27dd388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27dd388*, lpNumberOfBytesRead=0x57ff3fc*=0x2c4, lpOverlapped=0x0) returned 1
	[0185.131] CloseHandle (hObject=0x318) returned 1
	[0185.131] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0185.131] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.131] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27de424, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b2c0) returned 1
	[0185.131] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.131] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.131] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0185.131] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.131] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27de4dc*=0x1, dwFlags=0x0) returned 1
	[0185.131] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27de4a8, dwFlags=0x0) returned 1
	[0185.131] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27de4ec*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27de4ec*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0185.131] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27de7c8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27de7c8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.131] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0185.131] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.131] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.132] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.132] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.133] GetFileType (hFile=0x318) returned 0x1
	[0185.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.133] GetFileType (hFile=0x318) returned 0x1
	[0185.133] WriteFile (in: hFile=0x318, lpBuffer=0x27dea24*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27dea24*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0185.134] CloseHandle (hObject=0x318) returned 1
	[0185.134] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.135] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0185.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.135] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8ac6eba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0185.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.135] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0185.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.136] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e0048 | out: lpFileInformation=0x27e0048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285)) returned 1
	[0185.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0185.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.137] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.137] GetFileType (hFile=0x318) returned 0x1
	[0185.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.137] GetFileType (hFile=0x318) returned 0x1
	[0185.137] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x285
	[0185.137] ReadFile (in: hFile=0x318, lpBuffer=0x27e076c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27e076c*, lpNumberOfBytesRead=0x57ff3fc*=0x285, lpOverlapped=0x0) returned 1
	[0185.139] CloseHandle (hObject=0x318) returned 1
	[0185.139] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0185.139] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.139] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e1808, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b080) returned 1
	[0185.139] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.139] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.139] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0185.139] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.139] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27e18c0*=0x1, dwFlags=0x0) returned 1
	[0185.139] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27e188c, dwFlags=0x0) returned 1
	[0185.139] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e18d0*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x27e18d0*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0185.140] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e1b6c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27e1b6c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.140] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0185.140] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.140] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0185.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.140] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.141] GetFileType (hFile=0x318) returned 0x1
	[0185.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.141] GetFileType (hFile=0x318) returned 0x1
	[0185.141] WriteFile (in: hFile=0x318, lpBuffer=0x27e1dc0*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27e1dc0*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0185.142] CloseHandle (hObject=0x318) returned 1
	[0185.142] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0185.142] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0185.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.143] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8aed234, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0185.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.143] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0185.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.144] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e33d4 | out: lpFileInformation=0x27e33d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284)) returned 1
	[0185.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0185.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.144] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.144] GetFileType (hFile=0x318) returned 0x1
	[0185.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.144] GetFileType (hFile=0x318) returned 0x1
	[0185.144] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x284
	[0185.145] ReadFile (in: hFile=0x318, lpBuffer=0x27e3af4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27e3af4*, lpNumberOfBytesRead=0x57ff3fc*=0x284, lpOverlapped=0x0) returned 1
	[0185.146] CloseHandle (hObject=0x318) returned 1
	[0185.146] CryptDestroyKey (hKey=0x82b080) returned 1
	[0185.146] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.146] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e4b90, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b000) returned 1
	[0185.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.146] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b2c0) returned 1
	[0185.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.147] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x27e4c48*=0x1, dwFlags=0x0) returned 1
	[0185.147] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x27e4c14, dwFlags=0x0) returned 1
	[0185.147] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e4c58*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x27e4c58*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0185.147] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e4ef4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27e4ef4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.147] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0185.147] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.147] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.147] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0185.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.147] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.148] GetFileType (hFile=0x318) returned 0x1
	[0185.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.148] GetFileType (hFile=0x318) returned 0x1
	[0185.148] WriteFile (in: hFile=0x318, lpBuffer=0x27e5148*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27e5148*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0185.149] CloseHandle (hObject=0x318) returned 1
	[0185.149] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0185.149] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0185.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.150] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8aed234, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0185.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.150] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.151] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0185.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.151] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e675c | out: lpFileInformation=0x27e675c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353)) returned 1
	[0185.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.151] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0185.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.152] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.152] GetFileType (hFile=0x318) returned 0x1
	[0185.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.152] GetFileType (hFile=0x318) returned 0x1
	[0185.152] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x353
	[0185.152] ReadFile (in: hFile=0x318, lpBuffer=0x27e6f7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27e6f7c*, lpNumberOfBytesRead=0x57ff3fc*=0x353, lpOverlapped=0x0) returned 1
	[0185.153] CloseHandle (hObject=0x318) returned 1
	[0185.154] CryptDestroyKey (hKey=0x82b000) returned 1
	[0185.154] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.154] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e8018, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0185.154] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.154] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.154] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0185.154] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.154] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27e80d0*=0x1, dwFlags=0x0) returned 1
	[0185.154] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27e809c, dwFlags=0x0) returned 1
	[0185.154] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e80e0*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x27e80e0*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0185.154] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e844c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27e844c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.154] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0185.154] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.154] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.154] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0185.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.154] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.156] GetFileType (hFile=0x318) returned 0x1
	[0185.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.156] GetFileType (hFile=0x318) returned 0x1
	[0185.156] WriteFile (in: hFile=0x318, lpBuffer=0x27e86b8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27e86b8*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0185.157] CloseHandle (hObject=0x318) returned 1
	[0185.157] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0185.157] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0185.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.157] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8b13366, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0185.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.157] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.158] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.158] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e9cf0 | out: lpFileInformation=0x27e9cf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0185.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.159] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.159] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.159] GetFileType (hFile=0x318) returned 0x1
	[0185.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.159] GetFileType (hFile=0x318) returned 0x1
	[0185.159] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1e0
	[0185.159] ReadFile (in: hFile=0x318, lpBuffer=0x27ea2fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27ea2fc*, lpNumberOfBytesRead=0x57ff3fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0185.160] CloseHandle (hObject=0x318) returned 1
	[0185.160] CryptDestroyKey (hKey=0x82b280) returned 1
	[0185.160] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.160] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27eb398, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b480) returned 1
	[0185.160] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.160] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.161] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0185.161] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.161] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27eb450*=0x1, dwFlags=0x0) returned 1
	[0185.161] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x27eb41c, dwFlags=0x0) returned 1
	[0185.161] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27eb460*, pdwDataLen=0x57ff404*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x27eb460*, pdwDataLen=0x57ff404*=0x1f0) returned 1
	[0185.161] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27eb65c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27eb65c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.161] CryptDestroyKey (hKey=0x82b080) returned 1
	[0185.161] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.161] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.161] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.161] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.162] GetFileType (hFile=0x318) returned 0x1
	[0185.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.162] GetFileType (hFile=0x318) returned 0x1
	[0185.162] WriteFile (in: hFile=0x318, lpBuffer=0x27eb878*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27eb878*, lpNumberOfBytesWritten=0x57ff3c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0185.163] CloseHandle (hObject=0x318) returned 1
	[0185.163] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.163] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0185.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.164] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8b13366, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0185.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.164] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.183] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.183] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ece1c | out: lpFileInformation=0x27ece1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1)) returned 1
	[0185.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.184] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.184] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.184] GetFileType (hFile=0x318) returned 0x1
	[0185.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.184] GetFileType (hFile=0x318) returned 0x1
	[0185.184] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c1
	[0185.184] ReadFile (in: hFile=0x318, lpBuffer=0x27ed58c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27ed58c*, lpNumberOfBytesRead=0x57ff3fc*=0x2c1, lpOverlapped=0x0) returned 1
	[0185.186] CloseHandle (hObject=0x318) returned 1
	[0185.186] CryptDestroyKey (hKey=0x82b480) returned 1
	[0185.186] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.186] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ee628, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b300) returned 1
	[0185.186] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.186] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.186] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b440) returned 1
	[0185.186] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.186] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x27ee6e0*=0x1, dwFlags=0x0) returned 1
	[0185.186] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x27ee6ac, dwFlags=0x0) returned 1
	[0185.186] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ee6f0*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27ee6f0*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0185.186] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ee9cc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27ee9cc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.186] CryptDestroyKey (hKey=0x82b440) returned 1
	[0185.186] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.187] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.187] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.187] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.188] GetFileType (hFile=0x318) returned 0x1
	[0185.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.188] GetFileType (hFile=0x318) returned 0x1
	[0185.188] WriteFile (in: hFile=0x318, lpBuffer=0x27eec28*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27eec28*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0185.188] CloseHandle (hObject=0x318) returned 1
	[0185.189] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.189] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0185.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.189] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8b5f80c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0185.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.189] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.190] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.190] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f024c | out: lpFileInformation=0x27f024c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3)) returned 1
	[0185.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.190] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.190] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.190] GetFileType (hFile=0x318) returned 0x1
	[0185.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.190] GetFileType (hFile=0x318) returned 0x1
	[0185.190] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1d3
	[0185.190] ReadFile (in: hFile=0x318, lpBuffer=0x27f084c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27f084c*, lpNumberOfBytesRead=0x57ff3fc*=0x1d3, lpOverlapped=0x0) returned 1
	[0185.191] CloseHandle (hObject=0x318) returned 1
	[0185.191] CryptDestroyKey (hKey=0x82b300) returned 1
	[0185.191] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.191] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f18e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b5c0) returned 1
	[0185.191] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.191] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.191] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0185.191] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.191] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27f19a0*=0x1, dwFlags=0x0) returned 1
	[0185.192] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27f196c, dwFlags=0x0) returned 1
	[0185.192] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f19b0*, pdwDataLen=0x57ff404*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x27f19b0*, pdwDataLen=0x57ff404*=0x1e0) returned 1
	[0185.192] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f1b9c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27f1b9c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.192] CryptDestroyKey (hKey=0x82b280) returned 1
	[0185.192] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.192] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.192] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.192] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.193] GetFileType (hFile=0x318) returned 0x1
	[0185.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.193] GetFileType (hFile=0x318) returned 0x1
	[0185.193] WriteFile (in: hFile=0x318, lpBuffer=0x27f1db8*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27f1db8*, lpNumberOfBytesWritten=0x57ff3c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0185.194] CloseHandle (hObject=0x318) returned 1
	[0185.194] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0185.194] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0185.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.194] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8b5f80c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0185.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.194] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.195] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0185.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.195] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f335c | out: lpFileInformation=0x27f335c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x33b)) returned 1
	[0185.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.196] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0185.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.196] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.196] GetFileType (hFile=0x318) returned 0x1
	[0185.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.196] GetFileType (hFile=0x318) returned 0x1
	[0185.196] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x33b
	[0185.196] ReadFile (in: hFile=0x318, lpBuffer=0x27f3b04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27f3b04*, lpNumberOfBytesRead=0x57ff3fc*=0x33b, lpOverlapped=0x0) returned 1
	[0185.197] CloseHandle (hObject=0x318) returned 1
	[0185.197] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0185.197] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.197] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f4ba0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b400) returned 1
	[0185.197] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.197] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.197] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0185.198] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.198] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27f4c58*=0x1, dwFlags=0x0) returned 1
	[0185.198] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27f4c24, dwFlags=0x0) returned 1
	[0185.198] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f4c68*, pdwDataLen=0x57ff404*=0x340, dwBufLen=0x340 | out: pbData=0x27f4c68*, pdwDataLen=0x57ff404*=0x340) returned 1
	[0185.198] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f4fb4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27f4fb4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.198] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0185.198] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.198] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.198] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0185.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.198] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.199] GetFileType (hFile=0x318) returned 0x1
	[0185.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.199] GetFileType (hFile=0x318) returned 0x1
	[0185.199] WriteFile (in: hFile=0x318, lpBuffer=0x27f51f0*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27f51f0*, lpNumberOfBytesWritten=0x57ff3c4*=0x340, lpOverlapped=0x0) returned 1
	[0185.200] CloseHandle (hObject=0x318) returned 1
	[0185.200] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0185.200] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc6
	[0185.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.200] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8b859e7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1
	[0185.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.200] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.201] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.201] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f67d4 | out: lpFileInformation=0x27f67d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x317)) returned 1
	[0185.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.201] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.202] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.202] GetFileType (hFile=0x318) returned 0x1
	[0185.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.202] GetFileType (hFile=0x318) returned 0x1
	[0185.202] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x317
	[0185.202] ReadFile (in: hFile=0x318, lpBuffer=0x27f6f98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27f6f98*, lpNumberOfBytesRead=0x57ff3fc*=0x317, lpOverlapped=0x0) returned 1
	[0185.203] CloseHandle (hObject=0x318) returned 1
	[0185.203] CryptDestroyKey (hKey=0x82b400) returned 1
	[0185.203] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.203] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f8034, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0185.203] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.203] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.204] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b400) returned 1
	[0185.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.204] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x27f80ec*=0x1, dwFlags=0x0) returned 1
	[0185.204] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x27f80b8, dwFlags=0x0) returned 1
	[0185.204] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f80fc*, pdwDataLen=0x57ff404*=0x320, dwBufLen=0x320 | out: pbData=0x27f80fc*, pdwDataLen=0x57ff404*=0x320) returned 1
	[0185.204] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f8428*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27f8428*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.204] CryptDestroyKey (hKey=0x82b400) returned 1
	[0185.204] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.204] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.204] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.204] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.205] GetFileType (hFile=0x318) returned 0x1
	[0185.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.205] GetFileType (hFile=0x318) returned 0x1
	[0185.205] WriteFile (in: hFile=0x318, lpBuffer=0x27f8684*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27f8684*, lpNumberOfBytesWritten=0x57ff3c4*=0x320, lpOverlapped=0x0) returned 1
	[0185.206] CloseHandle (hObject=0x318) returned 1
	[0185.206] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0185.206] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0185.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.206] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8b859e7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1
	[0185.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.207] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.208] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f9ca8 | out: lpFileInformation=0x27f9ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x389)) returned 1
	[0185.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.208] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.208] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.208] GetFileType (hFile=0x318) returned 0x1
	[0185.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.208] GetFileType (hFile=0x318) returned 0x1
	[0185.208] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x389
	[0185.208] ReadFile (in: hFile=0x318, lpBuffer=0x27fa4f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27fa4f0*, lpNumberOfBytesRead=0x57ff3fc*=0x389, lpOverlapped=0x0) returned 1
	[0185.210] CloseHandle (hObject=0x318) returned 1
	[0185.210] CryptDestroyKey (hKey=0x82b540) returned 1
	[0185.210] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.210] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fb58c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0185.210] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.210] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.210] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0185.210] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.210] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27fb644*=0x1, dwFlags=0x0) returned 1
	[0185.210] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27fb610, dwFlags=0x0) returned 1
	[0185.210] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27fb654*, pdwDataLen=0x57ff404*=0x390, dwBufLen=0x390 | out: pbData=0x27fb654*, pdwDataLen=0x57ff404*=0x390) returned 1
	[0185.210] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fb9f0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27fb9f0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.210] CryptDestroyKey (hKey=0x82b480) returned 1
	[0185.210] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.210] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.210] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.210] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.211] GetFileType (hFile=0x318) returned 0x1
	[0185.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.211] GetFileType (hFile=0x318) returned 0x1
	[0185.211] WriteFile (in: hFile=0x318, lpBuffer=0x27fbc54*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27fbc54*, lpNumberOfBytesWritten=0x57ff3c4*=0x390, lpOverlapped=0x0) returned 1
	[0185.212] CloseHandle (hObject=0x318) returned 1
	[0185.212] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.212] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0185.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.213] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8b859e7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x390)) returned 1
	[0185.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.213] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.214] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27fd27c | out: lpFileInformation=0x27fd27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307)) returned 1
	[0185.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.214] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.214] GetFileType (hFile=0x318) returned 0x1
	[0185.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.214] GetFileType (hFile=0x318) returned 0x1
	[0185.214] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x307
	[0185.214] ReadFile (in: hFile=0x318, lpBuffer=0x27fda40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27fda40*, lpNumberOfBytesRead=0x57ff3fc*=0x307, lpOverlapped=0x0) returned 1
	[0185.239] CloseHandle (hObject=0x318) returned 1
	[0185.239] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0185.239] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.239] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27feadc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b080) returned 1
	[0185.239] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.239] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.239] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0185.239] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.239] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27feb94*=0x1, dwFlags=0x0) returned 1
	[0185.239] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27feb60, dwFlags=0x0) returned 1
	[0185.239] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27feba4*, pdwDataLen=0x57ff404*=0x310, dwBufLen=0x310 | out: pbData=0x27feba4*, pdwDataLen=0x57ff404*=0x310) returned 1
	[0185.239] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27feec0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27feec0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.239] CryptDestroyKey (hKey=0x82b540) returned 1
	[0185.239] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.239] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.239] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.239] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.240] GetFileType (hFile=0x318) returned 0x1
	[0185.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.241] GetFileType (hFile=0x318) returned 0x1
	[0185.241] WriteFile (in: hFile=0x318, lpBuffer=0x27ff124*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27ff124*, lpNumberOfBytesWritten=0x57ff3c4*=0x310, lpOverlapped=0x0) returned 1
	[0185.241] CloseHandle (hObject=0x318) returned 1
	[0185.241] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.242] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0185.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.242] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8bd1f11, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0185.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.242] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.243] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0185.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.243] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2800758 | out: lpFileInformation=0x2800758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x357)) returned 1
	[0185.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.243] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0185.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.243] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.244] GetFileType (hFile=0x318) returned 0x1
	[0185.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.244] GetFileType (hFile=0x318) returned 0x1
	[0185.244] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x357
	[0185.244] ReadFile (in: hFile=0x318, lpBuffer=0x2800fbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2800fbc*, lpNumberOfBytesRead=0x57ff3fc*=0x357, lpOverlapped=0x0) returned 1
	[0185.245] CloseHandle (hObject=0x318) returned 1
	[0185.245] CryptDestroyKey (hKey=0x82b080) returned 1
	[0185.245] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.245] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2802058, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0185.245] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.245] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.245] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0185.246] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.246] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2802110*=0x1, dwFlags=0x0) returned 1
	[0185.246] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x28020dc, dwFlags=0x0) returned 1
	[0185.246] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2802120*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x2802120*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0185.246] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x280248c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x280248c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.246] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0185.246] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.246] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.246] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0185.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.246] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.247] GetFileType (hFile=0x318) returned 0x1
	[0185.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.247] GetFileType (hFile=0x318) returned 0x1
	[0185.247] WriteFile (in: hFile=0x318, lpBuffer=0x2802718*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2802718*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0185.248] CloseHandle (hObject=0x318) returned 1
	[0185.250] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0185.250] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xda
	[0185.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.250] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8bf823f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0185.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.250] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.251] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0185.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.251] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26030b8 | out: lpFileInformation=0x26030b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a541c1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a541c1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a541c1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0185.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.251] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0185.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.251] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.251] GetFileType (hFile=0x318) returned 0x1
	[0185.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.251] GetFileType (hFile=0x318) returned 0x1
	[0185.251] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c3
	[0185.251] ReadFile (in: hFile=0x318, lpBuffer=0x2603848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2603848*, lpNumberOfBytesRead=0x57ff3fc*=0x2c3, lpOverlapped=0x0) returned 1
	[0185.253] CloseHandle (hObject=0x318) returned 1
	[0185.253] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.253] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.253] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26048e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b300) returned 1
	[0185.253] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.253] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.253] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0185.253] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.253] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x260499c*=0x1, dwFlags=0x0) returned 1
	[0185.253] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2604968, dwFlags=0x0) returned 1
	[0185.253] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26049ac*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26049ac*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0185.253] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2604c88*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2604c88*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.253] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0185.253] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.254] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.254] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0185.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.254] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.255] GetFileType (hFile=0x318) returned 0x1
	[0185.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.255] GetFileType (hFile=0x318) returned 0x1
	[0185.255] WriteFile (in: hFile=0x318, lpBuffer=0x2604ef4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2604ef4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0185.256] CloseHandle (hObject=0x318) returned 1
	[0185.256] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0185.256] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd2
	[0185.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.256] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a541c1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a541c1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8bf823f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0185.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.256] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.257] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0185.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.257] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2606538 | out: lpFileInformation=0x2606538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a541c1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a541c1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a541c1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da)) returned 1
	[0185.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.257] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0185.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.257] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.257] GetFileType (hFile=0x318) returned 0x1
	[0185.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.257] GetFileType (hFile=0x318) returned 0x1
	[0185.258] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2da
	[0185.258] ReadFile (in: hFile=0x318, lpBuffer=0x2606d20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2606d20*, lpNumberOfBytesRead=0x57ff3fc*=0x2da, lpOverlapped=0x0) returned 1
	[0185.266] CloseHandle (hObject=0x318) returned 1
	[0185.266] CryptDestroyKey (hKey=0x82b300) returned 1
	[0185.266] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.266] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2607dbc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b300) returned 1
	[0185.266] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.266] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.266] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0185.266] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.266] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2607e74*=0x1, dwFlags=0x0) returned 1
	[0185.266] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2607e40, dwFlags=0x0) returned 1
	[0185.266] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2607e84*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2607e84*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0185.266] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2608170*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2608170*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.266] CryptDestroyKey (hKey=0x82b540) returned 1
	[0185.266] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.266] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0185.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.267] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.268] GetFileType (hFile=0x318) returned 0x1
	[0185.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.268] GetFileType (hFile=0x318) returned 0x1
	[0185.268] WriteFile (in: hFile=0x318, lpBuffer=0x26083fc*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26083fc*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.269] CloseHandle (hObject=0x318) returned 1
	[0185.269] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0185.269] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xda
	[0185.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.269] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a541c1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a541c1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8c1e379, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.269] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.270] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.270] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2609a80 | out: lpFileInformation=0x2609a80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7)) returned 1
	[0185.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.270] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.270] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.270] GetFileType (hFile=0x318) returned 0x1
	[0185.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.271] GetFileType (hFile=0x318) returned 0x1
	[0185.271] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d7
	[0185.271] ReadFile (in: hFile=0x318, lpBuffer=0x260a214, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x260a214*, lpNumberOfBytesRead=0x57ff3fc*=0x2d7, lpOverlapped=0x0) returned 1
	[0185.272] CloseHandle (hObject=0x318) returned 1
	[0185.272] CryptDestroyKey (hKey=0x82b300) returned 1
	[0185.272] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.272] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260b2b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0185.272] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.272] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.272] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0185.272] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.272] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x260b368*=0x1, dwFlags=0x0) returned 1
	[0185.272] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x260b334, dwFlags=0x0) returned 1
	[0185.272] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260b378*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x260b378*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0185.273] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260b664*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x260b664*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.273] CryptDestroyKey (hKey=0x82b080) returned 1
	[0185.273] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.273] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.273] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.273] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.274] GetFileType (hFile=0x318) returned 0x1
	[0185.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.274] GetFileType (hFile=0x318) returned 0x1
	[0185.274] WriteFile (in: hFile=0x318, lpBuffer=0x260b8c8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x260b8c8*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.275] CloseHandle (hObject=0x318) returned 1
	[0185.275] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.275] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0185.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.275] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8c445d6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.275] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.276] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.276] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x260cef0 | out: lpFileInformation=0x260cef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e2)) returned 1
	[0185.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.277] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.277] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.277] GetFileType (hFile=0x318) returned 0x1
	[0185.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.277] GetFileType (hFile=0x318) returned 0x1
	[0185.277] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2e2
	[0185.277] ReadFile (in: hFile=0x318, lpBuffer=0x260d690, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x260d690*, lpNumberOfBytesRead=0x57ff3fc*=0x2e2, lpOverlapped=0x0) returned 1
	[0185.284] CloseHandle (hObject=0x318) returned 1
	[0185.284] CryptDestroyKey (hKey=0x82b340) returned 1
	[0185.284] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.284] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260e72c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0185.284] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.284] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.284] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0185.284] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.284] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x260e7e4*=0x1, dwFlags=0x0) returned 1
	[0185.284] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x260e7b0, dwFlags=0x0) returned 1
	[0185.284] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260e7f4*, pdwDataLen=0x57ff404*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x260e7f4*, pdwDataLen=0x57ff404*=0x2f0) returned 1
	[0185.284] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260eaf0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x260eaf0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.284] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0185.285] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.285] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.285] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.285] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.286] GetFileType (hFile=0x318) returned 0x1
	[0185.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.286] GetFileType (hFile=0x318) returned 0x1
	[0185.286] WriteFile (in: hFile=0x318, lpBuffer=0x260ed54*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x260ed54*, lpNumberOfBytesWritten=0x57ff3c4*=0x2f0, lpOverlapped=0x0) returned 1
	[0185.287] CloseHandle (hObject=0x318) returned 1
	[0185.287] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0185.287] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0185.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.287] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8c445d6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0185.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.287] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.288] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.288] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x261037c | out: lpFileInformation=0x261037c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc)) returned 1
	[0185.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.288] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.289] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.289] GetFileType (hFile=0x318) returned 0x1
	[0185.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.289] GetFileType (hFile=0x318) returned 0x1
	[0185.289] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2dc
	[0185.289] ReadFile (in: hFile=0x318, lpBuffer=0x2610b14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2610b14*, lpNumberOfBytesRead=0x57ff3fc*=0x2dc, lpOverlapped=0x0) returned 1
	[0185.292] CloseHandle (hObject=0x318) returned 1
	[0185.292] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.292] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.292] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2611bb0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b000) returned 1
	[0185.292] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.292] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.292] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b440) returned 1
	[0185.292] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.292] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2611c68*=0x1, dwFlags=0x0) returned 1
	[0185.292] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2611c34, dwFlags=0x0) returned 1
	[0185.292] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2611c78*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2611c78*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0185.293] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2611f64*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2611f64*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.293] CryptDestroyKey (hKey=0x82b440) returned 1
	[0185.293] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.293] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.293] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.294] GetFileType (hFile=0x318) returned 0x1
	[0185.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.294] GetFileType (hFile=0x318) returned 0x1
	[0185.294] WriteFile (in: hFile=0x318, lpBuffer=0x26121c8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26121c8*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.295] CloseHandle (hObject=0x318) returned 1
	[0185.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0185.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.296] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8c6a7f4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.296] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.296] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.297] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26137fc | out: lpFileInformation=0x26137fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0185.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.298] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.298] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.298] GetFileType (hFile=0x318) returned 0x1
	[0185.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.298] GetFileType (hFile=0x318) returned 0x1
	[0185.298] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2e0
	[0185.298] ReadFile (in: hFile=0x318, lpBuffer=0x2613f98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2613f98*, lpNumberOfBytesRead=0x57ff3fc*=0x2e0, lpOverlapped=0x0) returned 1
	[0185.299] CloseHandle (hObject=0x318) returned 1
	[0185.299] CryptDestroyKey (hKey=0x82b000) returned 1
	[0185.299] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.300] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2615034, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0185.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.300] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0185.300] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.300] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26150ec*=0x1, dwFlags=0x0) returned 1
	[0185.300] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26150b8, dwFlags=0x0) returned 1
	[0185.300] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26150fc*, pdwDataLen=0x57ff404*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x26150fc*, pdwDataLen=0x57ff404*=0x2f0) returned 1
	[0185.300] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26153f8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26153f8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.300] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0185.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.300] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.300] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.300] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.301] GetFileType (hFile=0x318) returned 0x1
	[0185.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.301] GetFileType (hFile=0x318) returned 0x1
	[0185.301] WriteFile (in: hFile=0x318, lpBuffer=0x261565c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x261565c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2f0, lpOverlapped=0x0) returned 1
	[0185.302] CloseHandle (hObject=0x318) returned 1
	[0185.302] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.302] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0185.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.302] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8c6a7f4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0185.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.302] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0185.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.304] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2616c90 | out: lpFileInformation=0x2616c90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0185.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.304] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0185.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0185.304] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.304] GetFileType (hFile=0x318) returned 0x1
	[0185.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0185.304] GetFileType (hFile=0x318) returned 0x1
	[0185.304] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x280
	[0185.304] ReadFile (in: hFile=0x318, lpBuffer=0x261737c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x261737c*, lpNumberOfBytesRead=0x57ff3fc*=0x280, lpOverlapped=0x0) returned 1
	[0185.306] CloseHandle (hObject=0x318) returned 1
	[0185.306] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.306] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.306] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2618418, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0185.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.306] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0185.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0185.306] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26184d0*=0x1, dwFlags=0x0) returned 1
	[0185.306] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x261849c, dwFlags=0x0) returned 1
	[0185.306] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26184e0*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x26184e0*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0185.306] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261877c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x261877c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0185.306] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0185.306] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.306] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0185.306] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0185.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0185.307] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0185.308] GetFileType (hFile=0x318) returned 0x1
	[0185.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0185.308] GetFileType (hFile=0x318) returned 0x1
	[0185.308] WriteFile (in: hFile=0x318, lpBuffer=0x26189b8*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26189b8*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0185.309] CloseHandle (hObject=0x318) returned 1
	[0185.309] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0185.309] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc6
	[0185.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0185.309] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa8c90aca, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0185.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0185.309] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0185.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0185.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0185.310] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2619f9c | out: lpFileInformation=0x2619f9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e8)) returned 1
	[0185.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0185.414] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.528] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.529] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.543] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.549] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.554] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.555] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.717] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.775] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.782] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.783] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.885] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.009] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.072] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.134] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0186.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0186.303] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.303] GetFileType (hFile=0x318) returned 0x1
	[0186.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0186.303] GetFileType (hFile=0x318) returned 0x1
	[0186.303] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2bc
	[0186.303] ReadFile (in: hFile=0x318, lpBuffer=0x26b1370, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26b1370*, lpNumberOfBytesRead=0x57ff3fc*=0x2bc, lpOverlapped=0x0) returned 1
	[0186.305] CloseHandle (hObject=0x318) returned 1
	[0186.305] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.305] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.305] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b240c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b480) returned 1
	[0186.305] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.305] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.305] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0186.305] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.305] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26b24c4*=0x1, dwFlags=0x0) returned 1
	[0186.305] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26b2490, dwFlags=0x0) returned 1
	[0186.305] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b24d4*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x26b24d4*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0186.306] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b27a0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26b27a0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0186.306] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.306] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.306] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.306] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0186.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0186.306] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.311] GetFileType (hFile=0x318) returned 0x1
	[0186.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0186.311] GetFileType (hFile=0x318) returned 0x1
	[0186.311] WriteFile (in: hFile=0x318, lpBuffer=0x26b29ec*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26b29ec*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0186.312] CloseHandle (hObject=0x318) returned 1
	[0186.312] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0186.312] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0186.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0186.312] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa961a115, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0186.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0186.313] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.314] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0186.314] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b3fe4 | out: lpFileInformation=0x26b3fe4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6)) returned 1
	[0186.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0186.314] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0186.315] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.315] GetFileType (hFile=0x318) returned 0x1
	[0186.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0186.315] GetFileType (hFile=0x318) returned 0x1
	[0186.315] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d6
	[0186.315] ReadFile (in: hFile=0x318, lpBuffer=0x26b4768, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26b4768*, lpNumberOfBytesRead=0x57ff3fc*=0x2d6, lpOverlapped=0x0) returned 1
	[0186.316] CloseHandle (hObject=0x318) returned 1
	[0186.317] CryptDestroyKey (hKey=0x82b480) returned 1
	[0186.317] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.317] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b5804, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b080) returned 1
	[0186.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.317] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0186.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.317] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26b58bc*=0x1, dwFlags=0x0) returned 1
	[0186.317] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26b5888, dwFlags=0x0) returned 1
	[0186.317] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b58cc*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26b58cc*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0186.317] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b5bb8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26b5bb8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0186.317] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0186.317] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.317] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.317] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0186.317] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.318] GetFileType (hFile=0x318) returned 0x1
	[0186.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0186.319] GetFileType (hFile=0x318) returned 0x1
	[0186.319] WriteFile (in: hFile=0x318, lpBuffer=0x26b5e14*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26b5e14*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0186.319] CloseHandle (hObject=0x318) returned 1
	[0186.319] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0186.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0186.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0186.320] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa961a115, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0186.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0186.320] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.321] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0186.321] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b7438 | out: lpFileInformation=0x26b7438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be)) returned 1
	[0186.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0186.321] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0186.321] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.321] GetFileType (hFile=0x318) returned 0x1
	[0186.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0186.321] GetFileType (hFile=0x318) returned 0x1
	[0186.321] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2be
	[0186.321] ReadFile (in: hFile=0x318, lpBuffer=0x26b7b94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26b7b94*, lpNumberOfBytesRead=0x57ff3fc*=0x2be, lpOverlapped=0x0) returned 1
	[0186.323] CloseHandle (hObject=0x318) returned 1
	[0186.323] CryptDestroyKey (hKey=0x82b080) returned 1
	[0186.323] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.323] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b8c30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b000) returned 1
	[0186.323] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.323] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.323] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b2c0) returned 1
	[0186.323] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.323] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26b8ce8*=0x1, dwFlags=0x0) returned 1
	[0186.323] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26b8cb4, dwFlags=0x0) returned 1
	[0186.323] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b8cf8*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x26b8cf8*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0186.323] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b8fc4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26b8fc4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0186.323] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0186.323] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.323] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.323] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0186.324] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.325] GetFileType (hFile=0x318) returned 0x1
	[0186.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0186.325] GetFileType (hFile=0x318) returned 0x1
	[0186.325] WriteFile (in: hFile=0x318, lpBuffer=0x26b9218*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26b9218*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0186.326] CloseHandle (hObject=0x318) returned 1
	[0186.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0186.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0186.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0186.326] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9640374, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0186.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0186.326] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.327] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0186.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0186.327] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26ba820 | out: lpFileInformation=0x26ba820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0186.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0186.327] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0186.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0186.327] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.327] GetFileType (hFile=0x318) returned 0x1
	[0186.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0186.328] GetFileType (hFile=0x318) returned 0x1
	[0186.328] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cb
	[0186.328] ReadFile (in: hFile=0x318, lpBuffer=0x26baf98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26baf98*, lpNumberOfBytesRead=0x57ff3fc*=0x2cb, lpOverlapped=0x0) returned 1
	[0186.329] CloseHandle (hObject=0x318) returned 1
	[0186.329] CryptDestroyKey (hKey=0x82b000) returned 1
	[0186.329] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.329] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bc034, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0186.329] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.329] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.329] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0186.329] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.329] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26bc0ec*=0x1, dwFlags=0x0) returned 1
	[0186.329] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26bc0b8, dwFlags=0x0) returned 1
	[0186.330] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bc0fc*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26bc0fc*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0186.330] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bc3d8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26bc3d8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0186.330] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0186.330] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.330] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.330] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0186.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0186.330] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.331] GetFileType (hFile=0x318) returned 0x1
	[0186.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0186.331] GetFileType (hFile=0x318) returned 0x1
	[0186.331] WriteFile (in: hFile=0x318, lpBuffer=0x26bc634*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26bc634*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0186.332] CloseHandle (hObject=0x318) returned 1
	[0186.332] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0186.332] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0186.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0186.332] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9640374, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0186.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0186.332] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.333] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0186.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0186.333] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26bdc4c | out: lpFileInformation=0x26bdc4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c1dec7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ba)) returned 1
	[0186.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0186.334] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0186.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0186.334] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.334] GetFileType (hFile=0x318) returned 0x1
	[0186.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0186.334] GetFileType (hFile=0x318) returned 0x1
	[0186.334] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ba
	[0186.334] ReadFile (in: hFile=0x318, lpBuffer=0x26be384, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26be384*, lpNumberOfBytesRead=0x57ff3fc*=0x2ba, lpOverlapped=0x0) returned 1
	[0186.336] CloseHandle (hObject=0x318) returned 1
	[0186.336] CryptDestroyKey (hKey=0x82b280) returned 1
	[0186.336] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.336] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bf420, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b480) returned 1
	[0186.336] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.336] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.336] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0186.336] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.336] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x26bf4d8*=0x1, dwFlags=0x0) returned 1
	[0186.336] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x26bf4a4, dwFlags=0x0) returned 1
	[0186.336] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bf4e8*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x26bf4e8*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0186.336] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bf7b4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26bf7b4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0186.336] CryptDestroyKey (hKey=0x82b080) returned 1
	[0186.336] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.336] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.337] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0186.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0186.337] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.367] GetFileType (hFile=0x318) returned 0x1
	[0186.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0186.368] GetFileType (hFile=0x318) returned 0x1
	[0186.368] WriteFile (in: hFile=0x318, lpBuffer=0x26bf9f8*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26bf9f8*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0186.369] CloseHandle (hObject=0x318) returned 1
	[0186.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0186.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0186.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0186.369] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa96b2b4f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0186.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0186.369] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.370] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0186.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0186.370] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26c0fe0 | out: lpFileInformation=0x26c0fe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c1dec7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0186.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0186.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.476] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.686] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.745] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.980] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0186.980] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.980] GetFileType (hFile=0x318) returned 0x1
	[0186.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0186.980] GetFileType (hFile=0x318) returned 0x1
	[0186.980] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1d8
	[0186.980] ReadFile (in: hFile=0x318, lpBuffer=0x274a568, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x274a568*, lpNumberOfBytesRead=0x57ff3fc*=0x1d8, lpOverlapped=0x0) returned 1
	[0186.981] CloseHandle (hObject=0x318) returned 1
	[0186.981] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.982] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.982] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274b604, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b300) returned 1
	[0186.982] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.982] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.982] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b440) returned 1
	[0186.982] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.982] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x274b6bc*=0x1, dwFlags=0x0) returned 1
	[0186.982] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x274b688, dwFlags=0x0) returned 1
	[0186.982] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274b6cc*, pdwDataLen=0x57ff404*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x274b6cc*, pdwDataLen=0x57ff404*=0x1e0) returned 1
	[0186.982] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274b8b8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x274b8b8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0186.982] CryptDestroyKey (hKey=0x82b440) returned 1
	[0186.982] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.982] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0186.982] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.984] GetFileType (hFile=0x318) returned 0x1
	[0186.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0186.984] GetFileType (hFile=0x318) returned 0x1
	[0186.984] WriteFile (in: hFile=0x318, lpBuffer=0x274bad4*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x274bad4*, lpNumberOfBytesWritten=0x57ff3c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0186.985] CloseHandle (hObject=0x318) returned 1
	[0186.985] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0186.985] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0186.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0186.985] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9c852cb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0186.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0186.985] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.987] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0186.987] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x274d078 | out: lpFileInformation=0x274d078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a)) returned 1
	[0186.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0186.987] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0186.987] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.988] GetFileType (hFile=0x318) returned 0x1
	[0186.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0186.988] GetFileType (hFile=0x318) returned 0x1
	[0186.988] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x28a
	[0186.988] ReadFile (in: hFile=0x318, lpBuffer=0x274d7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x274d7e0*, lpNumberOfBytesRead=0x57ff3fc*=0x28a, lpOverlapped=0x0) returned 1
	[0186.989] CloseHandle (hObject=0x318) returned 1
	[0186.989] CryptDestroyKey (hKey=0x82b300) returned 1
	[0186.989] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.989] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274e87c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0186.989] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.990] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.990] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0186.990] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.990] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x274e934*=0x1, dwFlags=0x0) returned 1
	[0186.990] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x274e900, dwFlags=0x0) returned 1
	[0186.990] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274e944*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x274e944*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0186.990] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274ebe0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x274ebe0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0186.990] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0186.990] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.990] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0186.990] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.991] GetFileType (hFile=0x318) returned 0x1
	[0186.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0186.992] GetFileType (hFile=0x318) returned 0x1
	[0186.992] WriteFile (in: hFile=0x318, lpBuffer=0x274ee54*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x274ee54*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0186.993] CloseHandle (hObject=0x318) returned 1
	[0186.993] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0186.993] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0186.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0186.993] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9c852cb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0186.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0186.993] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0186.994] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb7
	[0186.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0186.994] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x275049c | out: lpFileInformation=0x275049c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d7548b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2a1)) returned 1
	[0186.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0186.995] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb7
	[0186.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0186.995] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.995] GetFileType (hFile=0x318) returned 0x1
	[0186.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0186.995] GetFileType (hFile=0x318) returned 0x1
	[0186.995] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2a1
	[0186.995] ReadFile (in: hFile=0x318, lpBuffer=0x2750cac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2750cac*, lpNumberOfBytesRead=0x57ff3fc*=0x2a1, lpOverlapped=0x0) returned 1
	[0186.997] CloseHandle (hObject=0x318) returned 1
	[0186.997] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0186.997] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.997] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2751d48, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0186.997] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.997] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.997] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0186.997] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0186.997] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2751e00*=0x1, dwFlags=0x0) returned 1
	[0186.998] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2751dcc, dwFlags=0x0) returned 1
	[0186.998] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2751e10*, pdwDataLen=0x57ff404*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x2751e10*, pdwDataLen=0x57ff404*=0x2b0) returned 1
	[0186.998] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27520cc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27520cc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0186.998] CryptDestroyKey (hKey=0x82b480) returned 1
	[0186.998] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.998] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0186.998] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb7
	[0186.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0186.998] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0186.999] GetFileType (hFile=0x318) returned 0x1
	[0186.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0186.999] GetFileType (hFile=0x318) returned 0x1
	[0186.999] WriteFile (in: hFile=0x318, lpBuffer=0x2752388*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2752388*, lpNumberOfBytesWritten=0x57ff3c4*=0x2b0, lpOverlapped=0x0) returned 1
	[0187.000] CloseHandle (hObject=0x318) returned 1
	[0187.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb7
	[0187.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe6
	[0187.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.001] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9cab57a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2b0)) returned 1
	[0187.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.001] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.002] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0187.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.002] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2753a6c | out: lpFileInformation=0x2753a6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d7548b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f8)) returned 1
	[0187.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.002] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0187.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.003] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.003] GetFileType (hFile=0x318) returned 0x1
	[0187.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.003] GetFileType (hFile=0x318) returned 0x1
	[0187.003] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1f8
	[0187.003] ReadFile (in: hFile=0x318, lpBuffer=0x27541b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27541b0*, lpNumberOfBytesRead=0x57ff3fc*=0x1f8, lpOverlapped=0x0) returned 1
	[0187.004] CloseHandle (hObject=0x318) returned 1
	[0187.005] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.005] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.005] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275524c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0187.005] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.005] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.005] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b040) returned 1
	[0187.005] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.005] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2755304*=0x1, dwFlags=0x0) returned 1
	[0187.005] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x27552d0, dwFlags=0x0) returned 1
	[0187.005] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2755314*, pdwDataLen=0x57ff404*=0x200, dwBufLen=0x200 | out: pbData=0x2755314*, pdwDataLen=0x57ff404*=0x200) returned 1
	[0187.005] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2755520*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2755520*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.005] CryptDestroyKey (hKey=0x82b040) returned 1
	[0187.005] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.005] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.005] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0187.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.005] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.007] GetFileType (hFile=0x318) returned 0x1
	[0187.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.007] GetFileType (hFile=0x318) returned 0x1
	[0187.007] WriteFile (in: hFile=0x318, lpBuffer=0x27557cc*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27557cc*, lpNumberOfBytesWritten=0x57ff3c4*=0x200, lpOverlapped=0x0) returned 1
	[0187.008] CloseHandle (hObject=0x318) returned 1
	[0187.062] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0187.062] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe1
	[0187.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.062] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9cab57a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1
	[0187.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.062] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.064] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaf
	[0187.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.064] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2756e84 | out: lpFileInformation=0x2756e84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d7548b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e2)) returned 1
	[0187.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.065] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaf
	[0187.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.065] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.065] GetFileType (hFile=0x318) returned 0x1
	[0187.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.065] GetFileType (hFile=0x318) returned 0x1
	[0187.065] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2e2
	[0187.065] ReadFile (in: hFile=0x318, lpBuffer=0x2757694, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2757694*, lpNumberOfBytesRead=0x57ff3fc*=0x2e2, lpOverlapped=0x0) returned 1
	[0187.067] CloseHandle (hObject=0x318) returned 1
	[0187.067] CryptDestroyKey (hKey=0x82b280) returned 1
	[0187.067] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.067] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2758730, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b2c0) returned 1
	[0187.067] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.067] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.067] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0187.067] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.067] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27587e8*=0x1, dwFlags=0x0) returned 1
	[0187.067] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27587b4, dwFlags=0x0) returned 1
	[0187.067] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27587f8*, pdwDataLen=0x57ff404*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x27587f8*, pdwDataLen=0x57ff404*=0x2f0) returned 1
	[0187.067] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2758af4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2758af4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.067] CryptDestroyKey (hKey=0x82b300) returned 1
	[0187.067] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.067] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.068] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaf
	[0187.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.068] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.069] GetFileType (hFile=0x318) returned 0x1
	[0187.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.069] GetFileType (hFile=0x318) returned 0x1
	[0187.069] WriteFile (in: hFile=0x318, lpBuffer=0x2758d90*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2758d90*, lpNumberOfBytesWritten=0x57ff3c4*=0x2f0, lpOverlapped=0x0) returned 1
	[0187.070] CloseHandle (hObject=0x318) returned 1
	[0187.070] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaf
	[0187.070] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xde
	[0187.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.071] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9d43ec0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0187.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.071] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.072] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0187.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.072] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x275a434 | out: lpFileInformation=0x275a434*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d7548b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc)) returned 1
	[0187.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.073] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0187.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.073] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.073] GetFileType (hFile=0x318) returned 0x1
	[0187.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.073] GetFileType (hFile=0x318) returned 0x1
	[0187.073] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2dc
	[0187.073] ReadFile (in: hFile=0x318, lpBuffer=0x275ac0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x275ac0c*, lpNumberOfBytesRead=0x57ff3fc*=0x2dc, lpOverlapped=0x0) returned 1
	[0187.075] CloseHandle (hObject=0x318) returned 1
	[0187.075] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0187.075] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.075] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275bca8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0187.075] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.075] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.075] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b340) returned 1
	[0187.075] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.075] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x275bd60*=0x1, dwFlags=0x0) returned 1
	[0187.075] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x275bd2c, dwFlags=0x0) returned 1
	[0187.075] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275bd70*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x275bd70*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0187.075] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275c05c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x275c05c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.075] CryptDestroyKey (hKey=0x82b340) returned 1
	[0187.075] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.075] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0187.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.076] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.077] GetFileType (hFile=0x318) returned 0x1
	[0187.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.077] GetFileType (hFile=0x318) returned 0x1
	[0187.077] WriteFile (in: hFile=0x318, lpBuffer=0x275c2e0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x275c2e0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0187.078] CloseHandle (hObject=0x318) returned 1
	[0187.078] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0187.078] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0187.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.078] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9d6a918, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0187.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.078] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.079] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.079] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x275d948 | out: lpFileInformation=0x275d948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901fba3a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901fba3a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901fba3a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e)) returned 1
	[0187.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.079] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.080] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.080] GetFileType (hFile=0x318) returned 0x1
	[0187.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.080] GetFileType (hFile=0x318) returned 0x1
	[0187.080] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x28e
	[0187.080] ReadFile (in: hFile=0x318, lpBuffer=0x275e0b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x275e0b4*, lpNumberOfBytesRead=0x57ff3fc*=0x28e, lpOverlapped=0x0) returned 1
	[0187.081] CloseHandle (hObject=0x318) returned 1
	[0187.081] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.081] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.081] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275f150, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b300) returned 1
	[0187.081] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.081] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.081] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0187.081] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.082] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x275f208*=0x1, dwFlags=0x0) returned 1
	[0187.082] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x275f1d4, dwFlags=0x0) returned 1
	[0187.082] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275f218*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x275f218*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0187.082] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275f4b4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x275f4b4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.082] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.082] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.082] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.082] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.083] GetFileType (hFile=0x318) returned 0x1
	[0187.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.083] GetFileType (hFile=0x318) returned 0x1
	[0187.083] WriteFile (in: hFile=0x318, lpBuffer=0x275f728*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x275f728*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0187.084] CloseHandle (hObject=0x318) returned 1
	[0187.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0187.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0187.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.084] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901fba3a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901fba3a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9d6a918, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0187.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.084] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.085] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0187.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.086] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2760d7c | out: lpFileInformation=0x2760d7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x315)) returned 1
	[0187.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.086] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0187.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.086] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.086] GetFileType (hFile=0x318) returned 0x1
	[0187.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.086] GetFileType (hFile=0x318) returned 0x1
	[0187.086] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x315
	[0187.086] ReadFile (in: hFile=0x318, lpBuffer=0x2761590, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2761590*, lpNumberOfBytesRead=0x57ff3fc*=0x315, lpOverlapped=0x0) returned 1
	[0187.113] CloseHandle (hObject=0x318) returned 1
	[0187.113] CryptDestroyKey (hKey=0x82b300) returned 1
	[0187.113] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.113] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276262c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b0c0) returned 1
	[0187.113] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.113] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.113] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0187.113] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.113] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27626e4*=0x1, dwFlags=0x0) returned 1
	[0187.113] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27626b0, dwFlags=0x0) returned 1
	[0187.113] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27626f4*, pdwDataLen=0x57ff404*=0x320, dwBufLen=0x320 | out: pbData=0x27626f4*, pdwDataLen=0x57ff404*=0x320) returned 1
	[0187.113] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2762a20*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2762a20*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.113] CryptDestroyKey (hKey=0x82b300) returned 1
	[0187.113] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.113] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0187.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.113] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.114] GetFileType (hFile=0x318) returned 0x1
	[0187.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.115] GetFileType (hFile=0x318) returned 0x1
	[0187.115] WriteFile (in: hFile=0x318, lpBuffer=0x2762ca4*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2762ca4*, lpNumberOfBytesWritten=0x57ff3c4*=0x320, lpOverlapped=0x0) returned 1
	[0187.115] CloseHandle (hObject=0x318) returned 1
	[0187.116] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0187.116] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0187.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.116] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xa9db6622, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1
	[0187.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.116] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.117] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaf
	[0187.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.117] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x276430c | out: lpFileInformation=0x276430c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de)) returned 1
	[0187.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.157] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.178] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.279] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.462] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.521] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.693] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.693] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.693] GetFileType (hFile=0x318) returned 0x1
	[0187.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.693] GetFileType (hFile=0x318) returned 0x1
	[0187.693] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1e0
	[0187.693] ReadFile (in: hFile=0x318, lpBuffer=0x27f7edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27f7edc*, lpNumberOfBytesRead=0x57ff3fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0187.694] CloseHandle (hObject=0x318) returned 1
	[0187.694] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.694] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.694] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f8f78, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0187.695] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.695] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.695] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0187.695] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.695] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27f9030*=0x1, dwFlags=0x0) returned 1
	[0187.695] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27f8ffc, dwFlags=0x0) returned 1
	[0187.695] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f9040*, pdwDataLen=0x57ff404*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x27f9040*, pdwDataLen=0x57ff404*=0x1f0) returned 1
	[0187.695] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f923c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27f923c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.695] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.695] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.695] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.695] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.695] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.696] GetFileType (hFile=0x318) returned 0x1
	[0187.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.696] GetFileType (hFile=0x318) returned 0x1
	[0187.697] WriteFile (in: hFile=0x318, lpBuffer=0x27f9458*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27f9458*, lpNumberOfBytesWritten=0x57ff3c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0187.697] CloseHandle (hObject=0x318) returned 1
	[0187.698] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0187.698] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0187.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.698] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa339cb2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0187.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.698] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.700] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0187.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.700] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27fa9fc | out: lpFileInformation=0x27fa9fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd)) returned 1
	[0187.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.700] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0187.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.701] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.701] GetFileType (hFile=0x318) returned 0x1
	[0187.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.701] GetFileType (hFile=0x318) returned 0x1
	[0187.701] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2bd
	[0187.701] ReadFile (in: hFile=0x318, lpBuffer=0x27fb138, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27fb138*, lpNumberOfBytesRead=0x57ff3fc*=0x2bd, lpOverlapped=0x0) returned 1
	[0187.720] CloseHandle (hObject=0x318) returned 1
	[0187.720] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.720] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.720] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fc1d4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0187.720] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.720] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.720] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0187.720] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.720] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27fc28c*=0x1, dwFlags=0x0) returned 1
	[0187.721] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27fc258, dwFlags=0x0) returned 1
	[0187.721] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27fc29c*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x27fc29c*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0187.721] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fc568*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27fc568*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.721] CryptDestroyKey (hKey=0x82b300) returned 1
	[0187.721] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.721] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0187.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.721] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.722] GetFileType (hFile=0x318) returned 0x1
	[0187.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.722] GetFileType (hFile=0x318) returned 0x1
	[0187.723] WriteFile (in: hFile=0x318, lpBuffer=0x27fc7ac*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27fc7ac*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0187.723] CloseHandle (hObject=0x318) returned 1
	[0187.727] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0187.727] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0187.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.727] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa386226, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0187.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.728] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.729] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27fdda0 | out: lpFileInformation=0x27fdda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0187.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.730] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.730] GetFileType (hFile=0x318) returned 0x1
	[0187.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.730] GetFileType (hFile=0x318) returned 0x1
	[0187.730] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ca
	[0187.730] ReadFile (in: hFile=0x318, lpBuffer=0x27fe518, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27fe518*, lpNumberOfBytesRead=0x57ff3fc*=0x2ca, lpOverlapped=0x0) returned 1
	[0187.736] CloseHandle (hObject=0x318) returned 1
	[0187.736] CryptDestroyKey (hKey=0x82b540) returned 1
	[0187.736] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.737] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ff5b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0187.737] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.737] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.737] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b200) returned 1
	[0187.737] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.737] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x27ff66c*=0x1, dwFlags=0x0) returned 1
	[0187.737] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x27ff638, dwFlags=0x0) returned 1
	[0187.737] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ff67c*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27ff67c*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0187.737] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ff958*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27ff958*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.737] CryptDestroyKey (hKey=0x82b200) returned 1
	[0187.737] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.737] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.737] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.737] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.738] GetFileType (hFile=0x318) returned 0x1
	[0187.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.739] GetFileType (hFile=0x318) returned 0x1
	[0187.739] WriteFile (in: hFile=0x318, lpBuffer=0x27ffbb4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27ffbb4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.740] CloseHandle (hObject=0x318) returned 1
	[0187.740] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.740] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0187.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.740] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa3adb5f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.740] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.741] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x28011cc | out: lpFileInformation=0x28011cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0187.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.742] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.742] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.742] GetFileType (hFile=0x318) returned 0x1
	[0187.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.742] GetFileType (hFile=0x318) returned 0x1
	[0187.742] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cd
	[0187.742] ReadFile (in: hFile=0x318, lpBuffer=0x2801948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2801948*, lpNumberOfBytesRead=0x57ff3fc*=0x2cd, lpOverlapped=0x0) returned 1
	[0187.744] CloseHandle (hObject=0x318) returned 1
	[0187.744] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.744] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.744] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28029e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0187.744] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.745] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.745] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0187.746] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.746] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2602e58*=0x1, dwFlags=0x0) returned 1
	[0187.746] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2602e24, dwFlags=0x0) returned 1
	[0187.746] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2602e68*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2602e68*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0187.746] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2603144*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2603144*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.746] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.746] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.746] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.746] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.746] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.747] GetFileType (hFile=0x318) returned 0x1
	[0187.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.747] GetFileType (hFile=0x318) returned 0x1
	[0187.747] WriteFile (in: hFile=0x318, lpBuffer=0x26033a0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26033a0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.748] CloseHandle (hObject=0x318) returned 1
	[0187.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0187.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0187.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.749] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa3d2662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.749] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.750] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.750] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26049b8 | out: lpFileInformation=0x26049b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0187.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.752] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.753] GetFileType (hFile=0x318) returned 0x1
	[0187.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.753] GetFileType (hFile=0x318) returned 0x1
	[0187.753] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x280
	[0187.753] ReadFile (in: hFile=0x318, lpBuffer=0x26050e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26050e4*, lpNumberOfBytesRead=0x57ff3fc*=0x280, lpOverlapped=0x0) returned 1
	[0187.754] CloseHandle (hObject=0x318) returned 1
	[0187.754] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0187.754] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.754] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2606180, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0187.754] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.754] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.754] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0187.754] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.754] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2606238*=0x1, dwFlags=0x0) returned 1
	[0187.754] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2606204, dwFlags=0x0) returned 1
	[0187.755] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2606248*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x2606248*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0187.755] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26064e4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26064e4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.755] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.755] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.755] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.755] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.756] GetFileType (hFile=0x318) returned 0x1
	[0187.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.756] GetFileType (hFile=0x318) returned 0x1
	[0187.756] WriteFile (in: hFile=0x318, lpBuffer=0x2606740*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2606740*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0187.757] CloseHandle (hObject=0x318) returned 1
	[0187.757] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.757] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.757] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa3d2662, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0187.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.758] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.759] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0187.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.759] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2607d64 | out: lpFileInformation=0x2607d64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27e)) returned 1
	[0187.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.759] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0187.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.759] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.759] GetFileType (hFile=0x318) returned 0x1
	[0187.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.759] GetFileType (hFile=0x318) returned 0x1
	[0187.759] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x27e
	[0187.760] ReadFile (in: hFile=0x318, lpBuffer=0x2608460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2608460*, lpNumberOfBytesRead=0x57ff3fc*=0x27e, lpOverlapped=0x0) returned 1
	[0187.761] CloseHandle (hObject=0x318) returned 1
	[0187.761] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.761] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.761] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26094fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0187.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.762] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0187.762] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.762] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26095b4*=0x1, dwFlags=0x0) returned 1
	[0187.762] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2609580, dwFlags=0x0) returned 1
	[0187.762] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26095c4*, pdwDataLen=0x57ff404*=0x280, dwBufLen=0x280 | out: pbData=0x26095c4*, pdwDataLen=0x57ff404*=0x280) returned 1
	[0187.762] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2609850*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2609850*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.762] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0187.762] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.762] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0187.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.762] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.763] GetFileType (hFile=0x318) returned 0x1
	[0187.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.763] GetFileType (hFile=0x318) returned 0x1
	[0187.764] WriteFile (in: hFile=0x318, lpBuffer=0x2609a94*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2609a94*, lpNumberOfBytesWritten=0x57ff3c4*=0x280, lpOverlapped=0x0) returned 1
	[0187.765] CloseHandle (hObject=0x318) returned 1
	[0187.765] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0187.765] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0187.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.765] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa3f88e3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0187.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.765] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.766] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x260b07c | out: lpFileInformation=0x260b07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a)) returned 1
	[0187.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.766] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.767] GetFileType (hFile=0x318) returned 0x1
	[0187.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.767] GetFileType (hFile=0x318) returned 0x1
	[0187.767] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x28a
	[0187.767] ReadFile (in: hFile=0x318, lpBuffer=0x260b7a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x260b7a4*, lpNumberOfBytesRead=0x57ff3fc*=0x28a, lpOverlapped=0x0) returned 1
	[0187.769] CloseHandle (hObject=0x318) returned 1
	[0187.770] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.770] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.770] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260c840, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0187.770] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.770] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.770] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0187.770] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.770] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x260c8f8*=0x1, dwFlags=0x0) returned 1
	[0187.770] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x260c8c4, dwFlags=0x0) returned 1
	[0187.770] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260c908*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x260c908*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0187.770] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260cba4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x260cba4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.770] CryptDestroyKey (hKey=0x82b100) returned 1
	[0187.770] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.770] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.770] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.772] GetFileType (hFile=0x318) returned 0x1
	[0187.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.772] GetFileType (hFile=0x318) returned 0x1
	[0187.772] WriteFile (in: hFile=0x318, lpBuffer=0x260cdf8*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x260cdf8*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0187.773] CloseHandle (hObject=0x318) returned 1
	[0187.773] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.773] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0187.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.773] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa3f88e3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0187.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.773] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.774] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0187.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.774] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x260e400 | out: lpFileInformation=0x260e400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2)) returned 1
	[0187.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.774] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0187.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.775] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.775] GetFileType (hFile=0x318) returned 0x1
	[0187.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.775] GetFileType (hFile=0x318) returned 0x1
	[0187.775] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c2
	[0187.775] ReadFile (in: hFile=0x318, lpBuffer=0x260eb30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x260eb30*, lpNumberOfBytesRead=0x57ff3fc*=0x2c2, lpOverlapped=0x0) returned 1
	[0187.789] CloseHandle (hObject=0x318) returned 1
	[0187.789] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.789] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.789] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260fbcc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b200) returned 1
	[0187.789] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.789] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.789] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b040) returned 1
	[0187.789] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.789] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x260fc84*=0x1, dwFlags=0x0) returned 1
	[0187.789] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x260fc50, dwFlags=0x0) returned 1
	[0187.789] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260fc94*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x260fc94*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0187.789] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260ff70*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x260ff70*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.789] CryptDestroyKey (hKey=0x82b040) returned 1
	[0187.789] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.790] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.790] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0187.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.790] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.791] GetFileType (hFile=0x318) returned 0x1
	[0187.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.791] GetFileType (hFile=0x318) returned 0x1
	[0187.791] WriteFile (in: hFile=0x318, lpBuffer=0x26101ac*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26101ac*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.792] CloseHandle (hObject=0x318) returned 1
	[0187.792] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0187.792] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc5
	[0187.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.792] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa444d85, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.792] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.793] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0187.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.793] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2611784 | out: lpFileInformation=0x2611784*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be)) returned 1
	[0187.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0187.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.794] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.794] GetFileType (hFile=0x318) returned 0x1
	[0187.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.794] GetFileType (hFile=0x318) returned 0x1
	[0187.794] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2be
	[0187.794] ReadFile (in: hFile=0x318, lpBuffer=0x2611eb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2611eb0*, lpNumberOfBytesRead=0x57ff3fc*=0x2be, lpOverlapped=0x0) returned 1
	[0187.800] CloseHandle (hObject=0x318) returned 1
	[0187.800] CryptDestroyKey (hKey=0x82b200) returned 1
	[0187.800] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.800] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2612f4c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0187.800] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.800] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.801] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b040) returned 1
	[0187.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.801] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2613004*=0x1, dwFlags=0x0) returned 1
	[0187.801] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2612fd0, dwFlags=0x0) returned 1
	[0187.801] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2613014*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x2613014*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0187.801] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26132e0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26132e0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.801] CryptDestroyKey (hKey=0x82b040) returned 1
	[0187.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0187.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.801] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.802] GetFileType (hFile=0x318) returned 0x1
	[0187.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.802] GetFileType (hFile=0x318) returned 0x1
	[0187.802] WriteFile (in: hFile=0x318, lpBuffer=0x261351c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x261351c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0187.803] CloseHandle (hObject=0x318) returned 1
	[0187.803] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0187.803] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc5
	[0187.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.803] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa444d85, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0187.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.803] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.805] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2614af4 | out: lpFileInformation=0x2614af4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90221ca6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353)) returned 1
	[0187.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.805] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.805] GetFileType (hFile=0x318) returned 0x1
	[0187.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.805] GetFileType (hFile=0x318) returned 0x1
	[0187.805] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x353
	[0187.805] ReadFile (in: hFile=0x318, lpBuffer=0x26152d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26152d4*, lpNumberOfBytesRead=0x57ff3fc*=0x353, lpOverlapped=0x0) returned 1
	[0187.813] CloseHandle (hObject=0x318) returned 1
	[0187.813] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.813] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.813] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2616370, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0187.813] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.813] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.813] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b000) returned 1
	[0187.813] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.813] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2616428*=0x1, dwFlags=0x0) returned 1
	[0187.813] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x26163f4, dwFlags=0x0) returned 1
	[0187.813] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2616438*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x2616438*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0187.813] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26167a4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26167a4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.813] CryptDestroyKey (hKey=0x82b000) returned 1
	[0187.813] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.813] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.813] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.814] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.815] GetFileType (hFile=0x318) returned 0x1
	[0187.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.815] GetFileType (hFile=0x318) returned 0x1
	[0187.815] WriteFile (in: hFile=0x318, lpBuffer=0x26169f0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26169f0*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0187.816] CloseHandle (hObject=0x318) returned 1
	[0187.816] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.816] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0187.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.816] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa46ee0a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0187.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.816] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.817] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0187.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.817] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2617ff4 | out: lpFileInformation=0x2617ff4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1de)) returned 1
	[0187.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.817] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0187.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.818] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.818] GetFileType (hFile=0x318) returned 0x1
	[0187.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.818] GetFileType (hFile=0x318) returned 0x1
	[0187.818] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1de
	[0187.818] ReadFile (in: hFile=0x318, lpBuffer=0x2618680, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2618680*, lpNumberOfBytesRead=0x57ff3fc*=0x1de, lpOverlapped=0x0) returned 1
	[0187.819] CloseHandle (hObject=0x318) returned 1
	[0187.819] CryptDestroyKey (hKey=0x82b280) returned 1
	[0187.819] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.819] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261971c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b040) returned 1
	[0187.819] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.819] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.819] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0187.819] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.819] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26197d4*=0x1, dwFlags=0x0) returned 1
	[0187.819] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26197a0, dwFlags=0x0) returned 1
	[0187.819] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26197e4*, pdwDataLen=0x57ff404*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x26197e4*, pdwDataLen=0x57ff404*=0x1e0) returned 1
	[0187.819] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26199d0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26199d0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.819] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.819] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.820] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.820] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0187.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.820] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.821] GetFileType (hFile=0x318) returned 0x1
	[0187.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.821] GetFileType (hFile=0x318) returned 0x1
	[0187.821] WriteFile (in: hFile=0x318, lpBuffer=0x2619c2c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2619c2c*, lpNumberOfBytesWritten=0x57ff3c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0187.822] CloseHandle (hObject=0x318) returned 1
	[0187.822] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0187.822] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0187.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.823] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa46ee0a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0187.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.860] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.862] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x261b244 | out: lpFileInformation=0x261b244*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0187.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.862] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.863] GetFileType (hFile=0x318) returned 0x1
	[0187.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.863] GetFileType (hFile=0x318) returned 0x1
	[0187.863] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c9
	[0187.863] ReadFile (in: hFile=0x318, lpBuffer=0x261b9bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x261b9bc*, lpNumberOfBytesRead=0x57ff3fc*=0x2c9, lpOverlapped=0x0) returned 1
	[0187.864] CloseHandle (hObject=0x318) returned 1
	[0187.864] CryptDestroyKey (hKey=0x82b040) returned 1
	[0187.865] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.865] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261ca58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0187.865] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.865] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.865] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0187.865] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.865] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x261cb10*=0x1, dwFlags=0x0) returned 1
	[0187.865] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x261cadc, dwFlags=0x0) returned 1
	[0187.865] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261cb20*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x261cb20*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0187.865] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261cdfc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x261cdfc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.865] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.865] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.865] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.865] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.865] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.866] GetFileType (hFile=0x318) returned 0x1
	[0187.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.867] GetFileType (hFile=0x318) returned 0x1
	[0187.867] WriteFile (in: hFile=0x318, lpBuffer=0x261d058*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x261d058*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.868] CloseHandle (hObject=0x318) returned 1
	[0187.868] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.868] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.868] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa4dd6e2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.868] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0187.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.869] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x261e67c | out: lpFileInformation=0x261e67c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f65464, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f65464, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f65464, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0187.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0187.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.871] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.871] GetFileType (hFile=0x318) returned 0x1
	[0187.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.871] GetFileType (hFile=0x318) returned 0x1
	[0187.871] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c8
	[0187.871] ReadFile (in: hFile=0x318, lpBuffer=0x261edd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x261edd0*, lpNumberOfBytesRead=0x57ff3fc*=0x2c8, lpOverlapped=0x0) returned 1
	[0187.872] CloseHandle (hObject=0x318) returned 1
	[0187.872] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.872] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.872] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261fe6c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0187.873] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.873] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.873] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0187.873] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.873] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x261ff24*=0x1, dwFlags=0x0) returned 1
	[0187.873] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x261fef0, dwFlags=0x0) returned 1
	[0187.873] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261ff34*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x261ff34*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0187.873] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2620210*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2620210*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.873] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.873] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.873] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.873] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0187.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.873] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.875] GetFileType (hFile=0x318) returned 0x1
	[0187.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.875] GetFileType (hFile=0x318) returned 0x1
	[0187.875] WriteFile (in: hFile=0x318, lpBuffer=0x262045c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x262045c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.876] CloseHandle (hObject=0x318) returned 1
	[0187.876] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0187.876] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0187.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.876] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f65464, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f65464, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa503963, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.876] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.877] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.878] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2621a54 | out: lpFileInformation=0x2621a54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f65464, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f65464, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f65464, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28d)) returned 1
	[0187.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.878] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.878] GetFileType (hFile=0x318) returned 0x1
	[0187.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.878] GetFileType (hFile=0x318) returned 0x1
	[0187.878] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x28d
	[0187.878] ReadFile (in: hFile=0x318, lpBuffer=0x2622180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2622180*, lpNumberOfBytesRead=0x57ff3fc*=0x28d, lpOverlapped=0x0) returned 1
	[0187.880] CloseHandle (hObject=0x318) returned 1
	[0187.880] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.880] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.880] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262321c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0187.880] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.880] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.880] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0187.880] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.880] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26232d4*=0x1, dwFlags=0x0) returned 1
	[0187.880] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x26232a0, dwFlags=0x0) returned 1
	[0187.881] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26232e4*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x26232e4*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0187.881] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2623580*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2623580*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.881] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0187.881] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.881] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.881] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.882] GetFileType (hFile=0x318) returned 0x1
	[0187.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.882] GetFileType (hFile=0x318) returned 0x1
	[0187.882] WriteFile (in: hFile=0x318, lpBuffer=0x26237d4*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26237d4*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0187.883] CloseHandle (hObject=0x318) returned 1
	[0187.884] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0187.884] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0187.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.884] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f65464, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f65464, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa503963, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0187.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.884] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.885] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0187.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.885] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2624ddc | out: lpFileInformation=0x2624ddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f65464, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f65464, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f65464, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287)) returned 1
	[0187.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.919] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0187.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.919] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.919] GetFileType (hFile=0x318) returned 0x1
	[0187.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.919] GetFileType (hFile=0x318) returned 0x1
	[0187.919] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x287
	[0187.919] ReadFile (in: hFile=0x318, lpBuffer=0x26254f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26254f0*, lpNumberOfBytesRead=0x57ff3fc*=0x287, lpOverlapped=0x0) returned 1
	[0187.928] CloseHandle (hObject=0x318) returned 1
	[0187.928] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.928] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.928] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262658c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b400) returned 1
	[0187.928] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.928] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.929] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0187.929] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.929] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2626644*=0x1, dwFlags=0x0) returned 1
	[0187.929] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2626610, dwFlags=0x0) returned 1
	[0187.929] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2626654*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x2626654*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0187.929] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26268f0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26268f0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.929] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.929] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.929] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0187.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.929] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.930] GetFileType (hFile=0x318) returned 0x1
	[0187.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.931] GetFileType (hFile=0x318) returned 0x1
	[0187.931] WriteFile (in: hFile=0x318, lpBuffer=0x2626b3c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2626b3c*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0187.932] CloseHandle (hObject=0x318) returned 1
	[0187.932] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0187.932] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0187.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.932] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f65464, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f65464, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa5760ee, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0187.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.932] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.933] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0187.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.934] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2628134 | out: lpFileInformation=0x2628134*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0187.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.934] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0187.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.934] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.934] GetFileType (hFile=0x318) returned 0x1
	[0187.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.934] GetFileType (hFile=0x318) returned 0x1
	[0187.934] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cc
	[0187.934] ReadFile (in: hFile=0x318, lpBuffer=0x26288bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26288bc*, lpNumberOfBytesRead=0x57ff3fc*=0x2cc, lpOverlapped=0x0) returned 1
	[0187.939] CloseHandle (hObject=0x318) returned 1
	[0187.939] CryptDestroyKey (hKey=0x82b400) returned 1
	[0187.939] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.939] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2629958, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0187.939] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.939] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.939] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b400) returned 1
	[0187.939] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.939] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2629a10*=0x1, dwFlags=0x0) returned 1
	[0187.939] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x26299dc, dwFlags=0x0) returned 1
	[0187.939] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2629a20*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2629a20*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0187.939] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2629cfc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2629cfc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.939] CryptDestroyKey (hKey=0x82b400) returned 1
	[0187.939] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.939] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.939] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0187.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.940] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.941] GetFileType (hFile=0x318) returned 0x1
	[0187.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.941] GetFileType (hFile=0x318) returned 0x1
	[0187.941] WriteFile (in: hFile=0x318, lpBuffer=0x2629f60*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2629f60*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.942] CloseHandle (hObject=0x318) returned 1
	[0187.942] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0187.942] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0187.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.942] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa59c341, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.942] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.944] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0187.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.944] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x262b588 | out: lpFileInformation=0x262b588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0187.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.944] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0187.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.944] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.944] GetFileType (hFile=0x318) returned 0x1
	[0187.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.944] GetFileType (hFile=0x318) returned 0x1
	[0187.944] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c9
	[0187.944] ReadFile (in: hFile=0x318, lpBuffer=0x262bd10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x262bd10*, lpNumberOfBytesRead=0x57ff3fc*=0x2c9, lpOverlapped=0x0) returned 1
	[0187.947] CloseHandle (hObject=0x318) returned 1
	[0187.947] CryptDestroyKey (hKey=0x82b540) returned 1
	[0187.947] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.947] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262cdac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0187.947] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.947] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.947] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0187.947] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.948] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x262ce64*=0x1, dwFlags=0x0) returned 1
	[0187.948] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x262ce30, dwFlags=0x0) returned 1
	[0187.948] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262ce74*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x262ce74*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0187.948] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262d150*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x262d150*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.948] CryptDestroyKey (hKey=0x82b480) returned 1
	[0187.948] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.948] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.948] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0187.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.948] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.949] GetFileType (hFile=0x318) returned 0x1
	[0187.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.949] GetFileType (hFile=0x318) returned 0x1
	[0187.950] WriteFile (in: hFile=0x318, lpBuffer=0x262d3b4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x262d3b4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.950] CloseHandle (hObject=0x318) returned 1
	[0187.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0187.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0187.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.951] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa5c25a8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.951] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.952] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x262e9dc | out: lpFileInformation=0x262e9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287)) returned 1
	[0187.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.953] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.953] GetFileType (hFile=0x318) returned 0x1
	[0187.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.953] GetFileType (hFile=0x318) returned 0x1
	[0187.953] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x287
	[0187.953] ReadFile (in: hFile=0x318, lpBuffer=0x262f120, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x262f120*, lpNumberOfBytesRead=0x57ff3fc*=0x287, lpOverlapped=0x0) returned 1
	[0187.960] CloseHandle (hObject=0x318) returned 1
	[0187.961] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0187.961] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.961] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26301bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b080) returned 1
	[0187.961] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.961] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.961] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0187.961] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.961] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2630274*=0x1, dwFlags=0x0) returned 1
	[0187.961] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2630240, dwFlags=0x0) returned 1
	[0187.961] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2630284*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x2630284*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0187.961] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2630520*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2630520*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.961] CryptDestroyKey (hKey=0x82b540) returned 1
	[0187.961] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.961] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.961] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.961] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.963] GetFileType (hFile=0x318) returned 0x1
	[0187.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.963] GetFileType (hFile=0x318) returned 0x1
	[0187.963] WriteFile (in: hFile=0x318, lpBuffer=0x2630784*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2630784*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0187.964] CloseHandle (hObject=0x318) returned 1
	[0187.964] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0187.964] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0187.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.965] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa5e8777, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0187.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.965] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.966] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0187.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.966] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2631db8 | out: lpFileInformation=0x2631db8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0187.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.966] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0187.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.966] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.966] GetFileType (hFile=0x318) returned 0x1
	[0187.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.967] GetFileType (hFile=0x318) returned 0x1
	[0187.967] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cf
	[0187.967] ReadFile (in: hFile=0x318, lpBuffer=0x2632554, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2632554*, lpNumberOfBytesRead=0x57ff3fc*=0x2cf, lpOverlapped=0x0) returned 1
	[0187.968] CloseHandle (hObject=0x318) returned 1
	[0187.968] CryptDestroyKey (hKey=0x82b080) returned 1
	[0187.968] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.968] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26335f0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0187.968] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.969] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.969] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0187.969] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.969] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26336a8*=0x1, dwFlags=0x0) returned 1
	[0187.969] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2633674, dwFlags=0x0) returned 1
	[0187.969] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26336b8*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26336b8*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0187.969] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2633994*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2633994*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.969] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0187.969] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.969] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.969] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0187.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.969] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.970] GetFileType (hFile=0x318) returned 0x1
	[0187.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.971] GetFileType (hFile=0x318) returned 0x1
	[0187.971] WriteFile (in: hFile=0x318, lpBuffer=0x2633c00*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2633c00*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.972] CloseHandle (hObject=0x318) returned 1
	[0187.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0187.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0187.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.972] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa5e8777, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0187.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.972] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.973] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2635238 | out: lpFileInformation=0x2635238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1)) returned 1
	[0187.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.974] ReadFile (in: hFile=0x318, lpBuffer=0x26359b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26359b8*, lpNumberOfBytesRead=0x57ff3fc*=0x2d1, lpOverlapped=0x0) returned 1
	[0187.988] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.988] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.988] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2636a54, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b300) returned 1
	[0187.988] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.988] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.988] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0187.988] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.988] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2636b0c*=0x1, dwFlags=0x0) returned 1
	[0187.988] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2636ad8, dwFlags=0x0) returned 1
	[0187.988] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2636b1c*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2636b1c*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0187.988] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2636e08*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2636e08*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.988] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0187.988] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.988] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.989] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.990] GetFileType (hFile=0x318) returned 0x1
	[0187.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.990] GetFileType (hFile=0x318) returned 0x1
	[0187.990] WriteFile (in: hFile=0x318, lpBuffer=0x2637064*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2637064*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0187.991] CloseHandle (hObject=0x318) returned 1
	[0187.991] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0187.991] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0187.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0187.991] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa60ef0b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0187.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0187.991] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0187.993] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0187.993] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2638688 | out: lpFileInformation=0x2638688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90247f0e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90247f0e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90247f0e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352)) returned 1
	[0187.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0187.994] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0187.994] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.994] GetFileType (hFile=0x318) returned 0x1
	[0187.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0187.994] GetFileType (hFile=0x318) returned 0x1
	[0187.994] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x352
	[0187.994] ReadFile (in: hFile=0x318, lpBuffer=0x2638e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2638e68*, lpNumberOfBytesRead=0x57ff3fc*=0x352, lpOverlapped=0x0) returned 1
	[0187.996] CloseHandle (hObject=0x318) returned 1
	[0187.996] CryptDestroyKey (hKey=0x82b300) returned 1
	[0187.996] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.996] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2639f04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0187.996] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.996] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.996] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0187.996] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0187.996] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2639fbc*=0x1, dwFlags=0x0) returned 1
	[0187.996] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2639f88, dwFlags=0x0) returned 1
	[0187.997] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2639fcc*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x2639fcc*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0187.997] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263a338*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x263a338*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0187.997] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0187.997] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.997] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0187.997] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0187.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0187.997] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0187.998] GetFileType (hFile=0x318) returned 0x1
	[0187.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0187.998] GetFileType (hFile=0x318) returned 0x1
	[0187.998] WriteFile (in: hFile=0x318, lpBuffer=0x263a584*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x263a584*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0187.999] CloseHandle (hObject=0x318) returned 1
	[0188.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0188.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.000] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90247f0e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90247f0e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa634c91, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0188.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.000] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0188.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.001] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x263bb88 | out: lpFileInformation=0x263bb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fb18e0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27d)) returned 1
	[0188.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.002] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0188.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.002] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.002] GetFileType (hFile=0x318) returned 0x1
	[0188.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.002] GetFileType (hFile=0x318) returned 0x1
	[0188.002] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x27d
	[0188.002] ReadFile (in: hFile=0x318, lpBuffer=0x263c274, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x263c274*, lpNumberOfBytesRead=0x57ff3fc*=0x27d, lpOverlapped=0x0) returned 1
	[0188.004] CloseHandle (hObject=0x318) returned 1
	[0188.004] CryptDestroyKey (hKey=0x82b100) returned 1
	[0188.004] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.004] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263d310, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b300) returned 1
	[0188.004] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.004] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.004] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b340) returned 1
	[0188.004] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.004] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x263d3c8*=0x1, dwFlags=0x0) returned 1
	[0188.004] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x263d394, dwFlags=0x0) returned 1
	[0188.004] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263d3d8*, pdwDataLen=0x57ff404*=0x280, dwBufLen=0x280 | out: pbData=0x263d3d8*, pdwDataLen=0x57ff404*=0x280) returned 1
	[0188.004] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263d664*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x263d664*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.004] CryptDestroyKey (hKey=0x82b340) returned 1
	[0188.004] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.004] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.004] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0188.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.005] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.006] GetFileType (hFile=0x318) returned 0x1
	[0188.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.006] GetFileType (hFile=0x318) returned 0x1
	[0188.006] WriteFile (in: hFile=0x318, lpBuffer=0x263d8a0*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x263d8a0*, lpNumberOfBytesWritten=0x57ff3c4*=0x280, lpOverlapped=0x0) returned 1
	[0188.007] CloseHandle (hObject=0x318) returned 1
	[0188.007] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0188.007] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc6
	[0188.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.007] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa634c91, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0188.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.007] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.008] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0188.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.009] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x263ee84 | out: lpFileInformation=0x263ee84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fb18e0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a)) returned 1
	[0188.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.009] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0188.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.009] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.009] GetFileType (hFile=0x318) returned 0x1
	[0188.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.010] GetFileType (hFile=0x318) returned 0x1
	[0188.010] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x28a
	[0188.010] ReadFile (in: hFile=0x318, lpBuffer=0x263f5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x263f5ac*, lpNumberOfBytesRead=0x57ff3fc*=0x28a, lpOverlapped=0x0) returned 1
	[0188.011] CloseHandle (hObject=0x318) returned 1
	[0188.011] CryptDestroyKey (hKey=0x82b300) returned 1
	[0188.011] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.012] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2640648, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0188.012] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.012] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.012] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0188.012] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.012] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2640700*=0x1, dwFlags=0x0) returned 1
	[0188.012] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x26406cc, dwFlags=0x0) returned 1
	[0188.012] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2640710*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x2640710*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0188.012] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26409ac*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26409ac*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.012] CryptDestroyKey (hKey=0x82b080) returned 1
	[0188.012] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.012] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.012] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0188.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.012] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.013] GetFileType (hFile=0x318) returned 0x1
	[0188.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.014] GetFileType (hFile=0x318) returned 0x1
	[0188.014] WriteFile (in: hFile=0x318, lpBuffer=0x2640c00*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2640c00*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0188.015] CloseHandle (hObject=0x318) returned 1
	[0188.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0188.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0188.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.015] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa65ae73, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0188.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.015] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.017] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2642208 | out: lpFileInformation=0x2642208*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fb18e0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0188.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.017] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.017] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.017] GetFileType (hFile=0x318) returned 0x1
	[0188.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.017] GetFileType (hFile=0x318) returned 0x1
	[0188.018] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cc
	[0188.018] ReadFile (in: hFile=0x318, lpBuffer=0x2642970, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2642970*, lpNumberOfBytesRead=0x57ff3fc*=0x2cc, lpOverlapped=0x0) returned 1
	[0188.019] CloseHandle (hObject=0x318) returned 1
	[0188.019] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.019] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.020] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2643a0c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b400) returned 1
	[0188.020] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.020] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.020] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0188.020] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.020] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2643ac4*=0x1, dwFlags=0x0) returned 1
	[0188.020] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2643a90, dwFlags=0x0) returned 1
	[0188.020] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2643ad4*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2643ad4*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0188.020] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2643db0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2643db0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.020] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.020] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.020] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.020] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.020] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.022] GetFileType (hFile=0x318) returned 0x1
	[0188.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.022] GetFileType (hFile=0x318) returned 0x1
	[0188.022] WriteFile (in: hFile=0x318, lpBuffer=0x2644004*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2644004*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.023] CloseHandle (hObject=0x318) returned 1
	[0188.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0188.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.023] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa65ae73, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.023] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.024] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.024] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2645618 | out: lpFileInformation=0x2645618*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fb18e0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x344)) returned 1
	[0188.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.051] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.051] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.051] GetFileType (hFile=0x318) returned 0x1
	[0188.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.051] GetFileType (hFile=0x318) returned 0x1
	[0188.051] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x344
	[0188.051] ReadFile (in: hFile=0x318, lpBuffer=0x2645df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2645df8*, lpNumberOfBytesRead=0x57ff3fc*=0x344, lpOverlapped=0x0) returned 1
	[0188.053] CloseHandle (hObject=0x318) returned 1
	[0188.053] CryptDestroyKey (hKey=0x82b400) returned 1
	[0188.053] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.053] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2646e94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0188.053] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.053] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.053] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0188.053] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.053] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2646f4c*=0x1, dwFlags=0x0) returned 1
	[0188.053] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2646f18, dwFlags=0x0) returned 1
	[0188.053] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2646f5c*, pdwDataLen=0x57ff404*=0x350, dwBufLen=0x350 | out: pbData=0x2646f5c*, pdwDataLen=0x57ff404*=0x350) returned 1
	[0188.053] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26472b8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26472b8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.053] CryptDestroyKey (hKey=0x82b480) returned 1
	[0188.053] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.053] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.054] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.054] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.055] GetFileType (hFile=0x318) returned 0x1
	[0188.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.055] GetFileType (hFile=0x318) returned 0x1
	[0188.055] WriteFile (in: hFile=0x318, lpBuffer=0x264750c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x264750c*, lpNumberOfBytesWritten=0x57ff3c4*=0x350, lpOverlapped=0x0) returned 1
	[0188.056] CloseHandle (hObject=0x318) returned 1
	[0188.056] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.056] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0188.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.056] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa6a7388, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0188.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.057] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.058] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0188.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.058] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2648b20 | out: lpFileInformation=0x2648b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fd7b44, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27f)) returned 1
	[0188.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.059] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0188.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.059] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.059] GetFileType (hFile=0x318) returned 0x1
	[0188.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.059] GetFileType (hFile=0x318) returned 0x1
	[0188.059] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x27f
	[0188.059] ReadFile (in: hFile=0x318, lpBuffer=0x264923c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x264923c*, lpNumberOfBytesRead=0x57ff3fc*=0x27f, lpOverlapped=0x0) returned 1
	[0188.061] CloseHandle (hObject=0x318) returned 1
	[0188.061] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.061] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.061] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264a2d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0188.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.061] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0188.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.061] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x264a390*=0x1, dwFlags=0x0) returned 1
	[0188.061] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x264a35c, dwFlags=0x0) returned 1
	[0188.061] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264a3a0*, pdwDataLen=0x57ff404*=0x280, dwBufLen=0x280 | out: pbData=0x264a3a0*, pdwDataLen=0x57ff404*=0x280) returned 1
	[0188.061] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264a62c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x264a62c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.061] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0188.061] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.061] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.062] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0188.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.062] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.063] GetFileType (hFile=0x318) returned 0x1
	[0188.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.063] GetFileType (hFile=0x318) returned 0x1
	[0188.063] WriteFile (in: hFile=0x318, lpBuffer=0x264a880*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x264a880*, lpNumberOfBytesWritten=0x57ff3c4*=0x280, lpOverlapped=0x0) returned 1
	[0188.064] CloseHandle (hObject=0x318) returned 1
	[0188.064] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0188.064] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0188.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.064] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa6cd56a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1
	[0188.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.064] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0188.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.066] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x264be88 | out: lpFileInformation=0x264be88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fd7b44, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0188.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0188.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.066] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.066] GetFileType (hFile=0x318) returned 0x1
	[0188.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.066] GetFileType (hFile=0x318) returned 0x1
	[0188.067] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cb
	[0188.067] ReadFile (in: hFile=0x318, lpBuffer=0x264c620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x264c620*, lpNumberOfBytesRead=0x57ff3fc*=0x2cb, lpOverlapped=0x0) returned 1
	[0188.068] CloseHandle (hObject=0x318) returned 1
	[0188.068] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0188.068] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.068] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264d6bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b440) returned 1
	[0188.068] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.068] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.068] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0188.068] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.069] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x264d774*=0x1, dwFlags=0x0) returned 1
	[0188.069] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x264d740, dwFlags=0x0) returned 1
	[0188.069] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264d784*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x264d784*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0188.069] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264da60*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x264da60*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.069] CryptDestroyKey (hKey=0x82b480) returned 1
	[0188.069] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.069] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0188.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.069] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.070] GetFileType (hFile=0x318) returned 0x1
	[0188.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.070] GetFileType (hFile=0x318) returned 0x1
	[0188.070] WriteFile (in: hFile=0x318, lpBuffer=0x264dccc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x264dccc*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.071] CloseHandle (hObject=0x318) returned 1
	[0188.072] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0188.072] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0188.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.072] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa6cd56a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.072] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.073] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.073] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x264f304 | out: lpFileInformation=0x264f304*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fd7b44, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f2)) returned 1
	[0188.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.074] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.074] GetFileType (hFile=0x318) returned 0x1
	[0188.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.074] GetFileType (hFile=0x318) returned 0x1
	[0188.074] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1f2
	[0188.074] ReadFile (in: hFile=0x318, lpBuffer=0x264f9a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x264f9a4*, lpNumberOfBytesRead=0x57ff3fc*=0x1f2, lpOverlapped=0x0) returned 1
	[0188.076] CloseHandle (hObject=0x318) returned 1
	[0188.076] CryptDestroyKey (hKey=0x82b440) returned 1
	[0188.076] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.076] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2650a40, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0188.076] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.076] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.076] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b040) returned 1
	[0188.076] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.076] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2650af8*=0x1, dwFlags=0x0) returned 1
	[0188.076] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2650ac4, dwFlags=0x0) returned 1
	[0188.076] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2650b08*, pdwDataLen=0x57ff404*=0x200, dwBufLen=0x200 | out: pbData=0x2650b08*, pdwDataLen=0x57ff404*=0x200) returned 1
	[0188.076] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2650d14*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2650d14*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.076] CryptDestroyKey (hKey=0x82b040) returned 1
	[0188.076] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.077] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.077] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.078] GetFileType (hFile=0x318) returned 0x1
	[0188.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.078] GetFileType (hFile=0x318) returned 0x1
	[0188.078] WriteFile (in: hFile=0x318, lpBuffer=0x2650f70*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2650f70*, lpNumberOfBytesWritten=0x57ff3c4*=0x200, lpOverlapped=0x0) returned 1
	[0188.082] CloseHandle (hObject=0x318) returned 1
	[0188.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.083] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0188.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.083] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa6f4025, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1
	[0188.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.083] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.084] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2652588 | out: lpFileInformation=0x2652588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fd7b44, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284)) returned 1
	[0188.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.085] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.085] GetFileType (hFile=0x318) returned 0x1
	[0188.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.085] GetFileType (hFile=0x318) returned 0x1
	[0188.085] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x284
	[0188.085] ReadFile (in: hFile=0x318, lpBuffer=0x2652cb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2652cb8*, lpNumberOfBytesRead=0x57ff3fc*=0x284, lpOverlapped=0x0) returned 1
	[0188.109] CloseHandle (hObject=0x318) returned 1
	[0188.109] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.109] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.109] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2653d54, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0188.110] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.110] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.110] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0188.110] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.110] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2653e0c*=0x1, dwFlags=0x0) returned 1
	[0188.110] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2653dd8, dwFlags=0x0) returned 1
	[0188.110] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2653e1c*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x2653e1c*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0188.110] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26540b8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26540b8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.110] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0188.110] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.110] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.110] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.110] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.111] GetFileType (hFile=0x318) returned 0x1
	[0188.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.111] GetFileType (hFile=0x318) returned 0x1
	[0188.111] WriteFile (in: hFile=0x318, lpBuffer=0x2654314*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2654314*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0188.112] CloseHandle (hObject=0x318) returned 1
	[0188.112] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.112] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0188.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.112] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa73fcba, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0188.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.113] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.114] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0188.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.114] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x265592c | out: lpFileInformation=0x265592c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0188.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.114] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0188.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.114] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.114] GetFileType (hFile=0x318) returned 0x1
	[0188.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.115] GetFileType (hFile=0x318) returned 0x1
	[0188.115] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cb
	[0188.115] ReadFile (in: hFile=0x318, lpBuffer=0x26560b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26560b4*, lpNumberOfBytesRead=0x57ff3fc*=0x2cb, lpOverlapped=0x0) returned 1
	[0188.118] CloseHandle (hObject=0x318) returned 1
	[0188.118] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.118] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.118] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2657150, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0188.118] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.118] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.118] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b2c0) returned 1
	[0188.118] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.118] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2657208*=0x1, dwFlags=0x0) returned 1
	[0188.118] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26571d4, dwFlags=0x0) returned 1
	[0188.118] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2657218*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2657218*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0188.118] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26574f4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26574f4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.118] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0188.118] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.118] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0188.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.118] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.120] GetFileType (hFile=0x318) returned 0x1
	[0188.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.120] GetFileType (hFile=0x318) returned 0x1
	[0188.120] WriteFile (in: hFile=0x318, lpBuffer=0x2657758*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2657758*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.121] CloseHandle (hObject=0x318) returned 1
	[0188.121] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0188.121] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0188.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.121] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa7660d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.121] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0188.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.123] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2658d8c | out: lpFileInformation=0x2658d8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4)) returned 1
	[0188.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0188.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.124] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.124] GetFileType (hFile=0x318) returned 0x1
	[0188.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.124] GetFileType (hFile=0x318) returned 0x1
	[0188.124] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c4
	[0188.124] ReadFile (in: hFile=0x318, lpBuffer=0x265950c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x265950c*, lpNumberOfBytesRead=0x57ff3fc*=0x2c4, lpOverlapped=0x0) returned 1
	[0188.125] CloseHandle (hObject=0x318) returned 1
	[0188.125] CryptDestroyKey (hKey=0x82b100) returned 1
	[0188.125] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.126] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265a5a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0188.126] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.126] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.126] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0188.126] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.126] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x265a660*=0x1, dwFlags=0x0) returned 1
	[0188.126] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x265a62c, dwFlags=0x0) returned 1
	[0188.126] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265a670*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x265a670*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0188.126] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265a94c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x265a94c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.126] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.126] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.126] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.126] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0188.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.126] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.128] GetFileType (hFile=0x318) returned 0x1
	[0188.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.128] GetFileType (hFile=0x318) returned 0x1
	[0188.128] WriteFile (in: hFile=0x318, lpBuffer=0x265abb0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x265abb0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.129] CloseHandle (hObject=0x318) returned 1
	[0188.129] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0188.129] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0188.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.129] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa7660d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.129] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.130] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.131] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x265c1e4 | out: lpFileInformation=0x265c1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90247f0e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90247f0e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90247f0e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354)) returned 1
	[0188.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.131] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.131] GetFileType (hFile=0x318) returned 0x1
	[0188.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.131] GetFileType (hFile=0x318) returned 0x1
	[0188.131] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x354
	[0188.131] ReadFile (in: hFile=0x318, lpBuffer=0x265c9c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x265c9c4*, lpNumberOfBytesRead=0x57ff3fc*=0x354, lpOverlapped=0x0) returned 1
	[0188.133] CloseHandle (hObject=0x318) returned 1
	[0188.133] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.133] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265da60, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0188.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.133] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0188.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.133] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x265db18*=0x1, dwFlags=0x0) returned 1
	[0188.133] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x265dae4, dwFlags=0x0) returned 1
	[0188.133] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265db28*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x265db28*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0188.133] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265de94*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x265de94*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.133] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.133] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.133] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.134] GetFileType (hFile=0x318) returned 0x1
	[0188.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.135] GetFileType (hFile=0x318) returned 0x1
	[0188.135] WriteFile (in: hFile=0x318, lpBuffer=0x265e0e0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x265e0e0*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0188.135] CloseHandle (hObject=0x318) returned 1
	[0188.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0188.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.136] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90247f0e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90247f0e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa78c100, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0188.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.136] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0188.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.137] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x265f6e4 | out: lpFileInformation=0x265f6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf)) returned 1
	[0188.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.138] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0188.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.138] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.138] GetFileType (hFile=0x318) returned 0x1
	[0188.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.138] GetFileType (hFile=0x318) returned 0x1
	[0188.138] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2bf
	[0188.138] ReadFile (in: hFile=0x318, lpBuffer=0x265fe60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x265fe60*, lpNumberOfBytesRead=0x57ff3fc*=0x2bf, lpOverlapped=0x0) returned 1
	[0188.139] CloseHandle (hObject=0x318) returned 1
	[0188.139] CryptDestroyKey (hKey=0x82b100) returned 1
	[0188.139] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.139] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2660efc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0188.140] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.140] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.140] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b2c0) returned 1
	[0188.140] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.140] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2660fb4*=0x1, dwFlags=0x0) returned 1
	[0188.140] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2660f80, dwFlags=0x0) returned 1
	[0188.140] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2660fc4*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x2660fc4*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0188.140] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2661290*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2661290*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.140] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0188.140] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.140] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0188.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.140] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.141] GetFileType (hFile=0x318) returned 0x1
	[0188.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.141] GetFileType (hFile=0x318) returned 0x1
	[0188.141] WriteFile (in: hFile=0x318, lpBuffer=0x26614f4*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26614f4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0188.142] CloseHandle (hObject=0x318) returned 1
	[0188.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0188.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0188.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.143] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa78c100, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0188.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.143] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.144] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2662b28 | out: lpFileInformation=0x2662b28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc)) returned 1
	[0188.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.144] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.145] GetFileType (hFile=0x318) returned 0x1
	[0188.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.145] GetFileType (hFile=0x318) returned 0x1
	[0188.145] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1cc
	[0188.145] ReadFile (in: hFile=0x318, lpBuffer=0x26631a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26631a0*, lpNumberOfBytesRead=0x57ff3fc*=0x1cc, lpOverlapped=0x0) returned 1
	[0188.172] CloseHandle (hObject=0x318) returned 1
	[0188.174] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0188.174] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.174] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266423c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0188.174] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.174] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.174] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0188.174] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.174] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26642f4*=0x1, dwFlags=0x0) returned 1
	[0188.174] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26642c0, dwFlags=0x0) returned 1
	[0188.174] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2664304*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x2664304*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0188.174] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26644e0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26644e0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.174] CryptDestroyKey (hKey=0x82b280) returned 1
	[0188.174] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.174] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.174] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.176] GetFileType (hFile=0x318) returned 0x1
	[0188.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.176] GetFileType (hFile=0x318) returned 0x1
	[0188.176] WriteFile (in: hFile=0x318, lpBuffer=0x266473c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x266473c*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0188.177] CloseHandle (hObject=0x318) returned 1
	[0188.177] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.177] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0188.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.177] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa7d8760, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0188.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.177] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.179] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0188.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.179] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2665d54 | out: lpFileInformation=0x2665d54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4)) returned 1
	[0188.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.180] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0188.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.180] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.180] GetFileType (hFile=0x318) returned 0x1
	[0188.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.180] GetFileType (hFile=0x318) returned 0x1
	[0188.180] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d4
	[0188.181] ReadFile (in: hFile=0x318, lpBuffer=0x2666514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2666514*, lpNumberOfBytesRead=0x57ff3fc*=0x2d4, lpOverlapped=0x0) returned 1
	[0188.183] CloseHandle (hObject=0x318) returned 1
	[0188.183] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0188.183] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.183] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26675b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b2c0) returned 1
	[0188.183] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.183] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.183] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0188.183] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.183] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2667668*=0x1, dwFlags=0x0) returned 1
	[0188.183] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2667634, dwFlags=0x0) returned 1
	[0188.183] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2667678*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2667678*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0188.183] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2667964*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2667964*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.183] CryptDestroyKey (hKey=0x82b300) returned 1
	[0188.183] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.183] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.183] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0188.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.184] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.185] GetFileType (hFile=0x318) returned 0x1
	[0188.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.185] GetFileType (hFile=0x318) returned 0x1
	[0188.185] WriteFile (in: hFile=0x318, lpBuffer=0x2667be0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2667be0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0188.186] CloseHandle (hObject=0x318) returned 1
	[0188.186] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0188.186] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0188.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.186] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa7fe82b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0188.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.187] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.188] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.188] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2669244 | out: lpFileInformation=0x2669244*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0188.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.188] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.188] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.188] GetFileType (hFile=0x318) returned 0x1
	[0188.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.188] GetFileType (hFile=0x318) returned 0x1
	[0188.188] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1e0
	[0188.188] ReadFile (in: hFile=0x318, lpBuffer=0x2669850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2669850*, lpNumberOfBytesRead=0x57ff3fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0188.189] CloseHandle (hObject=0x318) returned 1
	[0188.189] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0188.189] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.189] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266a8ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b0c0) returned 1
	[0188.189] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.190] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.190] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0188.190] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.190] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x266a9a4*=0x1, dwFlags=0x0) returned 1
	[0188.190] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x266a970, dwFlags=0x0) returned 1
	[0188.190] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266a9b4*, pdwDataLen=0x57ff404*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x266a9b4*, pdwDataLen=0x57ff404*=0x1f0) returned 1
	[0188.190] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266abb0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x266abb0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.190] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.190] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.190] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.190] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.190] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.191] GetFileType (hFile=0x318) returned 0x1
	[0188.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.191] GetFileType (hFile=0x318) returned 0x1
	[0188.191] WriteFile (in: hFile=0x318, lpBuffer=0x266adcc*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x266adcc*, lpNumberOfBytesWritten=0x57ff3c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0188.192] CloseHandle (hObject=0x318) returned 1
	[0188.192] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.192] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0188.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.193] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa7fe82b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0188.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.193] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.195] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0188.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.195] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x266c370 | out: lpFileInformation=0x266c370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd)) returned 1
	[0188.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.195] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0188.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.195] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.196] GetFileType (hFile=0x318) returned 0x1
	[0188.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.196] GetFileType (hFile=0x318) returned 0x1
	[0188.196] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2bd
	[0188.196] ReadFile (in: hFile=0x318, lpBuffer=0x266cabc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x266cabc*, lpNumberOfBytesRead=0x57ff3fc*=0x2bd, lpOverlapped=0x0) returned 1
	[0188.198] CloseHandle (hObject=0x318) returned 1
	[0188.198] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0188.198] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.198] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266db58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0188.198] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.198] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.198] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b400) returned 1
	[0188.198] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.198] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x266dc10*=0x1, dwFlags=0x0) returned 1
	[0188.198] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x266dbdc, dwFlags=0x0) returned 1
	[0188.198] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266dc20*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x266dc20*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0188.198] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266deec*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x266deec*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.198] CryptDestroyKey (hKey=0x82b400) returned 1
	[0188.198] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.198] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.198] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0188.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.199] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.200] GetFileType (hFile=0x318) returned 0x1
	[0188.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.200] GetFileType (hFile=0x318) returned 0x1
	[0188.200] WriteFile (in: hFile=0x318, lpBuffer=0x266e138*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x266e138*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0188.201] CloseHandle (hObject=0x318) returned 1
	[0188.201] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0188.201] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0188.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.201] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa824ab8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0188.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.201] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.203] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.203] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x266f730 | out: lpFileInformation=0x266f730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d9)) returned 1
	[0188.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.203] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.203] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.203] GetFileType (hFile=0x318) returned 0x1
	[0188.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.204] GetFileType (hFile=0x318) returned 0x1
	[0188.204] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1d9
	[0188.204] ReadFile (in: hFile=0x318, lpBuffer=0x266fd38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x266fd38*, lpNumberOfBytesRead=0x57ff3fc*=0x1d9, lpOverlapped=0x0) returned 1
	[0188.205] CloseHandle (hObject=0x318) returned 1
	[0188.205] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.205] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.205] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2670dd4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b000) returned 1
	[0188.205] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.205] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.205] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0188.205] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.205] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2670e8c*=0x1, dwFlags=0x0) returned 1
	[0188.205] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2670e58, dwFlags=0x0) returned 1
	[0188.205] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2670e9c*, pdwDataLen=0x57ff404*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x2670e9c*, pdwDataLen=0x57ff404*=0x1e0) returned 1
	[0188.206] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2671088*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2671088*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.206] CryptDestroyKey (hKey=0x82b280) returned 1
	[0188.206] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.206] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.206] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.206] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.207] GetFileType (hFile=0x318) returned 0x1
	[0188.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.207] GetFileType (hFile=0x318) returned 0x1
	[0188.207] WriteFile (in: hFile=0x318, lpBuffer=0x26712a4*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26712a4*, lpNumberOfBytesWritten=0x57ff3c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0188.208] CloseHandle (hObject=0x318) returned 1
	[0188.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0188.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.209] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa824ab8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0188.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.209] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.211] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2672848 | out: lpFileInformation=0x2672848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287)) returned 1
	[0188.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.211] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.211] GetFileType (hFile=0x318) returned 0x1
	[0188.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.212] GetFileType (hFile=0x318) returned 0x1
	[0188.212] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x287
	[0188.212] ReadFile (in: hFile=0x318, lpBuffer=0x2672f5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2672f5c*, lpNumberOfBytesRead=0x57ff3fc*=0x287, lpOverlapped=0x0) returned 1
	[0188.231] CloseHandle (hObject=0x318) returned 1
	[0188.231] CryptDestroyKey (hKey=0x82b000) returned 1
	[0188.231] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.231] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2673ff8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b5c0) returned 1
	[0188.231] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.231] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.232] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b0c0) returned 1
	[0188.232] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.232] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26740b0*=0x1, dwFlags=0x0) returned 1
	[0188.232] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x267407c, dwFlags=0x0) returned 1
	[0188.232] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26740c0*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x26740c0*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0188.232] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267435c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x267435c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.232] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0188.232] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.232] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.232] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.232] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.234] GetFileType (hFile=0x318) returned 0x1
	[0188.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.234] GetFileType (hFile=0x318) returned 0x1
	[0188.234] WriteFile (in: hFile=0x318, lpBuffer=0x26745a8*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26745a8*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0188.235] CloseHandle (hObject=0x318) returned 1
	[0188.235] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.235] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0188.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.235] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa870ff1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0188.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.236] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.237] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.237] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2675bac | out: lpFileInformation=0x2675bac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307)) returned 1
	[0188.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.237] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.237] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.237] GetFileType (hFile=0x318) returned 0x1
	[0188.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.238] GetFileType (hFile=0x318) returned 0x1
	[0188.238] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x307
	[0188.238] ReadFile (in: hFile=0x318, lpBuffer=0x2676350, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2676350*, lpNumberOfBytesRead=0x57ff3fc*=0x307, lpOverlapped=0x0) returned 1
	[0188.239] CloseHandle (hObject=0x318) returned 1
	[0188.239] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0188.239] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.239] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26773ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0188.240] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.240] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.240] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0188.240] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.240] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26774a4*=0x1, dwFlags=0x0) returned 1
	[0188.240] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2677470, dwFlags=0x0) returned 1
	[0188.240] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26774b4*, pdwDataLen=0x57ff404*=0x310, dwBufLen=0x310 | out: pbData=0x26774b4*, pdwDataLen=0x57ff404*=0x310) returned 1
	[0188.240] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26777d0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26777d0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.240] CryptDestroyKey (hKey=0x82b300) returned 1
	[0188.240] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.240] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.240] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.240] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.241] GetFileType (hFile=0x318) returned 0x1
	[0188.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.241] GetFileType (hFile=0x318) returned 0x1
	[0188.241] WriteFile (in: hFile=0x318, lpBuffer=0x2677a24*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2677a24*, lpNumberOfBytesWritten=0x57ff3c4*=0x310, lpOverlapped=0x0) returned 1
	[0188.242] CloseHandle (hObject=0x318) returned 1
	[0188.242] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.242] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0188.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.243] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa870ff1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0188.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.243] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.244] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.244] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2679038 | out: lpFileInformation=0x2679038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x313)) returned 1
	[0188.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.244] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.244] ReadFile (in: hFile=0x318, lpBuffer=0x26797e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26797e8*, lpNumberOfBytesRead=0x57ff3fc*=0x313, lpOverlapped=0x0) returned 1
	[0188.246] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.246] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.246] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267a884, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0188.246] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.246] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.246] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0188.246] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.246] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x267a93c*=0x1, dwFlags=0x0) returned 1
	[0188.246] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x267a908, dwFlags=0x0) returned 1
	[0188.246] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267a94c*, pdwDataLen=0x57ff404*=0x320, dwBufLen=0x320 | out: pbData=0x267a94c*, pdwDataLen=0x57ff404*=0x320) returned 1
	[0188.246] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267ac78*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x267ac78*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.246] CryptDestroyKey (hKey=0x82b300) returned 1
	[0188.246] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.246] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.246] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.247] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.248] GetFileType (hFile=0x318) returned 0x1
	[0188.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.248] GetFileType (hFile=0x318) returned 0x1
	[0188.248] WriteFile (in: hFile=0x318, lpBuffer=0x267aecc*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x267aecc*, lpNumberOfBytesWritten=0x57ff3c4*=0x320, lpOverlapped=0x0) returned 1
	[0188.249] CloseHandle (hObject=0x318) returned 1
	[0188.249] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.249] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0188.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.250] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa8971d4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1
	[0188.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.250] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.251] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0188.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.251] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x267c4e0 | out: lpFileInformation=0x267c4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9104a28e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0188.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.251] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0188.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.251] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.252] GetFileType (hFile=0x318) returned 0x1
	[0188.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.252] GetFileType (hFile=0x318) returned 0x1
	[0188.252] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c3
	[0188.252] ReadFile (in: hFile=0x318, lpBuffer=0x267cc20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x267cc20*, lpNumberOfBytesRead=0x57ff3fc*=0x2c3, lpOverlapped=0x0) returned 1
	[0188.253] CloseHandle (hObject=0x318) returned 1
	[0188.253] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.253] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.253] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267dcbc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0188.253] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.253] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.253] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b200) returned 1
	[0188.254] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.254] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x267dd74*=0x1, dwFlags=0x0) returned 1
	[0188.254] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x267dd40, dwFlags=0x0) returned 1
	[0188.254] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267dd84*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x267dd84*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0188.254] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267e060*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x267e060*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.254] CryptDestroyKey (hKey=0x82b200) returned 1
	[0188.254] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.254] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.254] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0188.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.254] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.255] GetFileType (hFile=0x318) returned 0x1
	[0188.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.256] GetFileType (hFile=0x318) returned 0x1
	[0188.256] WriteFile (in: hFile=0x318, lpBuffer=0x267e2a4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x267e2a4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.257] CloseHandle (hObject=0x318) returned 1
	[0188.257] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0188.257] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0188.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.257] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa8971d4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.257] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.258] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0188.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.258] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x267f898 | out: lpFileInformation=0x267f898*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90247f0e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90247f0e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90247f0e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x309)) returned 1
	[0188.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.259] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0188.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.259] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.259] GetFileType (hFile=0x318) returned 0x1
	[0188.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.259] GetFileType (hFile=0x318) returned 0x1
	[0188.259] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x309
	[0188.259] ReadFile (in: hFile=0x318, lpBuffer=0x2680050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2680050*, lpNumberOfBytesRead=0x57ff3fc*=0x309, lpOverlapped=0x0) returned 1
	[0188.261] CloseHandle (hObject=0x318) returned 1
	[0188.261] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.261] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.261] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26810ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0188.261] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.261] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.261] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0188.261] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.261] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26811a4*=0x1, dwFlags=0x0) returned 1
	[0188.261] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2681170, dwFlags=0x0) returned 1
	[0188.261] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26811b4*, pdwDataLen=0x57ff404*=0x310, dwBufLen=0x310 | out: pbData=0x26811b4*, pdwDataLen=0x57ff404*=0x310) returned 1
	[0188.261] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26814d0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26814d0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.261] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.261] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.261] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0188.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.262] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.263] GetFileType (hFile=0x318) returned 0x1
	[0188.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.263] GetFileType (hFile=0x318) returned 0x1
	[0188.263] WriteFile (in: hFile=0x318, lpBuffer=0x268172c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x268172c*, lpNumberOfBytesWritten=0x57ff3c4*=0x310, lpOverlapped=0x0) returned 1
	[0188.264] CloseHandle (hObject=0x318) returned 1
	[0188.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0188.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0188.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.264] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90247f0e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90247f0e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa8bd330, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0188.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.264] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.265] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0188.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.265] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2682d50 | out: lpFileInformation=0x2682d50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9104a28e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0188.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.266] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.266] GetFileType (hFile=0x318) returned 0x1
	[0188.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.266] GetFileType (hFile=0x318) returned 0x1
	[0188.266] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d0
	[0188.266] ReadFile (in: hFile=0x318, lpBuffer=0x26834bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26834bc*, lpNumberOfBytesRead=0x57ff3fc*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.294] CloseHandle (hObject=0x318) returned 1
	[0188.294] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0188.294] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.295] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2684558, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b000) returned 1
	[0188.295] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.295] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.295] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b440) returned 1
	[0188.295] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.295] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2684610*=0x1, dwFlags=0x0) returned 1
	[0188.295] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26845dc, dwFlags=0x0) returned 1
	[0188.295] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2684620*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2684620*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0188.295] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268490c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x268490c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.295] CryptDestroyKey (hKey=0x82b440) returned 1
	[0188.295] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.295] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0188.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.295] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.296] GetFileType (hFile=0x318) returned 0x1
	[0188.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.296] GetFileType (hFile=0x318) returned 0x1
	[0188.296] WriteFile (in: hFile=0x318, lpBuffer=0x2684b60*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2684b60*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0188.297] CloseHandle (hObject=0x318) returned 1
	[0188.297] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0188.297] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0188.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.298] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa909932, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0188.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.298] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.299] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.299] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2686168 | out: lpFileInformation=0x2686168*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9104a28e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0188.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.300] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.300] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.300] GetFileType (hFile=0x318) returned 0x1
	[0188.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.300] GetFileType (hFile=0x318) returned 0x1
	[0188.301] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c0
	[0188.301] ReadFile (in: hFile=0x318, lpBuffer=0x26868c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26868c4*, lpNumberOfBytesRead=0x57ff3fc*=0x2c0, lpOverlapped=0x0) returned 1
	[0188.302] CloseHandle (hObject=0x318) returned 1
	[0188.302] CryptDestroyKey (hKey=0x82b000) returned 1
	[0188.302] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.302] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2687960, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0188.302] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.302] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.302] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0188.302] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.302] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2687a18*=0x1, dwFlags=0x0) returned 1
	[0188.302] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26879e4, dwFlags=0x0) returned 1
	[0188.302] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2687a28*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2687a28*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0188.302] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2687d04*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2687d04*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.302] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0188.302] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.303] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.303] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.304] GetFileType (hFile=0x318) returned 0x1
	[0188.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.304] GetFileType (hFile=0x318) returned 0x1
	[0188.304] WriteFile (in: hFile=0x318, lpBuffer=0x2687f58*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2687f58*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.305] CloseHandle (hObject=0x318) returned 1
	[0188.305] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.305] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0188.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.305] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa909932, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.305] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.307] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.307] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x268956c | out: lpFileInformation=0x268956c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9104a28e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0188.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.307] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.308] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.308] GetFileType (hFile=0x318) returned 0x1
	[0188.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.308] GetFileType (hFile=0x318) returned 0x1
	[0188.308] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c8
	[0188.308] ReadFile (in: hFile=0x318, lpBuffer=0x2689cd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2689cd0*, lpNumberOfBytesRead=0x57ff3fc*=0x2c8, lpOverlapped=0x0) returned 1
	[0188.310] CloseHandle (hObject=0x318) returned 1
	[0188.310] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.310] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.310] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268ad6c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0188.310] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.310] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.310] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b2c0) returned 1
	[0188.310] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.310] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x268ae24*=0x1, dwFlags=0x0) returned 1
	[0188.310] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x268adf0, dwFlags=0x0) returned 1
	[0188.310] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268ae34*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x268ae34*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0188.310] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268b110*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x268b110*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.310] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0188.310] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.310] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.310] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.312] GetFileType (hFile=0x318) returned 0x1
	[0188.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.312] GetFileType (hFile=0x318) returned 0x1
	[0188.312] WriteFile (in: hFile=0x318, lpBuffer=0x268b364*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x268b364*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.313] CloseHandle (hObject=0x318) returned 1
	[0188.313] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.313] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0188.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.313] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa92fc41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.313] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.314] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.314] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x268c978 | out: lpFileInformation=0x268c978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0188.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.315] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.315] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.315] GetFileType (hFile=0x318) returned 0x1
	[0188.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.315] GetFileType (hFile=0x318) returned 0x1
	[0188.315] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cb
	[0188.315] ReadFile (in: hFile=0x318, lpBuffer=0x268d0e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x268d0e0*, lpNumberOfBytesRead=0x57ff3fc*=0x2cb, lpOverlapped=0x0) returned 1
	[0188.316] CloseHandle (hObject=0x318) returned 1
	[0188.316] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0188.317] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.317] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268e17c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b300) returned 1
	[0188.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.317] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0188.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.317] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x268e234*=0x1, dwFlags=0x0) returned 1
	[0188.317] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x268e200, dwFlags=0x0) returned 1
	[0188.317] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268e244*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x268e244*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0188.317] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268e520*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x268e520*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.317] CryptDestroyKey (hKey=0x82b080) returned 1
	[0188.317] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.317] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.317] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.317] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.318] GetFileType (hFile=0x318) returned 0x1
	[0188.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.319] GetFileType (hFile=0x318) returned 0x1
	[0188.319] WriteFile (in: hFile=0x318, lpBuffer=0x268e774*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x268e774*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.320] CloseHandle (hObject=0x318) returned 1
	[0188.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0188.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.320] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa92fc41, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.320] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.321] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.321] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x268fd88 | out: lpFileInformation=0x268fd88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e)) returned 1
	[0188.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.321] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.321] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.321] GetFileType (hFile=0x318) returned 0x1
	[0188.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.322] GetFileType (hFile=0x318) returned 0x1
	[0188.322] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x34e
	[0188.322] ReadFile (in: hFile=0x318, lpBuffer=0x2690594, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2690594*, lpNumberOfBytesRead=0x57ff3fc*=0x34e, lpOverlapped=0x0) returned 1
	[0188.323] CloseHandle (hObject=0x318) returned 1
	[0188.323] CryptDestroyKey (hKey=0x82b300) returned 1
	[0188.323] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.323] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2691630, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0188.324] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.324] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.324] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b000) returned 1
	[0188.324] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.324] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x26916e8*=0x1, dwFlags=0x0) returned 1
	[0188.324] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x26916b4, dwFlags=0x0) returned 1
	[0188.324] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26916f8*, pdwDataLen=0x57ff404*=0x350, dwBufLen=0x350 | out: pbData=0x26916f8*, pdwDataLen=0x57ff404*=0x350) returned 1
	[0188.324] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2691a54*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2691a54*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.324] CryptDestroyKey (hKey=0x82b000) returned 1
	[0188.324] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.324] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.324] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.324] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.325] GetFileType (hFile=0x318) returned 0x1
	[0188.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.325] GetFileType (hFile=0x318) returned 0x1
	[0188.325] WriteFile (in: hFile=0x318, lpBuffer=0x2691cb8*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2691cb8*, lpNumberOfBytesWritten=0x57ff3c4*=0x350, lpOverlapped=0x0) returned 1
	[0188.326] CloseHandle (hObject=0x318) returned 1
	[0188.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0188.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.327] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa955dfb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0188.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.327] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.328] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.328] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26932e0 | out: lpFileInformation=0x26932e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0188.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.328] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.328] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.328] GetFileType (hFile=0x318) returned 0x1
	[0188.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.329] GetFileType (hFile=0x318) returned 0x1
	[0188.329] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1e0
	[0188.329] ReadFile (in: hFile=0x318, lpBuffer=0x26938ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26938ec*, lpNumberOfBytesRead=0x57ff3fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0188.358] CloseHandle (hObject=0x318) returned 1
	[0188.358] CryptDestroyKey (hKey=0x82b280) returned 1
	[0188.358] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.358] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2694988, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0188.358] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.358] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.358] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0188.359] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.359] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2694a40*=0x1, dwFlags=0x0) returned 1
	[0188.359] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2694a0c, dwFlags=0x0) returned 1
	[0188.359] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2694a50*, pdwDataLen=0x57ff404*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x2694a50*, pdwDataLen=0x57ff404*=0x1f0) returned 1
	[0188.359] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2694c4c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2694c4c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.359] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.359] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.359] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.359] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.359] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.360] GetFileType (hFile=0x318) returned 0x1
	[0188.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.361] GetFileType (hFile=0x318) returned 0x1
	[0188.361] WriteFile (in: hFile=0x318, lpBuffer=0x2694e68*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2694e68*, lpNumberOfBytesWritten=0x57ff3c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0188.362] CloseHandle (hObject=0x318) returned 1
	[0188.362] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.362] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0188.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.362] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa9a2297, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0188.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.362] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.364] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0188.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.364] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x269640c | out: lpFileInformation=0x269640c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9)) returned 1
	[0188.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0188.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.365] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.365] GetFileType (hFile=0x318) returned 0x1
	[0188.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.365] GetFileType (hFile=0x318) returned 0x1
	[0188.365] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d9
	[0188.365] ReadFile (in: hFile=0x318, lpBuffer=0x2696bb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2696bb4*, lpNumberOfBytesRead=0x57ff3fc*=0x2d9, lpOverlapped=0x0) returned 1
	[0188.368] CloseHandle (hObject=0x318) returned 1
	[0188.368] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.368] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.368] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2697c50, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b2c0) returned 1
	[0188.368] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.368] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.368] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0188.368] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.368] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2697d08*=0x1, dwFlags=0x0) returned 1
	[0188.369] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2697cd4, dwFlags=0x0) returned 1
	[0188.369] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2697d18*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2697d18*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0188.369] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2698004*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2698004*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.369] CryptDestroyKey (hKey=0x82b300) returned 1
	[0188.369] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.369] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0188.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.369] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.370] GetFileType (hFile=0x318) returned 0x1
	[0188.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.370] GetFileType (hFile=0x318) returned 0x1
	[0188.370] WriteFile (in: hFile=0x318, lpBuffer=0x2698270*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2698270*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0188.371] CloseHandle (hObject=0x318) returned 1
	[0188.371] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0188.371] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd2
	[0188.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.371] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa9c8419, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0188.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.371] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.372] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.372] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26998b4 | out: lpFileInformation=0x26998b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0188.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.373] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.373] GetFileType (hFile=0x318) returned 0x1
	[0188.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.373] GetFileType (hFile=0x318) returned 0x1
	[0188.373] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1e0
	[0188.373] ReadFile (in: hFile=0x318, lpBuffer=0x2699ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2699ec0*, lpNumberOfBytesRead=0x57ff3fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0188.374] CloseHandle (hObject=0x318) returned 1
	[0188.374] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0188.374] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.374] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269af5c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b080) returned 1
	[0188.374] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.374] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.374] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b440) returned 1
	[0188.374] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.375] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x269b014*=0x1, dwFlags=0x0) returned 1
	[0188.375] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x269afe0, dwFlags=0x0) returned 1
	[0188.375] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269b024*, pdwDataLen=0x57ff404*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x269b024*, pdwDataLen=0x57ff404*=0x1f0) returned 1
	[0188.375] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269b220*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x269b220*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.375] CryptDestroyKey (hKey=0x82b440) returned 1
	[0188.375] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.375] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.375] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.375] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.376] GetFileType (hFile=0x318) returned 0x1
	[0188.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.376] GetFileType (hFile=0x318) returned 0x1
	[0188.376] WriteFile (in: hFile=0x318, lpBuffer=0x269b43c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x269b43c*, lpNumberOfBytesWritten=0x57ff3c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0188.377] CloseHandle (hObject=0x318) returned 1
	[0188.377] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.377] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0188.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.377] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa9c8419, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0188.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.377] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.379] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x269c9e0 | out: lpFileInformation=0x269c9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6)) returned 1
	[0188.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.379] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.379] GetFileType (hFile=0x318) returned 0x1
	[0188.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.379] GetFileType (hFile=0x318) returned 0x1
	[0188.379] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d6
	[0188.379] ReadFile (in: hFile=0x318, lpBuffer=0x269d164, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x269d164*, lpNumberOfBytesRead=0x57ff3fc*=0x2d6, lpOverlapped=0x0) returned 1
	[0188.381] CloseHandle (hObject=0x318) returned 1
	[0188.381] CryptDestroyKey (hKey=0x82b080) returned 1
	[0188.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.381] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269e200, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b200) returned 1
	[0188.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.381] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0188.381] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.381] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x269e2b8*=0x1, dwFlags=0x0) returned 1
	[0188.381] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x269e284, dwFlags=0x0) returned 1
	[0188.381] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269e2c8*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x269e2c8*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0188.381] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269e5b4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x269e5b4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.381] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.381] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.381] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.382] GetFileType (hFile=0x318) returned 0x1
	[0188.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.383] GetFileType (hFile=0x318) returned 0x1
	[0188.383] WriteFile (in: hFile=0x318, lpBuffer=0x269e810*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x269e810*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0188.383] CloseHandle (hObject=0x318) returned 1
	[0188.384] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.384] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0188.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.384] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa9c8419, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0188.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.384] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.385] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.385] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x269fe28 | out: lpFileInformation=0x269fe28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4)) returned 1
	[0188.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.385] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.385] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.386] GetFileType (hFile=0x318) returned 0x1
	[0188.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.386] GetFileType (hFile=0x318) returned 0x1
	[0188.386] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d4
	[0188.386] ReadFile (in: hFile=0x318, lpBuffer=0x26a05a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26a05a8*, lpNumberOfBytesRead=0x57ff3fc*=0x2d4, lpOverlapped=0x0) returned 1
	[0188.387] CloseHandle (hObject=0x318) returned 1
	[0188.387] CryptDestroyKey (hKey=0x82b200) returned 1
	[0188.387] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.387] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a1644, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b400) returned 1
	[0188.387] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.387] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.387] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0188.387] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.387] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26a16fc*=0x1, dwFlags=0x0) returned 1
	[0188.387] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26a16c8, dwFlags=0x0) returned 1
	[0188.388] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a170c*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26a170c*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0188.388] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a19f8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26a19f8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.388] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.388] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.388] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.388] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.388] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.389] GetFileType (hFile=0x318) returned 0x1
	[0188.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.389] GetFileType (hFile=0x318) returned 0x1
	[0188.389] WriteFile (in: hFile=0x318, lpBuffer=0x26a1c54*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26a1c54*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0188.390] CloseHandle (hObject=0x318) returned 1
	[0188.390] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.390] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0188.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.390] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaa9ee78e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0188.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.390] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.394] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.394] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26a326c | out: lpFileInformation=0x26a326c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7)) returned 1
	[0188.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.526] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.585] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.696] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.732] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.732] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.732] GetFileType (hFile=0x318) returned 0x1
	[0188.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.732] GetFileType (hFile=0x318) returned 0x1
	[0188.732] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cb
	[0188.732] ReadFile (in: hFile=0x318, lpBuffer=0x27000f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27000f8*, lpNumberOfBytesRead=0x57ff3fc*=0x2cb, lpOverlapped=0x0) returned 1
	[0188.734] CloseHandle (hObject=0x318) returned 1
	[0188.734] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0188.734] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.734] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2701194, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0188.734] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.734] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.734] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b400) returned 1
	[0188.734] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.734] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x270124c*=0x1, dwFlags=0x0) returned 1
	[0188.735] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2701218, dwFlags=0x0) returned 1
	[0188.735] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270125c*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x270125c*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0188.735] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2701538*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2701538*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.735] CryptDestroyKey (hKey=0x82b400) returned 1
	[0188.735] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.735] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.735] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.735] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.736] GetFileType (hFile=0x318) returned 0x1
	[0188.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.736] GetFileType (hFile=0x318) returned 0x1
	[0188.737] WriteFile (in: hFile=0x318, lpBuffer=0x270179c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x270179c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.738] CloseHandle (hObject=0x318) returned 1
	[0188.738] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.738] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0188.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.738] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaad35a18, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.738] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.740] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2702dc4 | out: lpFileInformation=0x2702dc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0188.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.740] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.740] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.740] GetFileType (hFile=0x318) returned 0x1
	[0188.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.740] GetFileType (hFile=0x318) returned 0x1
	[0188.740] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cf
	[0188.740] ReadFile (in: hFile=0x318, lpBuffer=0x2703550, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2703550*, lpNumberOfBytesRead=0x57ff3fc*=0x2cf, lpOverlapped=0x0) returned 1
	[0188.742] CloseHandle (hObject=0x318) returned 1
	[0188.742] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.742] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.742] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27045ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0188.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.742] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0188.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.742] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27046a4*=0x1, dwFlags=0x0) returned 1
	[0188.743] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2704670, dwFlags=0x0) returned 1
	[0188.743] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27046b4*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27046b4*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0188.743] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2704990*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2704990*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.743] CryptDestroyKey (hKey=0x82b480) returned 1
	[0188.743] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.743] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.743] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.743] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.744] GetFileType (hFile=0x318) returned 0x1
	[0188.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.745] GetFileType (hFile=0x318) returned 0x1
	[0188.745] WriteFile (in: hFile=0x318, lpBuffer=0x2704bf4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2704bf4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.746] CloseHandle (hObject=0x318) returned 1
	[0188.746] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.746] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0188.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.746] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaad5bd3f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.746] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.748] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x270621c | out: lpFileInformation=0x270621c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce)) returned 1
	[0188.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.748] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.748] GetFileType (hFile=0x318) returned 0x1
	[0188.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.748] GetFileType (hFile=0x318) returned 0x1
	[0188.748] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ce
	[0188.749] ReadFile (in: hFile=0x318, lpBuffer=0x27069a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27069a8*, lpNumberOfBytesRead=0x57ff3fc*=0x2ce, lpOverlapped=0x0) returned 1
	[0188.750] CloseHandle (hObject=0x318) returned 1
	[0188.750] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.750] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.750] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2707a44, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b080) returned 1
	[0188.750] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.750] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.750] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0188.750] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.751] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2707afc*=0x1, dwFlags=0x0) returned 1
	[0188.751] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2707ac8, dwFlags=0x0) returned 1
	[0188.751] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2707b0c*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2707b0c*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0188.751] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2707de8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2707de8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.751] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.751] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.751] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.751] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.751] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.752] GetFileType (hFile=0x318) returned 0x1
	[0188.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.752] GetFileType (hFile=0x318) returned 0x1
	[0188.752] WriteFile (in: hFile=0x318, lpBuffer=0x270804c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x270804c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.753] CloseHandle (hObject=0x318) returned 1
	[0188.753] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.754] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0188.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.754] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaad5bd3f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.754] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.755] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2709674 | out: lpFileInformation=0x2709674*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4)) returned 1
	[0188.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0188.756] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.756] GetFileType (hFile=0x318) returned 0x1
	[0188.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0188.756] GetFileType (hFile=0x318) returned 0x1
	[0188.756] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1e4
	[0188.756] ReadFile (in: hFile=0x318, lpBuffer=0x2709d04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2709d04*, lpNumberOfBytesRead=0x57ff3fc*=0x1e4, lpOverlapped=0x0) returned 1
	[0188.758] CloseHandle (hObject=0x318) returned 1
	[0188.758] CryptDestroyKey (hKey=0x82b080) returned 1
	[0188.758] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.758] CryptImportKey (in: hProv=0x7f93c0, pbData=0x270ada0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0188.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.758] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0188.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.758] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x270ae58*=0x1, dwFlags=0x0) returned 1
	[0188.758] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x270ae24, dwFlags=0x0) returned 1
	[0188.758] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270ae68*, pdwDataLen=0x57ff404*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x270ae68*, pdwDataLen=0x57ff404*=0x1f0) returned 1
	[0188.758] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270b064*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x270b064*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0188.758] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.758] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.758] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.758] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0188.759] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.760] GetFileType (hFile=0x318) returned 0x1
	[0188.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0188.760] GetFileType (hFile=0x318) returned 0x1
	[0188.760] WriteFile (in: hFile=0x318, lpBuffer=0x270b2c0*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x270b2c0*, lpNumberOfBytesWritten=0x57ff3c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0188.761] CloseHandle (hObject=0x318) returned 1
	[0188.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0188.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0188.762] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaad81f2b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0188.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0188.762] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.763] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0188.763] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x270c8d8 | out: lpFileInformation=0x270c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d9)) returned 1
	[0188.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0188.764] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.821] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.884] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.927] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0189.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.739] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.739] GetFileType (hFile=0x318) returned 0x1
	[0189.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.739] GetFileType (hFile=0x318) returned 0x1
	[0189.739] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d7
	[0189.740] ReadFile (in: hFile=0x318, lpBuffer=0x27c3c7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27c3c7c*, lpNumberOfBytesRead=0x57ff3fc*=0x2d7, lpOverlapped=0x0) returned 1
	[0189.741] CloseHandle (hObject=0x318) returned 1
	[0189.742] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0189.742] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.742] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c4d18, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b300) returned 1
	[0189.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.742] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0189.742] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.742] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27c4dd0*=0x1, dwFlags=0x0) returned 1
	[0189.742] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27c4d9c, dwFlags=0x0) returned 1
	[0189.742] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c4de0*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27c4de0*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0189.742] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c50cc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27c50cc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.742] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.742] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.742] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.742] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0189.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.742] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.744] GetFileType (hFile=0x318) returned 0x1
	[0189.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.744] GetFileType (hFile=0x318) returned 0x1
	[0189.744] WriteFile (in: hFile=0x318, lpBuffer=0x27c5360*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c5360*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.745] CloseHandle (hObject=0x318) returned 1
	[0189.745] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xad
	[0189.746] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdc
	[0189.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.746] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913452f1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913452f1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab6e53a8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.746] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0189.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.747] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c69f4 | out: lpFileInformation=0x27c69f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902943e8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902943e8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902943e8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1)) returned 1
	[0189.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0189.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.748] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.748] GetFileType (hFile=0x318) returned 0x1
	[0189.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.748] GetFileType (hFile=0x318) returned 0x1
	[0189.748] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d1
	[0189.748] ReadFile (in: hFile=0x318, lpBuffer=0x27c71a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27c71a4*, lpNumberOfBytesRead=0x57ff3fc*=0x2d1, lpOverlapped=0x0) returned 1
	[0189.750] CloseHandle (hObject=0x318) returned 1
	[0189.750] CryptDestroyKey (hKey=0x82b300) returned 1
	[0189.750] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.750] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c8240, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b300) returned 1
	[0189.750] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.750] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.750] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0189.750] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.750] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27c82f8*=0x1, dwFlags=0x0) returned 1
	[0189.750] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27c82c4, dwFlags=0x0) returned 1
	[0189.750] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c8308*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27c8308*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0189.750] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c85f4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27c85f4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.750] CryptDestroyKey (hKey=0x82b540) returned 1
	[0189.750] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.751] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.751] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0189.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.751] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.752] GetFileType (hFile=0x318) returned 0x1
	[0189.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.752] GetFileType (hFile=0x318) returned 0x1
	[0189.752] WriteFile (in: hFile=0x318, lpBuffer=0x27c8868*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c8868*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.753] CloseHandle (hObject=0x318) returned 1
	[0189.753] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0189.754] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0189.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.754] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902943e8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902943e8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab6e53a8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.754] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0189.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.755] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c9ebc | out: lpFileInformation=0x27c9ebc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913452f1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913452f1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913452f1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6)) returned 1
	[0189.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.756] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0189.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.756] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.756] GetFileType (hFile=0x318) returned 0x1
	[0189.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.756] GetFileType (hFile=0x318) returned 0x1
	[0189.756] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d6
	[0189.756] ReadFile (in: hFile=0x318, lpBuffer=0x27ca680, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27ca680*, lpNumberOfBytesRead=0x57ff3fc*=0x2d6, lpOverlapped=0x0) returned 1
	[0189.758] CloseHandle (hObject=0x318) returned 1
	[0189.758] CryptDestroyKey (hKey=0x82b300) returned 1
	[0189.758] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.758] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27cb71c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0189.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.758] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0189.758] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.758] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27cb7d4*=0x1, dwFlags=0x0) returned 1
	[0189.758] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x27cb7a0, dwFlags=0x0) returned 1
	[0189.759] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27cb7e4*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27cb7e4*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0189.759] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cbad0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27cbad0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.759] CryptDestroyKey (hKey=0x82b080) returned 1
	[0189.759] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.759] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.759] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0189.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.759] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.760] GetFileType (hFile=0x318) returned 0x1
	[0189.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.761] GetFileType (hFile=0x318) returned 0x1
	[0189.761] WriteFile (in: hFile=0x318, lpBuffer=0x27cbd4c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27cbd4c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.762] CloseHandle (hObject=0x318) returned 1
	[0189.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0189.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0189.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.762] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913452f1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913452f1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab70ba32, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.762] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.764] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27cd3b0 | out: lpFileInformation=0x27cd3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9136b55d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35b)) returned 1
	[0189.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.764] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.764] GetFileType (hFile=0x318) returned 0x1
	[0189.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.765] GetFileType (hFile=0x318) returned 0x1
	[0189.765] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x35b
	[0189.765] ReadFile (in: hFile=0x318, lpBuffer=0x27cdbf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27cdbf8*, lpNumberOfBytesRead=0x57ff3fc*=0x35b, lpOverlapped=0x0) returned 1
	[0189.766] CloseHandle (hObject=0x318) returned 1
	[0189.766] CryptDestroyKey (hKey=0x82b340) returned 1
	[0189.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.767] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27cec94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0189.767] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.767] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.767] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0189.767] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.767] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27ced4c*=0x1, dwFlags=0x0) returned 1
	[0189.767] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27ced18, dwFlags=0x0) returned 1
	[0189.767] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ced5c*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x27ced5c*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0189.767] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cf0c8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27cf0c8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.767] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.767] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.767] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.767] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.767] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.769] GetFileType (hFile=0x318) returned 0x1
	[0189.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.769] GetFileType (hFile=0x318) returned 0x1
	[0189.769] WriteFile (in: hFile=0x318, lpBuffer=0x27cf344*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27cf344*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0189.770] CloseHandle (hObject=0x318) returned 1
	[0189.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0189.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.770] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab70ba32, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0189.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.771] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.772] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.772] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d099c | out: lpFileInformation=0x27d099c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9136b55d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f)) returned 1
	[0189.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.772] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.772] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.773] GetFileType (hFile=0x318) returned 0x1
	[0189.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.773] GetFileType (hFile=0x318) returned 0x1
	[0189.773] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x34f
	[0189.773] ReadFile (in: hFile=0x318, lpBuffer=0x27d11d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27d11d8*, lpNumberOfBytesRead=0x57ff3fc*=0x34f, lpOverlapped=0x0) returned 1
	[0189.797] CloseHandle (hObject=0x318) returned 1
	[0189.797] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.797] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.797] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d2274, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b000) returned 1
	[0189.798] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.798] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.798] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b440) returned 1
	[0189.798] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.798] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x27d232c*=0x1, dwFlags=0x0) returned 1
	[0189.798] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x27d22f8, dwFlags=0x0) returned 1
	[0189.798] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d233c*, pdwDataLen=0x57ff404*=0x350, dwBufLen=0x350 | out: pbData=0x27d233c*, pdwDataLen=0x57ff404*=0x350) returned 1
	[0189.798] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d2698*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27d2698*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.798] CryptDestroyKey (hKey=0x82b440) returned 1
	[0189.798] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.798] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.798] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.798] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.800] GetFileType (hFile=0x318) returned 0x1
	[0189.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.800] GetFileType (hFile=0x318) returned 0x1
	[0189.800] WriteFile (in: hFile=0x318, lpBuffer=0x27d2914*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27d2914*, lpNumberOfBytesWritten=0x57ff3c4*=0x350, lpOverlapped=0x0) returned 1
	[0189.801] CloseHandle (hObject=0x318) returned 1
	[0189.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0189.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0189.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.801] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab757b29, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0189.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.802] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.803] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.803] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d3f6c | out: lpFileInformation=0x27d3f6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9136b55d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0189.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.804] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.804] GetFileType (hFile=0x318) returned 0x1
	[0189.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.804] GetFileType (hFile=0x318) returned 0x1
	[0189.804] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ca
	[0189.804] ReadFile (in: hFile=0x318, lpBuffer=0x27d46c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27d46c4*, lpNumberOfBytesRead=0x57ff3fc*=0x2ca, lpOverlapped=0x0) returned 1
	[0189.806] CloseHandle (hObject=0x318) returned 1
	[0189.806] CryptDestroyKey (hKey=0x82b000) returned 1
	[0189.806] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.806] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d5760, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b5c0) returned 1
	[0189.806] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.806] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.806] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0189.806] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.806] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27d5818*=0x1, dwFlags=0x0) returned 1
	[0189.806] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27d57e4, dwFlags=0x0) returned 1
	[0189.806] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d5828*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27d5828*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0189.806] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d5b04*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27d5b04*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.806] CryptDestroyKey (hKey=0x82b280) returned 1
	[0189.806] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.806] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.807] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.807] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.808] GetFileType (hFile=0x318) returned 0x1
	[0189.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.808] GetFileType (hFile=0x318) returned 0x1
	[0189.808] WriteFile (in: hFile=0x318, lpBuffer=0x27d5d50*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27d5d50*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0189.809] CloseHandle (hObject=0x318) returned 1
	[0189.810] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0189.810] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0189.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.810] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab77dc62, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0189.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.810] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.811] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.811] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d7354 | out: lpFileInformation=0x27d7354*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9136b55d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1)) returned 1
	[0189.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.812] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.812] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.812] GetFileType (hFile=0x318) returned 0x1
	[0189.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.812] GetFileType (hFile=0x318) returned 0x1
	[0189.812] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d1
	[0189.812] ReadFile (in: hFile=0x318, lpBuffer=0x27d7af4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27d7af4*, lpNumberOfBytesRead=0x57ff3fc*=0x2d1, lpOverlapped=0x0) returned 1
	[0189.814] CloseHandle (hObject=0x318) returned 1
	[0189.814] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0189.814] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.814] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d8b90, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0189.814] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.814] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.814] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0189.814] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.814] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27d8c48*=0x1, dwFlags=0x0) returned 1
	[0189.814] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27d8c14, dwFlags=0x0) returned 1
	[0189.814] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d8c58*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27d8c58*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0189.814] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d8f44*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27d8f44*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.814] CryptDestroyKey (hKey=0x82b100) returned 1
	[0189.814] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.815] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.815] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.815] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.816] GetFileType (hFile=0x318) returned 0x1
	[0189.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.816] GetFileType (hFile=0x318) returned 0x1
	[0189.816] WriteFile (in: hFile=0x318, lpBuffer=0x27d91b0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27d91b0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0189.817] CloseHandle (hObject=0x318) returned 1
	[0189.817] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.817] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0189.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.818] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab77dc62, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0189.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.818] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.819] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.819] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27da7e8 | out: lpFileInformation=0x27da7e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913917c8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913917c8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913917c8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353)) returned 1
	[0189.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.820] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.820] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.820] GetFileType (hFile=0x318) returned 0x1
	[0189.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.820] GetFileType (hFile=0x318) returned 0x1
	[0189.820] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x353
	[0189.821] ReadFile (in: hFile=0x318, lpBuffer=0x27db008, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27db008*, lpNumberOfBytesRead=0x57ff3fc*=0x353, lpOverlapped=0x0) returned 1
	[0189.822] CloseHandle (hObject=0x318) returned 1
	[0189.822] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.822] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.822] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27dc0a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b200) returned 1
	[0189.822] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.822] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.823] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b040) returned 1
	[0189.823] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.823] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x27dc15c*=0x1, dwFlags=0x0) returned 1
	[0189.869] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x27dc128, dwFlags=0x0) returned 1
	[0189.869] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27dc16c*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x27dc16c*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0189.869] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27dc4d8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27dc4d8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.869] CryptDestroyKey (hKey=0x82b040) returned 1
	[0189.869] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.869] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.869] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.871] GetFileType (hFile=0x318) returned 0x1
	[0189.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.871] GetFileType (hFile=0x318) returned 0x1
	[0189.871] WriteFile (in: hFile=0x318, lpBuffer=0x27dc744*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27dc744*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0189.872] CloseHandle (hObject=0x318) returned 1
	[0189.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0189.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.873] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913917c8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913917c8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab816672, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0189.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.873] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.874] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.874] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ddd7c | out: lpFileInformation=0x27ddd7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913917c8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913917c8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913917c8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0189.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.875] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.875] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.875] GetFileType (hFile=0x318) returned 0x1
	[0189.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.875] GetFileType (hFile=0x318) returned 0x1
	[0189.875] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x350
	[0189.875] ReadFile (in: hFile=0x318, lpBuffer=0x27de598, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27de598*, lpNumberOfBytesRead=0x57ff3fc*=0x350, lpOverlapped=0x0) returned 1
	[0189.902] CloseHandle (hObject=0x318) returned 1
	[0189.902] CryptDestroyKey (hKey=0x82b200) returned 1
	[0189.902] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.902] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27df634, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b480) returned 1
	[0189.902] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.902] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.902] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0189.902] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.902] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27df6ec*=0x1, dwFlags=0x0) returned 1
	[0189.903] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27df6b8, dwFlags=0x0) returned 1
	[0189.903] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27df6fc*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x27df6fc*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0189.903] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27dfa68*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27dfa68*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.903] CryptDestroyKey (hKey=0x82b100) returned 1
	[0189.903] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.903] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.903] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.903] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.904] GetFileType (hFile=0x318) returned 0x1
	[0189.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.905] GetFileType (hFile=0x318) returned 0x1
	[0189.905] WriteFile (in: hFile=0x318, lpBuffer=0x27dfcd4*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27dfcd4*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0189.906] CloseHandle (hObject=0x318) returned 1
	[0189.906] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.906] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0189.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.906] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913917c8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913917c8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab862c9f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0189.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.906] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.907] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.907] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e130c | out: lpFileInformation=0x27e130c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913b7a34, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x355)) returned 1
	[0189.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.908] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.908] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.908] GetFileType (hFile=0x318) returned 0x1
	[0189.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.908] GetFileType (hFile=0x318) returned 0x1
	[0189.908] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x355
	[0189.909] ReadFile (in: hFile=0x318, lpBuffer=0x27e1b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27e1b30*, lpNumberOfBytesRead=0x57ff3fc*=0x355, lpOverlapped=0x0) returned 1
	[0189.910] CloseHandle (hObject=0x318) returned 1
	[0189.910] CryptDestroyKey (hKey=0x82b480) returned 1
	[0189.910] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.910] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e2bcc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0189.910] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.910] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.911] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0189.911] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.911] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27e2c84*=0x1, dwFlags=0x0) returned 1
	[0189.911] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27e2c50, dwFlags=0x0) returned 1
	[0189.911] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e2c94*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x27e2c94*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0189.911] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e3000*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27e3000*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.911] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.911] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.911] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.911] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.911] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.913] GetFileType (hFile=0x318) returned 0x1
	[0189.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.913] GetFileType (hFile=0x318) returned 0x1
	[0189.913] WriteFile (in: hFile=0x318, lpBuffer=0x27e326c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27e326c*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0189.914] CloseHandle (hObject=0x318) returned 1
	[0189.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0189.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.914] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab862c9f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0189.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.914] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.915] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.916] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e48a4 | out: lpFileInformation=0x27e48a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913b7a34, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352)) returned 1
	[0189.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.916] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.916] GetFileType (hFile=0x318) returned 0x1
	[0189.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.916] GetFileType (hFile=0x318) returned 0x1
	[0189.916] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x352
	[0189.917] ReadFile (in: hFile=0x318, lpBuffer=0x27e50c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27e50c4*, lpNumberOfBytesRead=0x57ff3fc*=0x352, lpOverlapped=0x0) returned 1
	[0189.918] CloseHandle (hObject=0x318) returned 1
	[0189.918] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.918] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.918] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e6160, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0189.918] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.919] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.919] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0189.919] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.919] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27e6218*=0x1, dwFlags=0x0) returned 1
	[0189.919] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27e61e4, dwFlags=0x0) returned 1
	[0189.919] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e6228*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x27e6228*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0189.919] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e6594*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27e6594*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.919] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0189.919] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.919] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.919] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.919] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.921] GetFileType (hFile=0x318) returned 0x1
	[0189.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.921] GetFileType (hFile=0x318) returned 0x1
	[0189.921] WriteFile (in: hFile=0x318, lpBuffer=0x27e6800*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27e6800*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0189.922] CloseHandle (hObject=0x318) returned 1
	[0189.922] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa2
	[0189.922] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd1
	[0189.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.922] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab888e21, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0189.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.922] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.924] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0189.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.924] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e7e38 | out: lpFileInformation=0x27e7e38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913b7a34, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce)) returned 1
	[0189.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.926] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0189.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.926] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.926] GetFileType (hFile=0x318) returned 0x1
	[0189.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.926] GetFileType (hFile=0x318) returned 0x1
	[0189.927] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ce
	[0189.927] ReadFile (in: hFile=0x318, lpBuffer=0x27e8594, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27e8594*, lpNumberOfBytesRead=0x57ff3fc*=0x2ce, lpOverlapped=0x0) returned 1
	[0189.928] CloseHandle (hObject=0x318) returned 1
	[0189.928] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.928] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.928] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e9630, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0189.929] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.929] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.929] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0189.929] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.929] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27e96e8*=0x1, dwFlags=0x0) returned 1
	[0189.929] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27e96b4, dwFlags=0x0) returned 1
	[0189.929] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e96f8*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27e96f8*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0189.929] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e99d4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27e99d4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.929] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0189.929] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.929] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0189.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.929] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.931] GetFileType (hFile=0x318) returned 0x1
	[0189.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.931] GetFileType (hFile=0x318) returned 0x1
	[0189.931] WriteFile (in: hFile=0x318, lpBuffer=0x27e9c20*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27e9c20*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0189.932] CloseHandle (hObject=0x318) returned 1
	[0189.932] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0189.932] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0189.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.932] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab888e21, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0189.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.933] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.934] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0189.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.934] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27eb218 | out: lpFileInformation=0x27eb218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902ba650, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1)) returned 1
	[0189.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.934] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0189.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.935] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.935] GetFileType (hFile=0x318) returned 0x1
	[0189.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.935] GetFileType (hFile=0x318) returned 0x1
	[0189.935] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c1
	[0189.935] ReadFile (in: hFile=0x318, lpBuffer=0x27eb958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27eb958*, lpNumberOfBytesRead=0x57ff3fc*=0x2c1, lpOverlapped=0x0) returned 1
	[0189.954] CloseHandle (hObject=0x318) returned 1
	[0189.954] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.954] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.954] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ec9f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b200) returned 1
	[0189.954] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.954] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.954] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0189.955] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.955] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27ecaac*=0x1, dwFlags=0x0) returned 1
	[0189.955] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27eca78, dwFlags=0x0) returned 1
	[0189.955] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ecabc*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27ecabc*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0189.955] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ecd98*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27ecd98*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.955] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0189.955] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.955] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.955] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0189.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.955] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.975] GetFileType (hFile=0x318) returned 0x1
	[0189.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.975] GetFileType (hFile=0x318) returned 0x1
	[0189.975] WriteFile (in: hFile=0x318, lpBuffer=0x27ecfdc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27ecfdc*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0189.976] CloseHandle (hObject=0x318) returned 1
	[0189.976] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0189.976] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0189.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.976] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab8fb508, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0189.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.976] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.978] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0189.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.978] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ee5c4 | out: lpFileInformation=0x27ee5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913b7a34, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0189.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.979] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0189.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.979] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.979] GetFileType (hFile=0x318) returned 0x1
	[0189.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.979] GetFileType (hFile=0x318) returned 0x1
	[0189.979] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cc
	[0189.979] ReadFile (in: hFile=0x318, lpBuffer=0x27eed3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27eed3c*, lpNumberOfBytesRead=0x57ff3fc*=0x2cc, lpOverlapped=0x0) returned 1
	[0189.981] CloseHandle (hObject=0x318) returned 1
	[0189.981] CryptDestroyKey (hKey=0x82b200) returned 1
	[0189.981] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.981] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27efdd8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0189.981] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.981] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.981] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0189.981] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0189.981] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27efe90*=0x1, dwFlags=0x0) returned 1
	[0189.981] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27efe5c, dwFlags=0x0) returned 1
	[0189.982] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27efea0*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27efea0*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0189.982] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f017c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27f017c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0189.982] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0189.982] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.982] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0189.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0189.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0189.982] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.983] GetFileType (hFile=0x318) returned 0x1
	[0189.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0189.983] GetFileType (hFile=0x318) returned 0x1
	[0189.984] WriteFile (in: hFile=0x318, lpBuffer=0x27f03d8*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27f03d8*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0189.985] CloseHandle (hObject=0x318) returned 1
	[0189.985] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0189.985] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0189.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0189.985] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab92173b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0189.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0189.985] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0189.987] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0189.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0189.987] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f19fc | out: lpFileInformation=0x27f19fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913ddca3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x33c)) returned 1
	[0189.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0189.987] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0189.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0189.987] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0189.987] GetFileType (hFile=0x318) returned 0x1
	[0189.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0189.988] GetFileType (hFile=0x318) returned 0x1
	[0189.988] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x33c
	[0189.988] ReadFile (in: hFile=0x318, lpBuffer=0x27f21b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27f21b4*, lpNumberOfBytesRead=0x57ff3fc*=0x33c, lpOverlapped=0x0) returned 1
	[0190.010] CloseHandle (hObject=0x318) returned 1
	[0190.011] CryptDestroyKey (hKey=0x82b280) returned 1
	[0190.011] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.011] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f3250, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0190.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.011] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0190.011] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.011] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27f3308*=0x1, dwFlags=0x0) returned 1
	[0190.011] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27f32d4, dwFlags=0x0) returned 1
	[0190.011] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f3318*, pdwDataLen=0x57ff404*=0x340, dwBufLen=0x340 | out: pbData=0x27f3318*, pdwDataLen=0x57ff404*=0x340) returned 1
	[0190.011] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f3664*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27f3664*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.011] CryptDestroyKey (hKey=0x82b540) returned 1
	[0190.011] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.011] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.011] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0190.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.012] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.013] GetFileType (hFile=0x318) returned 0x1
	[0190.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.013] GetFileType (hFile=0x318) returned 0x1
	[0190.013] WriteFile (in: hFile=0x318, lpBuffer=0x27f38a8*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27f38a8*, lpNumberOfBytesWritten=0x57ff3c4*=0x340, lpOverlapped=0x0) returned 1
	[0190.014] CloseHandle (hObject=0x318) returned 1
	[0190.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0190.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0190.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.015] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab96dc87, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1
	[0190.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.015] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0190.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.016] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f4e9c | out: lpFileInformation=0x27f4e9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913ddca3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x347)) returned 1
	[0190.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.017] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0190.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.017] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.017] GetFileType (hFile=0x318) returned 0x1
	[0190.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.017] GetFileType (hFile=0x318) returned 0x1
	[0190.017] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x347
	[0190.017] ReadFile (in: hFile=0x318, lpBuffer=0x27f5660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27f5660*, lpNumberOfBytesRead=0x57ff3fc*=0x347, lpOverlapped=0x0) returned 1
	[0190.019] CloseHandle (hObject=0x318) returned 1
	[0190.019] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.019] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.019] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f66fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b200) returned 1
	[0190.019] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.019] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.019] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0190.019] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.019] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27f67b4*=0x1, dwFlags=0x0) returned 1
	[0190.020] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27f6780, dwFlags=0x0) returned 1
	[0190.020] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f67c4*, pdwDataLen=0x57ff404*=0x350, dwBufLen=0x350 | out: pbData=0x27f67c4*, pdwDataLen=0x57ff404*=0x350) returned 1
	[0190.020] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f6b20*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27f6b20*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.020] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0190.020] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.020] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.020] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0190.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.020] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.021] GetFileType (hFile=0x318) returned 0x1
	[0190.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.021] GetFileType (hFile=0x318) returned 0x1
	[0190.022] WriteFile (in: hFile=0x318, lpBuffer=0x27f6d64*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27f6d64*, lpNumberOfBytesWritten=0x57ff3c4*=0x350, lpOverlapped=0x0) returned 1
	[0190.023] CloseHandle (hObject=0x318) returned 1
	[0190.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0190.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0190.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.023] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab96dc87, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0190.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.023] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.024] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0190.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.025] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f8358 | out: lpFileInformation=0x27f8358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913ddca3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0190.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.025] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0190.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.025] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.025] GetFileType (hFile=0x318) returned 0x1
	[0190.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.025] GetFileType (hFile=0x318) returned 0x1
	[0190.025] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c8
	[0190.025] ReadFile (in: hFile=0x318, lpBuffer=0x27f8acc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27f8acc*, lpNumberOfBytesRead=0x57ff3fc*=0x2c8, lpOverlapped=0x0) returned 1
	[0190.027] CloseHandle (hObject=0x318) returned 1
	[0190.027] CryptDestroyKey (hKey=0x82b200) returned 1
	[0190.028] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.028] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f9b68, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b440) returned 1
	[0190.028] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.028] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.028] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0190.028] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.028] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27f9c20*=0x1, dwFlags=0x0) returned 1
	[0190.028] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27f9bec, dwFlags=0x0) returned 1
	[0190.028] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f9c30*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27f9c30*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0190.028] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f9f0c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27f9f0c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.028] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0190.028] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.028] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.028] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0190.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.028] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.030] GetFileType (hFile=0x318) returned 0x1
	[0190.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.030] GetFileType (hFile=0x318) returned 0x1
	[0190.030] WriteFile (in: hFile=0x318, lpBuffer=0x27fa168*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27fa168*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.031] CloseHandle (hObject=0x318) returned 1
	[0190.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0190.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0190.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.031] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab993e24, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.032] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0190.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.033] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27fb780 | out: lpFileInformation=0x27fb780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913ddca3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352)) returned 1
	[0190.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0190.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.034] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.034] GetFileType (hFile=0x318) returned 0x1
	[0190.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.034] GetFileType (hFile=0x318) returned 0x1
	[0190.034] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x352
	[0190.034] ReadFile (in: hFile=0x318, lpBuffer=0x27fbf70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27fbf70*, lpNumberOfBytesRead=0x57ff3fc*=0x352, lpOverlapped=0x0) returned 1
	[0190.036] CloseHandle (hObject=0x318) returned 1
	[0190.036] CryptDestroyKey (hKey=0x82b440) returned 1
	[0190.036] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.036] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fd00c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b5c0) returned 1
	[0190.036] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.036] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.036] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0190.036] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.036] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27fd0c4*=0x1, dwFlags=0x0) returned 1
	[0190.036] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27fd090, dwFlags=0x0) returned 1
	[0190.036] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27fd0d4*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x27fd0d4*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0190.036] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fd440*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27fd440*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.036] CryptDestroyKey (hKey=0x82b480) returned 1
	[0190.036] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.036] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0190.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.037] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.038] GetFileType (hFile=0x318) returned 0x1
	[0190.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.038] GetFileType (hFile=0x318) returned 0x1
	[0190.038] WriteFile (in: hFile=0x318, lpBuffer=0x27fd694*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27fd694*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0190.039] CloseHandle (hObject=0x318) returned 1
	[0190.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0190.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0190.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.039] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab993e24, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0190.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.040] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.041] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0190.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.041] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27feca8 | out: lpFileInformation=0x27feca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91403f0f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91403f0f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91403f0f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7)) returned 1
	[0190.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.041] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0190.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.041] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.042] GetFileType (hFile=0x318) returned 0x1
	[0190.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.042] GetFileType (hFile=0x318) returned 0x1
	[0190.042] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c7
	[0190.042] ReadFile (in: hFile=0x318, lpBuffer=0x27ff3fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27ff3fc*, lpNumberOfBytesRead=0x57ff3fc*=0x2c7, lpOverlapped=0x0) returned 1
	[0190.043] CloseHandle (hObject=0x318) returned 1
	[0190.043] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0190.043] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.044] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2800498, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0190.044] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.044] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.044] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0190.044] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.044] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2800550*=0x1, dwFlags=0x0) returned 1
	[0190.044] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x280051c, dwFlags=0x0) returned 1
	[0190.044] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2800560*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2800560*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0190.044] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x280083c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x280083c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.044] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.044] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.044] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.044] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0190.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.044] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.046] GetFileType (hFile=0x318) returned 0x1
	[0190.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.046] GetFileType (hFile=0x318) returned 0x1
	[0190.046] WriteFile (in: hFile=0x318, lpBuffer=0x2800a88*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2800a88*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.047] CloseHandle (hObject=0x318) returned 1
	[0190.047] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0190.047] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0190.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.047] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91403f0f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91403f0f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab9ba08b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.047] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.048] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0190.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.049] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2802080 | out: lpFileInformation=0x2802080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91403f0f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91403f0f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91403f0f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6)) returned 1
	[0190.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.059] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0190.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.059] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.059] GetFileType (hFile=0x318) returned 0x1
	[0190.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.059] GetFileType (hFile=0x318) returned 0x1
	[0190.059] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d6
	[0190.059] ReadFile (in: hFile=0x318, lpBuffer=0x28028a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x28028a4*, lpNumberOfBytesRead=0x57ff3fc*=0x2d6, lpOverlapped=0x0) returned 1
	[0190.061] CloseHandle (hObject=0x318) returned 1
	[0190.061] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0190.061] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.061] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2803940, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0190.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.061] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b0c0) returned 1
	[0190.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.061] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x28039f8*=0x1, dwFlags=0x0) returned 1
	[0190.061] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x28039c4, dwFlags=0x0) returned 1
	[0190.062] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2803a08*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2803a08*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0190.062] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2803cf4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2803cf4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.062] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0190.062] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.062] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.062] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0190.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.063] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.065] GetFileType (hFile=0x318) returned 0x1
	[0190.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.065] GetFileType (hFile=0x318) returned 0x1
	[0190.065] WriteFile (in: hFile=0x318, lpBuffer=0x2603744*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2603744*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.066] CloseHandle (hObject=0x318) returned 1
	[0190.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb2
	[0190.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe1
	[0190.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.066] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91403f0f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91403f0f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xab9e0212, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0190.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.067] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.068] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.068] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2604dfc | out: lpFileInformation=0x2604dfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91403f0f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91403f0f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91403f0f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35d)) returned 1
	[0190.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.068] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.068] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.068] GetFileType (hFile=0x318) returned 0x1
	[0190.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.069] GetFileType (hFile=0x318) returned 0x1
	[0190.069] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x35d
	[0190.069] ReadFile (in: hFile=0x318, lpBuffer=0x26055f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26055f8*, lpNumberOfBytesRead=0x57ff3fc*=0x35d, lpOverlapped=0x0) returned 1
	[0190.070] CloseHandle (hObject=0x318) returned 1
	[0190.070] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.070] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.070] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2606694, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0190.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.071] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0190.071] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.071] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x260674c*=0x1, dwFlags=0x0) returned 1
	[0190.071] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2606718, dwFlags=0x0) returned 1
	[0190.071] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260675c*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x260675c*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0190.071] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2606ac8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2606ac8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.071] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.071] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.071] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.071] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.071] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.072] GetFileType (hFile=0x318) returned 0x1
	[0190.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.073] GetFileType (hFile=0x318) returned 0x1
	[0190.073] WriteFile (in: hFile=0x318, lpBuffer=0x2606d1c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2606d1c*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0190.074] CloseHandle (hObject=0x318) returned 1
	[0190.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0190.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.074] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91403f0f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91403f0f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaba064a8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0190.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.075] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.076] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2608324 | out: lpFileInformation=0x2608324*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9142a17a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x349)) returned 1
	[0190.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.076] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.077] GetFileType (hFile=0x318) returned 0x1
	[0190.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.077] GetFileType (hFile=0x318) returned 0x1
	[0190.077] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x349
	[0190.077] ReadFile (in: hFile=0x318, lpBuffer=0x2608b0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2608b0c*, lpNumberOfBytesRead=0x57ff3fc*=0x349, lpOverlapped=0x0) returned 1
	[0190.078] CloseHandle (hObject=0x318) returned 1
	[0190.079] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0190.079] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.079] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2609ba8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0190.079] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.079] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.079] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0190.079] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.079] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2609c60*=0x1, dwFlags=0x0) returned 1
	[0190.079] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2609c2c, dwFlags=0x0) returned 1
	[0190.079] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2609c70*, pdwDataLen=0x57ff404*=0x350, dwBufLen=0x350 | out: pbData=0x2609c70*, pdwDataLen=0x57ff404*=0x350) returned 1
	[0190.079] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2609fcc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2609fcc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.079] CryptDestroyKey (hKey=0x82b080) returned 1
	[0190.079] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.079] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.079] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.079] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.081] GetFileType (hFile=0x318) returned 0x1
	[0190.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.081] GetFileType (hFile=0x318) returned 0x1
	[0190.081] WriteFile (in: hFile=0x318, lpBuffer=0x260a220*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x260a220*, lpNumberOfBytesWritten=0x57ff3c4*=0x350, lpOverlapped=0x0) returned 1
	[0190.082] CloseHandle (hObject=0x318) returned 1
	[0190.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.083] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0190.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.083] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaba064a8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0190.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.083] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.084] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x260b828 | out: lpFileInformation=0x260b828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9142a17a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7)) returned 1
	[0190.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.085] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.085] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.085] GetFileType (hFile=0x318) returned 0x1
	[0190.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.085] GetFileType (hFile=0x318) returned 0x1
	[0190.085] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d7
	[0190.085] ReadFile (in: hFile=0x318, lpBuffer=0x260bf9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x260bf9c*, lpNumberOfBytesRead=0x57ff3fc*=0x2d7, lpOverlapped=0x0) returned 1
	[0190.087] CloseHandle (hObject=0x318) returned 1
	[0190.087] CryptDestroyKey (hKey=0x82b340) returned 1
	[0190.087] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.087] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260d038, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b400) returned 1
	[0190.087] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.087] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.087] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0190.087] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.087] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x260d0f0*=0x1, dwFlags=0x0) returned 1
	[0190.087] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x260d0bc, dwFlags=0x0) returned 1
	[0190.087] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260d100*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x260d100*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0190.087] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260d3ec*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x260d3ec*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.088] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0190.088] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.088] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.088] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.088] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.090] GetFileType (hFile=0x318) returned 0x1
	[0190.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.090] GetFileType (hFile=0x318) returned 0x1
	[0190.090] WriteFile (in: hFile=0x318, lpBuffer=0x260d640*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x260d640*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.091] CloseHandle (hObject=0x318) returned 1
	[0190.091] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.091] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0190.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.091] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaba2c7c7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0190.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.091] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.092] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0190.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.092] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x260ec48 | out: lpFileInformation=0x260ec48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902ba650, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0190.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.093] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0190.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.093] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.093] GetFileType (hFile=0x318) returned 0x1
	[0190.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.093] GetFileType (hFile=0x318) returned 0x1
	[0190.093] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c0
	[0190.093] ReadFile (in: hFile=0x318, lpBuffer=0x260f374, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x260f374*, lpNumberOfBytesRead=0x57ff3fc*=0x2c0, lpOverlapped=0x0) returned 1
	[0190.118] CloseHandle (hObject=0x318) returned 1
	[0190.118] CryptDestroyKey (hKey=0x82b400) returned 1
	[0190.118] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.118] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2610410, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0190.118] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.118] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.118] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b380) returned 1
	[0190.118] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.118] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26104c8*=0x1, dwFlags=0x0) returned 1
	[0190.118] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x2610494, dwFlags=0x0) returned 1
	[0190.119] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26104d8*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26104d8*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0190.119] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26107b4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26107b4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.119] CryptDestroyKey (hKey=0x82b380) returned 1
	[0190.119] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.119] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.119] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0190.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.119] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.120] GetFileType (hFile=0x318) returned 0x1
	[0190.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.120] GetFileType (hFile=0x318) returned 0x1
	[0190.121] WriteFile (in: hFile=0x318, lpBuffer=0x26109f0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26109f0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0190.122] CloseHandle (hObject=0x318) returned 1
	[0190.122] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0190.122] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc5
	[0190.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.122] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaba7d87c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0190.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.122] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.124] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2611fc8 | out: lpFileInformation=0x2611fc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9142a17a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0190.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.124] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.124] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.124] GetFileType (hFile=0x318) returned 0x1
	[0190.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.124] GetFileType (hFile=0x318) returned 0x1
	[0190.124] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d3
	[0190.125] ReadFile (in: hFile=0x318, lpBuffer=0x2612738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2612738*, lpNumberOfBytesRead=0x57ff3fc*=0x2d3, lpOverlapped=0x0) returned 1
	[0190.126] CloseHandle (hObject=0x318) returned 1
	[0190.126] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.126] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.126] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26137d4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0190.126] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.126] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.126] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0190.126] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.126] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x261388c*=0x1, dwFlags=0x0) returned 1
	[0190.126] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2613858, dwFlags=0x0) returned 1
	[0190.126] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261389c*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x261389c*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0190.126] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2613b88*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2613b88*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.126] CryptDestroyKey (hKey=0x82b480) returned 1
	[0190.126] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.126] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.127] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.128] GetFileType (hFile=0x318) returned 0x1
	[0190.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.128] GetFileType (hFile=0x318) returned 0x1
	[0190.128] WriteFile (in: hFile=0x318, lpBuffer=0x2613ddc*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2613ddc*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.129] CloseHandle (hObject=0x318) returned 1
	[0190.129] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.129] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0190.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.129] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaba7d87c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0190.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.129] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.130] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.131] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26153e4 | out: lpFileInformation=0x26153e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9142a17a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2)) returned 1
	[0190.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.131] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.131] GetFileType (hFile=0x318) returned 0x1
	[0190.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.131] GetFileType (hFile=0x318) returned 0x1
	[0190.131] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d2
	[0190.131] ReadFile (in: hFile=0x318, lpBuffer=0x2615b54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2615b54*, lpNumberOfBytesRead=0x57ff3fc*=0x2d2, lpOverlapped=0x0) returned 1
	[0190.133] CloseHandle (hObject=0x318) returned 1
	[0190.133] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0190.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.133] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2616bf0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0190.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.133] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0190.133] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.133] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2616ca8*=0x1, dwFlags=0x0) returned 1
	[0190.133] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2616c74, dwFlags=0x0) returned 1
	[0190.133] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2616cb8*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2616cb8*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0190.133] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2616fa4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2616fa4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.133] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0190.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.133] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.133] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.133] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.134] GetFileType (hFile=0x318) returned 0x1
	[0190.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.135] GetFileType (hFile=0x318) returned 0x1
	[0190.135] WriteFile (in: hFile=0x318, lpBuffer=0x26171f8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26171f8*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.135] CloseHandle (hObject=0x318) returned 1
	[0190.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0190.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.136] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaba9ee0d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0190.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.136] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.137] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2618800 | out: lpFileInformation=0x2618800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7)) returned 1
	[0190.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.138] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.138] GetFileType (hFile=0x318) returned 0x1
	[0190.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.138] GetFileType (hFile=0x318) returned 0x1
	[0190.138] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d7
	[0190.138] ReadFile (in: hFile=0x318, lpBuffer=0x2618f74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2618f74*, lpNumberOfBytesRead=0x57ff3fc*=0x2d7, lpOverlapped=0x0) returned 1
	[0190.158] CloseHandle (hObject=0x318) returned 1
	[0190.158] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0190.158] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.158] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261a010, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b440) returned 1
	[0190.158] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.158] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.158] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0190.158] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.158] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x261a0c8*=0x1, dwFlags=0x0) returned 1
	[0190.159] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x261a094, dwFlags=0x0) returned 1
	[0190.159] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261a0d8*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x261a0d8*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0190.159] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261a3c4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x261a3c4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.159] CryptDestroyKey (hKey=0x82b480) returned 1
	[0190.159] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.159] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.159] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.159] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.160] GetFileType (hFile=0x318) returned 0x1
	[0190.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.160] GetFileType (hFile=0x318) returned 0x1
	[0190.160] WriteFile (in: hFile=0x318, lpBuffer=0x261a618*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x261a618*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.161] CloseHandle (hObject=0x318) returned 1
	[0190.161] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.161] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0190.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.161] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabac505a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0190.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.161] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.162] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.162] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x261bc20 | out: lpFileInformation=0x261bc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0190.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0190.163] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0190.163] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.163] GetFileType (hFile=0x318) returned 0x1
	[0190.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0190.163] GetFileType (hFile=0x318) returned 0x1
	[0190.163] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d3
	[0190.163] ReadFile (in: hFile=0x318, lpBuffer=0x261c390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x261c390*, lpNumberOfBytesRead=0x57ff3fc*=0x2d3, lpOverlapped=0x0) returned 1
	[0190.164] CloseHandle (hObject=0x318) returned 1
	[0190.165] CryptDestroyKey (hKey=0x82b440) returned 1
	[0190.165] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.165] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261d42c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0190.165] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.165] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.165] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b040) returned 1
	[0190.165] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0190.165] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x261d4e4*=0x1, dwFlags=0x0) returned 1
	[0190.165] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x261d4b0, dwFlags=0x0) returned 1
	[0190.165] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261d4f4*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x261d4f4*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0190.165] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261d7e0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x261d7e0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0190.165] CryptDestroyKey (hKey=0x82b040) returned 1
	[0190.165] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.165] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0190.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0190.165] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0190.166] GetFileType (hFile=0x318) returned 0x1
	[0190.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0190.166] GetFileType (hFile=0x318) returned 0x1
	[0190.166] WriteFile (in: hFile=0x318, lpBuffer=0x261da34*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x261da34*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0190.167] CloseHandle (hObject=0x318) returned 1
	[0190.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.168] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0190.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0190.168] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xabaeb281, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0190.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0190.168] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0190.169] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0190.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0190.169] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x261f03c | out: lpFileInformation=0x261f03c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db)) returned 1
	[0190.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.395] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.452] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.510] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.624] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.651] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0191.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.651] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.651] GetFileType (hFile=0x318) returned 0x1
	[0191.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.652] GetFileType (hFile=0x318) returned 0x1
	[0191.652] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x36a
	[0191.652] ReadFile (in: hFile=0x318, lpBuffer=0x278b1dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x278b1dc*, lpNumberOfBytesRead=0x57ff3fc*=0x36a, lpOverlapped=0x0) returned 1
	[0191.653] CloseHandle (hObject=0x318) returned 1
	[0191.653] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0191.653] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.653] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278c278, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0191.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.653] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0191.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.653] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x278c330*=0x1, dwFlags=0x0) returned 1
	[0191.653] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x278c2fc, dwFlags=0x0) returned 1
	[0191.654] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278c340*, pdwDataLen=0x57ff404*=0x370, dwBufLen=0x370 | out: pbData=0x278c340*, pdwDataLen=0x57ff404*=0x370) returned 1
	[0191.654] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278c6bc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x278c6bc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.654] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0191.654] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.654] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.654] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0191.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.654] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.655] GetFileType (hFile=0x318) returned 0x1
	[0191.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.655] GetFileType (hFile=0x318) returned 0x1
	[0191.655] WriteFile (in: hFile=0x318, lpBuffer=0x278c940*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x278c940*, lpNumberOfBytesWritten=0x57ff3c4*=0x370, lpOverlapped=0x0) returned 1
	[0191.656] CloseHandle (hObject=0x318) returned 1
	[0191.656] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0191.656] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0191.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.656] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac9132cf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1
	[0191.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.657] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.658] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.658] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278dfa8 | out: lpFileInformation=0x278dfa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d4)) returned 1
	[0191.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.658] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.658] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.658] GetFileType (hFile=0x318) returned 0x1
	[0191.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.658] GetFileType (hFile=0x318) returned 0x1
	[0191.658] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1d4
	[0191.659] ReadFile (in: hFile=0x318, lpBuffer=0x278e628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x278e628*, lpNumberOfBytesRead=0x57ff3fc*=0x1d4, lpOverlapped=0x0) returned 1
	[0191.659] CloseHandle (hObject=0x318) returned 1
	[0191.659] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.659] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.660] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278f6c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0191.660] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.660] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.660] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b2c0) returned 1
	[0191.660] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.660] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x278f77c*=0x1, dwFlags=0x0) returned 1
	[0191.660] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x278f748, dwFlags=0x0) returned 1
	[0191.660] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278f78c*, pdwDataLen=0x57ff404*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x278f78c*, pdwDataLen=0x57ff404*=0x1e0) returned 1
	[0191.660] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278f978*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x278f978*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.660] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0191.660] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.660] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.660] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.660] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.669] GetFileType (hFile=0x318) returned 0x1
	[0191.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.670] GetFileType (hFile=0x318) returned 0x1
	[0191.670] WriteFile (in: hFile=0x318, lpBuffer=0x278fbd4*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x278fbd4*, lpNumberOfBytesWritten=0x57ff3c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0191.670] CloseHandle (hObject=0x318) returned 1
	[0191.671] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.671] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0191.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.671] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac9414b8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0191.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.671] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.673] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.673] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27911ec | out: lpFileInformation=0x27911ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6)) returned 1
	[0191.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.674] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.674] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.674] GetFileType (hFile=0x318) returned 0x1
	[0191.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.674] GetFileType (hFile=0x318) returned 0x1
	[0191.674] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1c6
	[0191.674] ReadFile (in: hFile=0x318, lpBuffer=0x27917e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27917e0*, lpNumberOfBytesRead=0x57ff3fc*=0x1c6, lpOverlapped=0x0) returned 1
	[0191.675] CloseHandle (hObject=0x318) returned 1
	[0191.675] CryptDestroyKey (hKey=0x82b100) returned 1
	[0191.675] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.675] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279287c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0191.675] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.675] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.675] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0191.675] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.675] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2792934*=0x1, dwFlags=0x0) returned 1
	[0191.675] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2792900, dwFlags=0x0) returned 1
	[0191.675] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2792944*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x2792944*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0191.675] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2792b20*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2792b20*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.675] CryptDestroyKey (hKey=0x82b080) returned 1
	[0191.675] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.675] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.676] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.677] GetFileType (hFile=0x318) returned 0x1
	[0191.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.677] GetFileType (hFile=0x318) returned 0x1
	[0191.677] WriteFile (in: hFile=0x318, lpBuffer=0x2792d3c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2792d3c*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0191.678] CloseHandle (hObject=0x318) returned 1
	[0191.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0191.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.678] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac9414b8, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0191.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.678] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0191.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.680] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27942e0 | out: lpFileInformation=0x27942e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917bdb8f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x362)) returned 1
	[0191.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0191.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.680] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.680] GetFileType (hFile=0x318) returned 0x1
	[0191.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.680] GetFileType (hFile=0x318) returned 0x1
	[0191.680] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x362
	[0191.680] ReadFile (in: hFile=0x318, lpBuffer=0x2794b00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2794b00*, lpNumberOfBytesRead=0x57ff3fc*=0x362, lpOverlapped=0x0) returned 1
	[0191.682] CloseHandle (hObject=0x318) returned 1
	[0191.682] CryptDestroyKey (hKey=0x82b540) returned 1
	[0191.682] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.682] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2795b9c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0191.682] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.682] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.682] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0191.682] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.682] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2795c54*=0x1, dwFlags=0x0) returned 1
	[0191.682] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2795c20, dwFlags=0x0) returned 1
	[0191.682] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2795c64*, pdwDataLen=0x57ff404*=0x370, dwBufLen=0x370 | out: pbData=0x2795c64*, pdwDataLen=0x57ff404*=0x370) returned 1
	[0191.682] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2795fe0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2795fe0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.682] CryptDestroyKey (hKey=0x82b280) returned 1
	[0191.682] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.682] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.682] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0191.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.683] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.684] GetFileType (hFile=0x318) returned 0x1
	[0191.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.684] GetFileType (hFile=0x318) returned 0x1
	[0191.684] WriteFile (in: hFile=0x318, lpBuffer=0x2796244*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2796244*, lpNumberOfBytesWritten=0x57ff3c4*=0x370, lpOverlapped=0x0) returned 1
	[0191.706] CloseHandle (hObject=0x318) returned 1
	[0191.706] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0191.706] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0191.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.706] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac985a0d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1
	[0191.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.706] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.707] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.707] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x279786c | out: lpFileInformation=0x279786c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917bdb8f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d4)) returned 1
	[0191.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.708] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.708] GetFileType (hFile=0x318) returned 0x1
	[0191.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.708] GetFileType (hFile=0x318) returned 0x1
	[0191.708] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1d4
	[0191.708] ReadFile (in: hFile=0x318, lpBuffer=0x2797eec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2797eec*, lpNumberOfBytesRead=0x57ff3fc*=0x1d4, lpOverlapped=0x0) returned 1
	[0191.709] CloseHandle (hObject=0x318) returned 1
	[0191.709] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.709] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.709] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2798f88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0191.709] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.709] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.709] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b400) returned 1
	[0191.709] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.709] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2799040*=0x1, dwFlags=0x0) returned 1
	[0191.709] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x279900c, dwFlags=0x0) returned 1
	[0191.709] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2799050*, pdwDataLen=0x57ff404*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x2799050*, pdwDataLen=0x57ff404*=0x1e0) returned 1
	[0191.710] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279923c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x279923c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.710] CryptDestroyKey (hKey=0x82b400) returned 1
	[0191.710] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.710] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.710] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.710] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.711] GetFileType (hFile=0x318) returned 0x1
	[0191.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.711] GetFileType (hFile=0x318) returned 0x1
	[0191.711] WriteFile (in: hFile=0x318, lpBuffer=0x2799498*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2799498*, lpNumberOfBytesWritten=0x57ff3c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0191.712] CloseHandle (hObject=0x318) returned 1
	[0191.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0191.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.712] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac985a0d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0191.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.712] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.714] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x279aab0 | out: lpFileInformation=0x279aab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9032cd93, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9032cd93, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9032cd93, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353)) returned 1
	[0191.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.715] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.715] GetFileType (hFile=0x318) returned 0x1
	[0191.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.715] GetFileType (hFile=0x318) returned 0x1
	[0191.715] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x353
	[0191.715] ReadFile (in: hFile=0x318, lpBuffer=0x279b2a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x279b2a0*, lpNumberOfBytesRead=0x57ff3fc*=0x353, lpOverlapped=0x0) returned 1
	[0191.716] CloseHandle (hObject=0x318) returned 1
	[0191.716] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.716] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.716] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279c33c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0191.716] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.716] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.716] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b2c0) returned 1
	[0191.716] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.717] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x279c3f4*=0x1, dwFlags=0x0) returned 1
	[0191.717] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x279c3c0, dwFlags=0x0) returned 1
	[0191.717] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279c404*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x279c404*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0191.717] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279c770*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x279c770*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.717] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0191.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.717] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.717] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.718] GetFileType (hFile=0x318) returned 0x1
	[0191.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.718] GetFileType (hFile=0x318) returned 0x1
	[0191.718] WriteFile (in: hFile=0x318, lpBuffer=0x279c9c4*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x279c9c4*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0191.719] CloseHandle (hObject=0x318) returned 1
	[0191.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0191.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.719] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9032cd93, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9032cd93, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac9abb1b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0191.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.720] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.721] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x279dfcc | out: lpFileInformation=0x279dfcc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917bdb8f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6)) returned 1
	[0191.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.721] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.721] GetFileType (hFile=0x318) returned 0x1
	[0191.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.721] GetFileType (hFile=0x318) returned 0x1
	[0191.721] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1c6
	[0191.721] ReadFile (in: hFile=0x318, lpBuffer=0x279e5c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x279e5c0*, lpNumberOfBytesRead=0x57ff3fc*=0x1c6, lpOverlapped=0x0) returned 1
	[0191.722] CloseHandle (hObject=0x318) returned 1
	[0191.722] CryptDestroyKey (hKey=0x82b340) returned 1
	[0191.722] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.722] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279f65c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b2c0) returned 1
	[0191.722] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.723] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.723] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0191.723] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.723] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x279f714*=0x1, dwFlags=0x0) returned 1
	[0191.723] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x279f6e0, dwFlags=0x0) returned 1
	[0191.723] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279f724*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x279f724*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0191.723] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279f900*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x279f900*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.723] CryptDestroyKey (hKey=0x82b300) returned 1
	[0191.723] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.723] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.723] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.723] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.724] GetFileType (hFile=0x318) returned 0x1
	[0191.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.724] GetFileType (hFile=0x318) returned 0x1
	[0191.724] WriteFile (in: hFile=0x318, lpBuffer=0x279fb1c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x279fb1c*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0191.725] CloseHandle (hObject=0x318) returned 1
	[0191.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0191.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.725] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac9abb1b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0191.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.726] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.727] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.727] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a10c0 | out: lpFileInformation=0x27a10c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917bdb8f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1)) returned 1
	[0191.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.728] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.728] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.728] GetFileType (hFile=0x318) returned 0x1
	[0191.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.728] GetFileType (hFile=0x318) returned 0x1
	[0191.728] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d1
	[0191.728] ReadFile (in: hFile=0x318, lpBuffer=0x27a1820, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27a1820*, lpNumberOfBytesRead=0x57ff3fc*=0x2d1, lpOverlapped=0x0) returned 1
	[0191.730] CloseHandle (hObject=0x318) returned 1
	[0191.730] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0191.730] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.730] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a28bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b480) returned 1
	[0191.730] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.730] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.730] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b0c0) returned 1
	[0191.730] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.731] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x27a2974*=0x1, dwFlags=0x0) returned 1
	[0191.731] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x27a2940, dwFlags=0x0) returned 1
	[0191.731] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a2984*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27a2984*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0191.731] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a2c70*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27a2c70*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.731] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0191.731] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.731] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.731] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.731] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.732] GetFileType (hFile=0x318) returned 0x1
	[0191.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.732] GetFileType (hFile=0x318) returned 0x1
	[0191.732] WriteFile (in: hFile=0x318, lpBuffer=0x27a2ebc*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27a2ebc*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.733] CloseHandle (hObject=0x318) returned 1
	[0191.733] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.733] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0191.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.734] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac9d1e43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.734] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.735] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0191.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.735] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a44b4 | out: lpFileInformation=0x27a44b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917bdb8f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8)) returned 1
	[0191.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.735] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0191.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.735] ReadFile (in: hFile=0x318, lpBuffer=0x27a4c48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27a4c48*, lpNumberOfBytesRead=0x57ff3fc*=0x2d8, lpOverlapped=0x0) returned 1
	[0191.737] CryptDestroyKey (hKey=0x82b480) returned 1
	[0191.737] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.737] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a5ce4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0191.737] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.737] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.737] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0191.737] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.737] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27a5d9c*=0x1, dwFlags=0x0) returned 1
	[0191.737] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27a5d68, dwFlags=0x0) returned 1
	[0191.737] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a5dac*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27a5dac*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0191.737] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a6098*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27a6098*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.737] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0191.738] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.738] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.738] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0191.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.738] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.739] GetFileType (hFile=0x318) returned 0x1
	[0191.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.739] GetFileType (hFile=0x318) returned 0x1
	[0191.739] WriteFile (in: hFile=0x318, lpBuffer=0x27a62fc*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27a62fc*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.740] CloseHandle (hObject=0x318) returned 1
	[0191.740] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0191.740] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0191.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.740] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac9d1e43, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.740] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.741] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27a7930 | out: lpFileInformation=0x27a7930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917e3dfb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917e3dfb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917e3dfb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0191.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.742] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.742] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.742] GetFileType (hFile=0x318) returned 0x1
	[0191.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.742] GetFileType (hFile=0x318) returned 0x1
	[0191.742] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c9
	[0191.742] ReadFile (in: hFile=0x318, lpBuffer=0x27a8078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27a8078*, lpNumberOfBytesRead=0x57ff3fc*=0x2c9, lpOverlapped=0x0) returned 1
	[0191.773] CloseHandle (hObject=0x318) returned 1
	[0191.774] CryptDestroyKey (hKey=0x82b340) returned 1
	[0191.774] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.774] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a9114, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0191.774] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.774] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.774] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0191.774] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.774] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27a91cc*=0x1, dwFlags=0x0) returned 1
	[0191.774] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27a9198, dwFlags=0x0) returned 1
	[0191.774] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a91dc*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27a91dc*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0191.774] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a94b8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27a94b8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.774] CryptDestroyKey (hKey=0x82b280) returned 1
	[0191.774] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.774] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.774] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.774] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.776] GetFileType (hFile=0x318) returned 0x1
	[0191.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.776] GetFileType (hFile=0x318) returned 0x1
	[0191.776] WriteFile (in: hFile=0x318, lpBuffer=0x27a96fc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27a96fc*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.777] CloseHandle (hObject=0x318) returned 1
	[0191.777] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.777] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0191.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.777] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917e3dfb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917e3dfb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaca4626a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.777] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.778] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.778] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27aacf0 | out: lpFileInformation=0x27aacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917e3dfb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917e3dfb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917e3dfb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2)) returned 1
	[0191.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.779] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.780] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.780] GetFileType (hFile=0x318) returned 0x1
	[0191.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.780] GetFileType (hFile=0x318) returned 0x1
	[0191.780] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d2
	[0191.780] ReadFile (in: hFile=0x318, lpBuffer=0x27ab440, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27ab440*, lpNumberOfBytesRead=0x57ff3fc*=0x2d2, lpOverlapped=0x0) returned 1
	[0191.781] CloseHandle (hObject=0x318) returned 1
	[0191.781] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.781] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.781] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ac4dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b300) returned 1
	[0191.781] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.781] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.781] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0191.781] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.782] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27ac594*=0x1, dwFlags=0x0) returned 1
	[0191.782] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27ac560, dwFlags=0x0) returned 1
	[0191.782] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ac5a4*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27ac5a4*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0191.782] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ac890*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27ac890*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.782] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.782] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.782] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.782] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.782] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.783] GetFileType (hFile=0x318) returned 0x1
	[0191.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.783] GetFileType (hFile=0x318) returned 0x1
	[0191.783] WriteFile (in: hFile=0x318, lpBuffer=0x27acad4*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27acad4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.784] CloseHandle (hObject=0x318) returned 1
	[0191.784] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.784] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0191.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.784] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917e3dfb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917e3dfb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaca4626a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.785] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.786] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.786] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ae0c8 | out: lpFileInformation=0x27ae0c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917e3dfb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917e3dfb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917e3dfb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1)) returned 1
	[0191.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.786] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.786] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.786] GetFileType (hFile=0x318) returned 0x1
	[0191.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.786] GetFileType (hFile=0x318) returned 0x1
	[0191.786] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d1
	[0191.786] ReadFile (in: hFile=0x318, lpBuffer=0x27ae818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27ae818*, lpNumberOfBytesRead=0x57ff3fc*=0x2d1, lpOverlapped=0x0) returned 1
	[0191.788] CloseHandle (hObject=0x318) returned 1
	[0191.788] CryptDestroyKey (hKey=0x82b300) returned 1
	[0191.788] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.788] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27af8b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0191.788] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.788] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.788] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0191.788] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.788] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27af96c*=0x1, dwFlags=0x0) returned 1
	[0191.788] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27af938, dwFlags=0x0) returned 1
	[0191.788] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27af97c*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27af97c*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0191.788] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27afc68*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27afc68*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.788] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.788] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.788] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.788] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.788] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.790] GetFileType (hFile=0x318) returned 0x1
	[0191.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.790] GetFileType (hFile=0x318) returned 0x1
	[0191.790] WriteFile (in: hFile=0x318, lpBuffer=0x27afeac*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27afeac*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.791] CloseHandle (hObject=0x318) returned 1
	[0191.791] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.791] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0191.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.791] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917e3dfb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917e3dfb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaca4626a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.791] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.793] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.793] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b14a0 | out: lpFileInformation=0x27b14a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917e3dfb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917e3dfb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917e3dfb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0191.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.793] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.793] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.793] GetFileType (hFile=0x318) returned 0x1
	[0191.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.793] GetFileType (hFile=0x318) returned 0x1
	[0191.793] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d3
	[0191.793] ReadFile (in: hFile=0x318, lpBuffer=0x27b1c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27b1c10*, lpNumberOfBytesRead=0x57ff3fc*=0x2d3, lpOverlapped=0x0) returned 1
	[0191.795] CloseHandle (hObject=0x318) returned 1
	[0191.795] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.795] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.795] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b2cac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0191.795] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.795] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.795] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0191.795] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.795] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27b2d64*=0x1, dwFlags=0x0) returned 1
	[0191.795] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27b2d30, dwFlags=0x0) returned 1
	[0191.795] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b2d74*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27b2d74*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0191.795] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b3060*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27b3060*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.795] CryptDestroyKey (hKey=0x82b300) returned 1
	[0191.795] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.795] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.796] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.796] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.797] GetFileType (hFile=0x318) returned 0x1
	[0191.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.797] GetFileType (hFile=0x318) returned 0x1
	[0191.797] WriteFile (in: hFile=0x318, lpBuffer=0x27b32b4*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27b32b4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.798] CloseHandle (hObject=0x318) returned 1
	[0191.798] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.798] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0191.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.798] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917e3dfb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917e3dfb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaca6a7a7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.798] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.799] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0191.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.799] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b48bc | out: lpFileInformation=0x27b48bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9180a066, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da)) returned 1
	[0191.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.800] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0191.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.800] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.800] GetFileType (hFile=0x318) returned 0x1
	[0191.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.800] GetFileType (hFile=0x318) returned 0x1
	[0191.800] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2da
	[0191.800] ReadFile (in: hFile=0x318, lpBuffer=0x27b5064, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27b5064*, lpNumberOfBytesRead=0x57ff3fc*=0x2da, lpOverlapped=0x0) returned 1
	[0191.801] CloseHandle (hObject=0x318) returned 1
	[0191.801] CryptDestroyKey (hKey=0x82b540) returned 1
	[0191.801] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.801] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b6100, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b080) returned 1
	[0191.801] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.802] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.802] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b040) returned 1
	[0191.802] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.802] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x27b61b8*=0x1, dwFlags=0x0) returned 1
	[0191.802] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x27b6184, dwFlags=0x0) returned 1
	[0191.802] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b61c8*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27b61c8*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0191.802] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b64b4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27b64b4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.802] CryptDestroyKey (hKey=0x82b040) returned 1
	[0191.802] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.802] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0191.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.802] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.803] GetFileType (hFile=0x318) returned 0x1
	[0191.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.803] GetFileType (hFile=0x318) returned 0x1
	[0191.803] WriteFile (in: hFile=0x318, lpBuffer=0x27b6720*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27b6720*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.804] CloseHandle (hObject=0x318) returned 1
	[0191.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0191.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd2
	[0191.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.805] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaca6a7a7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.805] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.806] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0191.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.806] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27b7d64 | out: lpFileInformation=0x27b7d64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9180a066, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf)) returned 1
	[0191.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.806] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0191.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.806] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.806] GetFileType (hFile=0x318) returned 0x1
	[0191.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.807] GetFileType (hFile=0x318) returned 0x1
	[0191.807] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2bf
	[0191.807] ReadFile (in: hFile=0x318, lpBuffer=0x27b8490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27b8490*, lpNumberOfBytesRead=0x57ff3fc*=0x2bf, lpOverlapped=0x0) returned 1
	[0191.886] CloseHandle (hObject=0x318) returned 1
	[0191.886] CryptDestroyKey (hKey=0x82b080) returned 1
	[0191.886] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.886] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27b952c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0191.887] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.887] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.887] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0191.887] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.887] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27b95e4*=0x1, dwFlags=0x0) returned 1
	[0191.887] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27b95b0, dwFlags=0x0) returned 1
	[0191.887] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27b95f4*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x27b95f4*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0191.887] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b98c0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27b98c0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.887] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.887] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.887] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.887] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0191.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.887] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.888] GetFileType (hFile=0x318) returned 0x1
	[0191.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.888] GetFileType (hFile=0x318) returned 0x1
	[0191.888] WriteFile (in: hFile=0x318, lpBuffer=0x27b9afc*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27b9afc*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0191.889] CloseHandle (hObject=0x318) returned 1
	[0191.889] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x96
	[0191.889] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc5
	[0191.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.889] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacb4f57b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0191.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.890] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.891] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27bb0d4 | out: lpFileInformation=0x27bb0d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9180a066, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x381)) returned 1
	[0191.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.891] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.891] GetFileType (hFile=0x318) returned 0x1
	[0191.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.891] GetFileType (hFile=0x318) returned 0x1
	[0191.891] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x381
	[0191.891] ReadFile (in: hFile=0x318, lpBuffer=0x27bb8f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27bb8f4*, lpNumberOfBytesRead=0x57ff3fc*=0x381, lpOverlapped=0x0) returned 1
	[0191.893] CloseHandle (hObject=0x318) returned 1
	[0191.893] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0191.893] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.893] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27bc990, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0191.893] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.893] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.893] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b440) returned 1
	[0191.893] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.893] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x27bca48*=0x1, dwFlags=0x0) returned 1
	[0191.893] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x27bca14, dwFlags=0x0) returned 1
	[0191.893] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27bca58*, pdwDataLen=0x57ff404*=0x390, dwBufLen=0x390 | out: pbData=0x27bca58*, pdwDataLen=0x57ff404*=0x390) returned 1
	[0191.893] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27bcdf4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27bcdf4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.893] CryptDestroyKey (hKey=0x82b440) returned 1
	[0191.893] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.893] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.893] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.893] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.894] GetFileType (hFile=0x318) returned 0x1
	[0191.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.895] GetFileType (hFile=0x318) returned 0x1
	[0191.895] WriteFile (in: hFile=0x318, lpBuffer=0x27bd048*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27bd048*, lpNumberOfBytesWritten=0x57ff3c4*=0x390, lpOverlapped=0x0) returned 1
	[0191.895] CloseHandle (hObject=0x318) returned 1
	[0191.895] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0191.896] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0191.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.896] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacb4f57b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x390)) returned 1
	[0191.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.896] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.897] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.897] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27be650 | out: lpFileInformation=0x27be650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9032cd93, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9032cd93, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9032cd93, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7)) returned 1
	[0191.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.897] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.897] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.897] GetFileType (hFile=0x318) returned 0x1
	[0191.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.897] GetFileType (hFile=0x318) returned 0x1
	[0191.897] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c7
	[0191.897] ReadFile (in: hFile=0x318, lpBuffer=0x27bedb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27bedb4*, lpNumberOfBytesRead=0x57ff3fc*=0x2c7, lpOverlapped=0x0) returned 1
	[0191.899] CloseHandle (hObject=0x318) returned 1
	[0191.899] CryptDestroyKey (hKey=0x82b100) returned 1
	[0191.899] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.899] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27bfe50, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0191.899] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.899] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.899] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0191.899] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.899] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27bff08*=0x1, dwFlags=0x0) returned 1
	[0191.899] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27bfed4, dwFlags=0x0) returned 1
	[0191.899] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27bff18*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27bff18*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0191.899] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c01f4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27c01f4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.899] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.899] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.899] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.899] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.899] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.901] GetFileType (hFile=0x318) returned 0x1
	[0191.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.901] GetFileType (hFile=0x318) returned 0x1
	[0191.901] WriteFile (in: hFile=0x318, lpBuffer=0x27c0448*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c0448*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.902] CloseHandle (hObject=0x318) returned 1
	[0191.902] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.902] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0191.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.902] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9032cd93, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9032cd93, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacb757c9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.902] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.903] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.903] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c1a5c | out: lpFileInformation=0x27c1a5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9180a066, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c3)) returned 1
	[0191.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.904] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.904] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.904] GetFileType (hFile=0x318) returned 0x1
	[0191.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.904] GetFileType (hFile=0x318) returned 0x1
	[0191.904] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1c3
	[0191.904] ReadFile (in: hFile=0x318, lpBuffer=0x27c204c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27c204c*, lpNumberOfBytesRead=0x57ff3fc*=0x1c3, lpOverlapped=0x0) returned 1
	[0191.905] CloseHandle (hObject=0x318) returned 1
	[0191.905] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.905] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.905] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c30e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0191.905] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.905] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.905] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0191.905] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.905] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27c31a0*=0x1, dwFlags=0x0) returned 1
	[0191.905] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27c316c, dwFlags=0x0) returned 1
	[0191.905] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c31b0*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27c31b0*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0191.906] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c338c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27c338c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.906] CryptDestroyKey (hKey=0x82b100) returned 1
	[0191.906] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.906] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.906] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.906] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.907] GetFileType (hFile=0x318) returned 0x1
	[0191.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.907] GetFileType (hFile=0x318) returned 0x1
	[0191.907] WriteFile (in: hFile=0x318, lpBuffer=0x27c35a8*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c35a8*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0191.908] CloseHandle (hObject=0x318) returned 1
	[0191.908] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.908] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0191.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.908] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacb757c9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0191.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.908] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.910] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0191.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.910] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c4b4c | out: lpFileInformation=0x27c4b4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9180a066, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29b)) returned 1
	[0191.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.911] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0191.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.911] ReadFile (in: hFile=0x318, lpBuffer=0x27c52b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27c52b4*, lpNumberOfBytesRead=0x57ff3fc*=0x29b, lpOverlapped=0x0) returned 1
	[0191.912] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.912] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.912] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c6350, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0191.912] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.912] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.912] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0191.912] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.913] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27c6408*=0x1, dwFlags=0x0) returned 1
	[0191.913] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27c63d4, dwFlags=0x0) returned 1
	[0191.913] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c6418*, pdwDataLen=0x57ff404*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x27c6418*, pdwDataLen=0x57ff404*=0x2a0) returned 1
	[0191.913] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c66c4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27c66c4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.913] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0191.913] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.913] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.913] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0191.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.913] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.914] GetFileType (hFile=0x318) returned 0x1
	[0191.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.914] GetFileType (hFile=0x318) returned 0x1
	[0191.914] WriteFile (in: hFile=0x318, lpBuffer=0x27c6930*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c6930*, lpNumberOfBytesWritten=0x57ff3c4*=0x2a0, lpOverlapped=0x0) returned 1
	[0191.915] CloseHandle (hObject=0x318) returned 1
	[0191.915] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0191.915] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd2
	[0191.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.915] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacb757c9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0191.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.915] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.917] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27c7f74 | out: lpFileInformation=0x27c7f74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918302ce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918302ce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918302ce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x345)) returned 1
	[0191.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.917] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.917] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.917] GetFileType (hFile=0x318) returned 0x1
	[0191.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.917] GetFileType (hFile=0x318) returned 0x1
	[0191.917] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x345
	[0191.917] ReadFile (in: hFile=0x318, lpBuffer=0x27c8748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27c8748*, lpNumberOfBytesRead=0x57ff3fc*=0x345, lpOverlapped=0x0) returned 1
	[0191.918] CloseHandle (hObject=0x318) returned 1
	[0191.919] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.919] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.919] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c97e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0191.919] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.919] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.919] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0191.919] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.919] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27c989c*=0x1, dwFlags=0x0) returned 1
	[0191.919] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27c9868, dwFlags=0x0) returned 1
	[0191.919] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c98ac*, pdwDataLen=0x57ff404*=0x350, dwBufLen=0x350 | out: pbData=0x27c98ac*, pdwDataLen=0x57ff404*=0x350) returned 1
	[0191.919] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9c08*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27c9c08*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.919] CryptDestroyKey (hKey=0x82b480) returned 1
	[0191.919] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.919] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.919] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.919] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.920] GetFileType (hFile=0x318) returned 0x1
	[0191.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.920] GetFileType (hFile=0x318) returned 0x1
	[0191.921] WriteFile (in: hFile=0x318, lpBuffer=0x27c9e54*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9e54*, lpNumberOfBytesWritten=0x57ff3c4*=0x350, lpOverlapped=0x0) returned 1
	[0191.921] CloseHandle (hObject=0x318) returned 1
	[0191.921] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.921] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0191.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.921] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918302ce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918302ce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacb9ba74, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0191.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.922] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.923] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.923] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27cb44c | out: lpFileInformation=0x27cb44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918302ce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918302ce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918302ce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x3ea)) returned 1
	[0191.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.923] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.923] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.923] GetFileType (hFile=0x318) returned 0x1
	[0191.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.923] GetFileType (hFile=0x318) returned 0x1
	[0191.923] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x3ea
	[0191.923] ReadFile (in: hFile=0x318, lpBuffer=0x27cbd14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27cbd14*, lpNumberOfBytesRead=0x57ff3fc*=0x3ea, lpOverlapped=0x0) returned 1
	[0191.945] CloseHandle (hObject=0x318) returned 1
	[0191.945] CryptDestroyKey (hKey=0x82b540) returned 1
	[0191.945] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.945] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ccdb0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0191.945] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.945] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.945] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0191.945] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.946] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27cce68*=0x1, dwFlags=0x0) returned 1
	[0191.946] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27cce34, dwFlags=0x0) returned 1
	[0191.946] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27cce78*, pdwDataLen=0x57ff404*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x27cce78*, pdwDataLen=0x57ff404*=0x3f0) returned 1
	[0191.946] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cd274*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27cd274*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.946] CryptDestroyKey (hKey=0x82b300) returned 1
	[0191.946] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.946] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.946] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.946] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.947] GetFileType (hFile=0x318) returned 0x1
	[0191.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.948] GetFileType (hFile=0x318) returned 0x1
	[0191.948] WriteFile (in: hFile=0x318, lpBuffer=0x27cd4e8*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27cd4e8*, lpNumberOfBytesWritten=0x57ff3c4*=0x3f0, lpOverlapped=0x0) returned 1
	[0191.948] CloseHandle (hObject=0x318) returned 1
	[0191.949] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.949] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0191.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.949] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918302ce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918302ce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacbe7f31, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1
	[0191.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.949] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.950] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.950] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ceb30 | out: lpFileInformation=0x27ceb30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918302ce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918302ce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918302ce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1be)) returned 1
	[0191.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.950] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.950] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.951] GetFileType (hFile=0x318) returned 0x1
	[0191.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.951] GetFileType (hFile=0x318) returned 0x1
	[0191.951] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1be
	[0191.951] ReadFile (in: hFile=0x318, lpBuffer=0x27cf11c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27cf11c*, lpNumberOfBytesRead=0x57ff3fc*=0x1be, lpOverlapped=0x0) returned 1
	[0191.952] CloseHandle (hObject=0x318) returned 1
	[0191.952] CryptDestroyKey (hKey=0x82b340) returned 1
	[0191.952] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.952] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d01b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0191.952] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.952] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.952] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0191.952] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.952] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27d0270*=0x1, dwFlags=0x0) returned 1
	[0191.952] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27d023c, dwFlags=0x0) returned 1
	[0191.952] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0280*, pdwDataLen=0x57ff404*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x27d0280*, pdwDataLen=0x57ff404*=0x1c0) returned 1
	[0191.952] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d044c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27d044c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.952] CryptDestroyKey (hKey=0x82b100) returned 1
	[0191.952] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.952] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.952] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.954] GetFileType (hFile=0x318) returned 0x1
	[0191.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.954] GetFileType (hFile=0x318) returned 0x1
	[0191.954] WriteFile (in: hFile=0x318, lpBuffer=0x27d0668*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27d0668*, lpNumberOfBytesWritten=0x57ff3c4*=0x1c0, lpOverlapped=0x0) returned 1
	[0191.955] CloseHandle (hObject=0x318) returned 1
	[0191.955] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.955] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0191.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.955] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918302ce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918302ce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacbe7f31, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1c0)) returned 1
	[0191.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.955] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.962] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0191.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.963] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d1c0c | out: lpFileInformation=0x27d1c0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918302ce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918302ce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918302ce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.963] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0191.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.963] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.963] GetFileType (hFile=0x318) returned 0x1
	[0191.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.963] GetFileType (hFile=0x318) returned 0x1
	[0191.963] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d0
	[0191.964] ReadFile (in: hFile=0x318, lpBuffer=0x27d2418, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27d2418*, lpNumberOfBytesRead=0x57ff3fc*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.965] CloseHandle (hObject=0x318) returned 1
	[0191.965] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.965] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.965] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d34b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0191.966] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.966] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.966] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0191.966] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.966] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27d356c*=0x1, dwFlags=0x0) returned 1
	[0191.966] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27d3538, dwFlags=0x0) returned 1
	[0191.967] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d357c*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27d357c*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0191.967] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d3868*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27d3868*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.967] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0191.967] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.968] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.968] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0191.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.968] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.970] GetFileType (hFile=0x318) returned 0x1
	[0191.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.970] GetFileType (hFile=0x318) returned 0x1
	[0191.970] WriteFile (in: hFile=0x318, lpBuffer=0x27d3b0c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27d3b0c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.972] CloseHandle (hObject=0x318) returned 1
	[0191.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb0
	[0191.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdf
	[0191.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.972] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918302ce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918302ce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacc21f26, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.973] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.974] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0191.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.974] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d51b4 | out: lpFileInformation=0x27d51b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9185653d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9185653d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9185653d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x357)) returned 1
	[0191.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0191.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.975] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.976] GetFileType (hFile=0x318) returned 0x1
	[0191.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.976] GetFileType (hFile=0x318) returned 0x1
	[0191.976] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x357
	[0191.976] ReadFile (in: hFile=0x318, lpBuffer=0x27d59c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27d59c8*, lpNumberOfBytesRead=0x57ff3fc*=0x357, lpOverlapped=0x0) returned 1
	[0191.978] CloseHandle (hObject=0x318) returned 1
	[0191.978] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.979] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.979] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d6a64, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b080) returned 1
	[0191.979] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.979] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.979] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b440) returned 1
	[0191.979] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.979] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x27d6b1c*=0x1, dwFlags=0x0) returned 1
	[0191.979] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x27d6ae8, dwFlags=0x0) returned 1
	[0191.979] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d6b2c*, pdwDataLen=0x57ff404*=0x360, dwBufLen=0x360 | out: pbData=0x27d6b2c*, pdwDataLen=0x57ff404*=0x360) returned 1
	[0191.979] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d6e98*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27d6e98*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.979] CryptDestroyKey (hKey=0x82b440) returned 1
	[0191.979] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.979] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.979] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0191.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.980] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.982] GetFileType (hFile=0x318) returned 0x1
	[0191.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.982] GetFileType (hFile=0x318) returned 0x1
	[0191.982] WriteFile (in: hFile=0x318, lpBuffer=0x27d70fc*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27d70fc*, lpNumberOfBytesWritten=0x57ff3c4*=0x360, lpOverlapped=0x0) returned 1
	[0191.983] CloseHandle (hObject=0x318) returned 1
	[0191.983] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0191.983] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0191.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.984] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9185653d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9185653d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacc3d94d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0191.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.984] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.985] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0191.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0191.985] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27d8724 | out: lpFileInformation=0x27d8724*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9185653d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9185653d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9185653d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce)) returned 1
	[0191.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0191.986] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0191.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0191.986] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.986] GetFileType (hFile=0x318) returned 0x1
	[0191.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0191.986] GetFileType (hFile=0x318) returned 0x1
	[0191.986] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ce
	[0191.986] ReadFile (in: hFile=0x318, lpBuffer=0x27d8ea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27d8ea0*, lpNumberOfBytesRead=0x57ff3fc*=0x2ce, lpOverlapped=0x0) returned 1
	[0191.988] CloseHandle (hObject=0x318) returned 1
	[0191.988] CryptDestroyKey (hKey=0x82b080) returned 1
	[0191.988] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.988] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d9f3c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0191.988] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.988] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.988] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0191.988] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.988] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27d9ff4*=0x1, dwFlags=0x0) returned 1
	[0191.988] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27d9fc0, dwFlags=0x0) returned 1
	[0191.988] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27da004*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27da004*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0191.988] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27da2e0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27da2e0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0191.988] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0191.988] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.988] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0191.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0191.989] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.998] GetFileType (hFile=0x318) returned 0x1
	[0191.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0191.998] GetFileType (hFile=0x318) returned 0x1
	[0191.998] WriteFile (in: hFile=0x318, lpBuffer=0x27da53c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27da53c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.999] CloseHandle (hObject=0x318) returned 1
	[0191.999] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0191.999] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0191.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0191.999] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9185653d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9185653d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacc64411, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0191.999] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.004] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.004] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27dbb60 | out: lpFileInformation=0x27dbb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9185653d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9185653d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9185653d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce)) returned 1
	[0192.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.005] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.005] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.005] GetFileType (hFile=0x318) returned 0x1
	[0192.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.005] GetFileType (hFile=0x318) returned 0x1
	[0192.005] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ce
	[0192.005] ReadFile (in: hFile=0x318, lpBuffer=0x27dc2dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27dc2dc*, lpNumberOfBytesRead=0x57ff3fc*=0x2ce, lpOverlapped=0x0) returned 1
	[0192.006] CloseHandle (hObject=0x318) returned 1
	[0192.006] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0192.006] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.006] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27dd378, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0192.006] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.006] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.006] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0192.007] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.007] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27dd430*=0x1, dwFlags=0x0) returned 1
	[0192.007] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27dd3fc, dwFlags=0x0) returned 1
	[0192.007] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27dd440*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27dd440*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.007] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27dd71c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27dd71c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.007] CryptDestroyKey (hKey=0x82b480) returned 1
	[0192.007] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.007] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.007] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.007] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.008] GetFileType (hFile=0x318) returned 0x1
	[0192.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.008] GetFileType (hFile=0x318) returned 0x1
	[0192.008] WriteFile (in: hFile=0x318, lpBuffer=0x27dd978*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27dd978*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.009] CloseHandle (hObject=0x318) returned 1
	[0192.009] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.009] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0192.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.009] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9185653d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9185653d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacc71b95, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.009] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.010] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.011] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27def9c | out: lpFileInformation=0x27def9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9187c7a9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9187c7a9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9187c7a9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0192.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.011] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.011] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.011] GetFileType (hFile=0x318) returned 0x1
	[0192.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.011] GetFileType (hFile=0x318) returned 0x1
	[0192.011] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cb
	[0192.012] ReadFile (in: hFile=0x318, lpBuffer=0x27df714, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27df714*, lpNumberOfBytesRead=0x57ff3fc*=0x2cb, lpOverlapped=0x0) returned 1
	[0192.013] CloseHandle (hObject=0x318) returned 1
	[0192.013] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.013] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.013] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e07b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0192.013] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.014] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.014] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0192.014] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.014] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27e0868*=0x1, dwFlags=0x0) returned 1
	[0192.014] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27e0834, dwFlags=0x0) returned 1
	[0192.014] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e0878*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27e0878*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.014] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e0b54*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27e0b54*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.014] CryptDestroyKey (hKey=0x82b100) returned 1
	[0192.014] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.014] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.014] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.016] GetFileType (hFile=0x318) returned 0x1
	[0192.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.016] GetFileType (hFile=0x318) returned 0x1
	[0192.016] WriteFile (in: hFile=0x318, lpBuffer=0x27e0db0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27e0db0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.017] CloseHandle (hObject=0x318) returned 1
	[0192.017] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.017] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0192.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.017] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9187c7a9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9187c7a9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacc71b95, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.018] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.019] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.019] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e23d4 | out: lpFileInformation=0x27e23d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9032cd93, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9032cd93, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9032cd93, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1)) returned 1
	[0192.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.019] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.020] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.020] GetFileType (hFile=0x318) returned 0x1
	[0192.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.020] GetFileType (hFile=0x318) returned 0x1
	[0192.020] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c1
	[0192.020] ReadFile (in: hFile=0x318, lpBuffer=0x27e2b44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27e2b44*, lpNumberOfBytesRead=0x57ff3fc*=0x2c1, lpOverlapped=0x0) returned 1
	[0192.022] CloseHandle (hObject=0x318) returned 1
	[0192.022] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.022] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.022] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e3be0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b440) returned 1
	[0192.022] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.022] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.022] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0192.022] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.022] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x27e3c98*=0x1, dwFlags=0x0) returned 1
	[0192.022] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27e3c64, dwFlags=0x0) returned 1
	[0192.022] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e3ca8*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27e3ca8*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.022] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e3f84*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27e3f84*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.022] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0192.022] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.022] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.023] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.024] GetFileType (hFile=0x318) returned 0x1
	[0192.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.024] GetFileType (hFile=0x318) returned 0x1
	[0192.024] WriteFile (in: hFile=0x318, lpBuffer=0x27e41e0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27e41e0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.025] CloseHandle (hObject=0x318) returned 1
	[0192.025] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.025] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0192.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.025] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9032cd93, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9032cd93, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacc981aa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.025] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.027] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.027] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e5804 | out: lpFileInformation=0x27e5804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9187c7a9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9187c7a9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9187c7a9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0192.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.027] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.027] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.027] GetFileType (hFile=0x318) returned 0x1
	[0192.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.027] GetFileType (hFile=0x318) returned 0x1
	[0192.028] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cf
	[0192.028] ReadFile (in: hFile=0x318, lpBuffer=0x27e5f80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27e5f80*, lpNumberOfBytesRead=0x57ff3fc*=0x2cf, lpOverlapped=0x0) returned 1
	[0192.029] CloseHandle (hObject=0x318) returned 1
	[0192.029] CryptDestroyKey (hKey=0x82b440) returned 1
	[0192.029] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.029] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e701c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b5c0) returned 1
	[0192.029] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.029] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.029] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0192.029] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.030] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27e70d4*=0x1, dwFlags=0x0) returned 1
	[0192.030] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27e70a0, dwFlags=0x0) returned 1
	[0192.030] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e70e4*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27e70e4*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.030] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e73c0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27e73c0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.030] CryptDestroyKey (hKey=0x82b480) returned 1
	[0192.030] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.030] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.030] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.030] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.031] GetFileType (hFile=0x318) returned 0x1
	[0192.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.031] GetFileType (hFile=0x318) returned 0x1
	[0192.031] WriteFile (in: hFile=0x318, lpBuffer=0x27e761c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27e761c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.032] CloseHandle (hObject=0x318) returned 1
	[0192.032] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.032] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0192.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.032] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9187c7a9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9187c7a9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacc981aa, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.032] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.034] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27e8c40 | out: lpFileInformation=0x27e8c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9187c7a9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9187c7a9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9187c7a9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce)) returned 1
	[0192.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.034] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.034] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.034] GetFileType (hFile=0x318) returned 0x1
	[0192.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.034] GetFileType (hFile=0x318) returned 0x1
	[0192.034] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ce
	[0192.034] ReadFile (in: hFile=0x318, lpBuffer=0x27e93bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27e93bc*, lpNumberOfBytesRead=0x57ff3fc*=0x2ce, lpOverlapped=0x0) returned 1
	[0192.054] CloseHandle (hObject=0x318) returned 1
	[0192.054] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0192.054] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.055] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ea458, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0192.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.055] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0192.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.055] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x27ea510*=0x1, dwFlags=0x0) returned 1
	[0192.055] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27ea4dc, dwFlags=0x0) returned 1
	[0192.055] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ea520*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27ea520*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.055] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ea7fc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27ea7fc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.055] CryptDestroyKey (hKey=0x82b300) returned 1
	[0192.055] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.055] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.055] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.055] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.056] GetFileType (hFile=0x318) returned 0x1
	[0192.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.056] GetFileType (hFile=0x318) returned 0x1
	[0192.056] WriteFile (in: hFile=0x318, lpBuffer=0x27eaa58*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27eaa58*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.057] CloseHandle (hObject=0x318) returned 1
	[0192.057] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.057] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0192.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.057] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9187c7a9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9187c7a9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacce4519, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.058] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.059] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.059] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ec07c | out: lpFileInformation=0x27ec07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9187c7a9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9187c7a9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9187c7a9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0192.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.060] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.060] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.060] GetFileType (hFile=0x318) returned 0x1
	[0192.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.060] GetFileType (hFile=0x318) returned 0x1
	[0192.060] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cc
	[0192.060] ReadFile (in: hFile=0x318, lpBuffer=0x27ec7f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27ec7f4*, lpNumberOfBytesRead=0x57ff3fc*=0x2cc, lpOverlapped=0x0) returned 1
	[0192.061] CloseHandle (hObject=0x318) returned 1
	[0192.061] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0192.061] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.061] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ed890, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0192.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.061] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0192.061] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.061] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27ed948*=0x1, dwFlags=0x0) returned 1
	[0192.061] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27ed914, dwFlags=0x0) returned 1
	[0192.062] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ed958*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27ed958*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.062] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27edc34*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27edc34*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.062] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0192.062] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.062] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.062] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.062] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.063] GetFileType (hFile=0x318) returned 0x1
	[0192.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.063] GetFileType (hFile=0x318) returned 0x1
	[0192.063] WriteFile (in: hFile=0x318, lpBuffer=0x27ede90*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27ede90*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.064] CloseHandle (hObject=0x318) returned 1
	[0192.064] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.064] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0192.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.064] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9187c7a9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9187c7a9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacce4519, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.064] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.065] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.065] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ef4b4 | out: lpFileInformation=0x27ef4b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918a2a15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6)) returned 1
	[0192.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.066] ReadFile (in: hFile=0x318, lpBuffer=0x27efc38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27efc38*, lpNumberOfBytesRead=0x57ff3fc*=0x2d6, lpOverlapped=0x0) returned 1
	[0192.067] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.067] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.067] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f0cd4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b340) returned 1
	[0192.067] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.067] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.067] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b380) returned 1
	[0192.067] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.067] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27f0d8c*=0x1, dwFlags=0x0) returned 1
	[0192.067] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27f0d58, dwFlags=0x0) returned 1
	[0192.067] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f0d9c*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27f0d9c*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0192.068] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f1088*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27f1088*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.068] CryptDestroyKey (hKey=0x82b380) returned 1
	[0192.068] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.068] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.068] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.068] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.069] GetFileType (hFile=0x318) returned 0x1
	[0192.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.069] GetFileType (hFile=0x318) returned 0x1
	[0192.069] WriteFile (in: hFile=0x318, lpBuffer=0x27f12e4*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27f12e4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0192.070] CloseHandle (hObject=0x318) returned 1
	[0192.070] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.070] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.070] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacd0a69a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0192.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.070] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.071] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.071] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f28fc | out: lpFileInformation=0x27f28fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918a2a15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4)) returned 1
	[0192.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.071] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.071] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.071] GetFileType (hFile=0x318) returned 0x1
	[0192.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.071] GetFileType (hFile=0x318) returned 0x1
	[0192.071] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d4
	[0192.071] ReadFile (in: hFile=0x318, lpBuffer=0x27f307c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27f307c*, lpNumberOfBytesRead=0x57ff3fc*=0x2d4, lpOverlapped=0x0) returned 1
	[0192.073] CloseHandle (hObject=0x318) returned 1
	[0192.073] CryptDestroyKey (hKey=0x82b340) returned 1
	[0192.073] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.073] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f4118, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0192.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.073] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b400) returned 1
	[0192.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.073] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x27f41d0*=0x1, dwFlags=0x0) returned 1
	[0192.073] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x27f419c, dwFlags=0x0) returned 1
	[0192.074] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f41e0*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27f41e0*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0192.074] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f44cc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27f44cc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.074] CryptDestroyKey (hKey=0x82b400) returned 1
	[0192.074] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.074] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.074] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.075] GetFileType (hFile=0x318) returned 0x1
	[0192.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.075] GetFileType (hFile=0x318) returned 0x1
	[0192.075] WriteFile (in: hFile=0x318, lpBuffer=0x27f4728*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27f4728*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0192.076] CloseHandle (hObject=0x318) returned 1
	[0192.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.076] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacd0a69a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0192.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.076] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.077] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f5d40 | out: lpFileInformation=0x27f5d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918a2a15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0192.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.078] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.078] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.078] GetFileType (hFile=0x318) returned 0x1
	[0192.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.078] GetFileType (hFile=0x318) returned 0x1
	[0192.078] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d3
	[0192.078] ReadFile (in: hFile=0x318, lpBuffer=0x27f64c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27f64c0*, lpNumberOfBytesRead=0x57ff3fc*=0x2d3, lpOverlapped=0x0) returned 1
	[0192.079] CloseHandle (hObject=0x318) returned 1
	[0192.079] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.079] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.079] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f755c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0192.079] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.079] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.079] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b000) returned 1
	[0192.079] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.080] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x27f7614*=0x1, dwFlags=0x0) returned 1
	[0192.080] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x27f75e0, dwFlags=0x0) returned 1
	[0192.080] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f7624*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27f7624*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0192.080] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f7910*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27f7910*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.080] CryptDestroyKey (hKey=0x82b000) returned 1
	[0192.080] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.080] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.080] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.081] GetFileType (hFile=0x318) returned 0x1
	[0192.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.081] GetFileType (hFile=0x318) returned 0x1
	[0192.081] WriteFile (in: hFile=0x318, lpBuffer=0x27f7b6c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27f7b6c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0192.082] CloseHandle (hObject=0x318) returned 1
	[0192.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.082] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacd0a69a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0192.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.083] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.084] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27f9184 | out: lpFileInformation=0x27f9184*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918a2a15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0192.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.084] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.084] GetFileType (hFile=0x318) returned 0x1
	[0192.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.085] GetFileType (hFile=0x318) returned 0x1
	[0192.085] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cd
	[0192.085] ReadFile (in: hFile=0x318, lpBuffer=0x27f9900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27f9900*, lpNumberOfBytesRead=0x57ff3fc*=0x2cd, lpOverlapped=0x0) returned 1
	[0192.086] CloseHandle (hObject=0x318) returned 1
	[0192.086] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0192.086] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.086] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fa99c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0192.086] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.086] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.086] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0192.086] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.086] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27faa54*=0x1, dwFlags=0x0) returned 1
	[0192.086] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27faa20, dwFlags=0x0) returned 1
	[0192.086] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27faa64*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27faa64*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.086] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fad40*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27fad40*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.086] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.086] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.086] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.086] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.087] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.088] GetFileType (hFile=0x318) returned 0x1
	[0192.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.088] GetFileType (hFile=0x318) returned 0x1
	[0192.088] WriteFile (in: hFile=0x318, lpBuffer=0x27faf9c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27faf9c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.089] CloseHandle (hObject=0x318) returned 1
	[0192.089] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.089] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.089] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacd30a5d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.089] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.090] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.090] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27fc5b4 | out: lpFileInformation=0x27fc5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918a2a15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0192.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.091] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.091] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.091] GetFileType (hFile=0x318) returned 0x1
	[0192.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.091] GetFileType (hFile=0x318) returned 0x1
	[0192.091] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cd
	[0192.091] ReadFile (in: hFile=0x318, lpBuffer=0x27fcd30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27fcd30*, lpNumberOfBytesRead=0x57ff3fc*=0x2cd, lpOverlapped=0x0) returned 1
	[0192.114] CloseHandle (hObject=0x318) returned 1
	[0192.114] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0192.114] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.114] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fddcc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0192.114] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.114] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.114] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0192.114] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.114] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27fde84*=0x1, dwFlags=0x0) returned 1
	[0192.114] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27fde50, dwFlags=0x0) returned 1
	[0192.114] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27fde94*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27fde94*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.115] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fe170*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x27fe170*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.115] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.115] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.115] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.116] GetFileType (hFile=0x318) returned 0x1
	[0192.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.116] GetFileType (hFile=0x318) returned 0x1
	[0192.116] WriteFile (in: hFile=0x318, lpBuffer=0x27fe3cc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27fe3cc*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.117] CloseHandle (hObject=0x318) returned 1
	[0192.117] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.117] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.117] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacd7ce73, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.117] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0192.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.118] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27ff9e4 | out: lpFileInformation=0x27ff9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918c8c7c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc)) returned 1
	[0192.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.119] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0192.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.119] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.119] GetFileType (hFile=0x318) returned 0x1
	[0192.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.119] GetFileType (hFile=0x318) returned 0x1
	[0192.119] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2bc
	[0192.119] ReadFile (in: hFile=0x318, lpBuffer=0x280010c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x280010c*, lpNumberOfBytesRead=0x57ff3fc*=0x2bc, lpOverlapped=0x0) returned 1
	[0192.120] CloseHandle (hObject=0x318) returned 1
	[0192.120] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0192.121] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.121] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28011a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b2c0) returned 1
	[0192.121] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.121] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.121] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0192.121] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.121] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2801260*=0x1, dwFlags=0x0) returned 1
	[0192.121] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x280122c, dwFlags=0x0) returned 1
	[0192.121] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2801270*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x2801270*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0192.121] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x280153c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x280153c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.121] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0192.121] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.121] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.121] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0192.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.121] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.122] GetFileType (hFile=0x318) returned 0x1
	[0192.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.122] GetFileType (hFile=0x318) returned 0x1
	[0192.122] WriteFile (in: hFile=0x318, lpBuffer=0x2801778*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2801778*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0192.123] CloseHandle (hObject=0x318) returned 1
	[0192.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x97
	[0192.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc6
	[0192.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.124] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacd7ce73, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0192.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.124] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.125] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.125] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2802d5c | out: lpFileInformation=0x2802d5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918c8c7c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6)) returned 1
	[0192.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.125] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.125] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.125] GetFileType (hFile=0x318) returned 0x1
	[0192.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.125] GetFileType (hFile=0x318) returned 0x1
	[0192.125] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1c6
	[0192.125] ReadFile (in: hFile=0x318, lpBuffer=0x28033d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x28033d0*, lpNumberOfBytesRead=0x57ff3fc*=0x1c6, lpOverlapped=0x0) returned 1
	[0192.126] CloseHandle (hObject=0x318) returned 1
	[0192.126] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0192.127] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.127] CryptImportKey (in: hProv=0x7f93c0, pbData=0x280446c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0192.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.127] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0192.127] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.127] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2804524*=0x1, dwFlags=0x0) returned 1
	[0192.127] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x28044f0, dwFlags=0x0) returned 1
	[0192.128] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26048dc*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26048dc*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0192.129] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2604ab8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2604ab8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.129] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.129] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.129] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.129] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.129] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.130] GetFileType (hFile=0x318) returned 0x1
	[0192.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.130] GetFileType (hFile=0x318) returned 0x1
	[0192.130] WriteFile (in: hFile=0x318, lpBuffer=0x2604d14*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2604d14*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0192.131] CloseHandle (hObject=0x318) returned 1
	[0192.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.131] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacda3132, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0192.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.131] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.133] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0192.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.133] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x260632c | out: lpFileInformation=0x260632c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9032cd93, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9032cd93, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9032cd93, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1db)) returned 1
	[0192.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.133] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0192.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.134] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.134] GetFileType (hFile=0x318) returned 0x1
	[0192.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.134] GetFileType (hFile=0x318) returned 0x1
	[0192.134] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1db
	[0192.134] ReadFile (in: hFile=0x318, lpBuffer=0x26069a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26069a4*, lpNumberOfBytesRead=0x57ff3fc*=0x1db, lpOverlapped=0x0) returned 1
	[0192.135] CloseHandle (hObject=0x318) returned 1
	[0192.135] CryptDestroyKey (hKey=0x82b280) returned 1
	[0192.135] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.135] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2607a40, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b440) returned 1
	[0192.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.135] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0192.135] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.135] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2607af8*=0x1, dwFlags=0x0) returned 1
	[0192.135] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2607ac4, dwFlags=0x0) returned 1
	[0192.135] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2607b08*, pdwDataLen=0x57ff404*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x2607b08*, pdwDataLen=0x57ff404*=0x1e0) returned 1
	[0192.135] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2607cf4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2607cf4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.135] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.135] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.135] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.135] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0192.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.135] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.137] GetFileType (hFile=0x318) returned 0x1
	[0192.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.137] GetFileType (hFile=0x318) returned 0x1
	[0192.137] WriteFile (in: hFile=0x318, lpBuffer=0x2607f48*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2607f48*, lpNumberOfBytesWritten=0x57ff3c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0192.137] CloseHandle (hObject=0x318) returned 1
	[0192.138] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0192.138] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0192.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.138] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9032cd93, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9032cd93, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacda3132, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0192.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.138] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.139] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0192.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.140] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x260955c | out: lpFileInformation=0x260955c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900f0949, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0192.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0192.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.140] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.140] GetFileType (hFile=0x318) returned 0x1
	[0192.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.140] GetFileType (hFile=0x318) returned 0x1
	[0192.140] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cb
	[0192.140] ReadFile (in: hFile=0x318, lpBuffer=0x2609ce4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2609ce4*, lpNumberOfBytesRead=0x57ff3fc*=0x2cb, lpOverlapped=0x0) returned 1
	[0192.141] CloseHandle (hObject=0x318) returned 1
	[0192.141] CryptDestroyKey (hKey=0x82b440) returned 1
	[0192.142] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.142] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260ad80, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0192.142] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.142] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.142] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0192.142] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.142] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x260ae38*=0x1, dwFlags=0x0) returned 1
	[0192.142] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x260ae04, dwFlags=0x0) returned 1
	[0192.142] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260ae48*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x260ae48*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.142] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260b124*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x260b124*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.142] CryptDestroyKey (hKey=0x82b100) returned 1
	[0192.142] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.142] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.142] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0192.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.142] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.143] GetFileType (hFile=0x318) returned 0x1
	[0192.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.144] GetFileType (hFile=0x318) returned 0x1
	[0192.144] WriteFile (in: hFile=0x318, lpBuffer=0x260b388*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x260b388*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.144] CloseHandle (hObject=0x318) returned 1
	[0192.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0192.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0192.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.145] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacda3132, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.145] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0192.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.146] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x260c9b0 | out: lpFileInformation=0x260c9b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918c8c7c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be)) returned 1
	[0192.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.147] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0192.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.147] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.147] GetFileType (hFile=0x318) returned 0x1
	[0192.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.147] GetFileType (hFile=0x318) returned 0x1
	[0192.147] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2be
	[0192.147] ReadFile (in: hFile=0x318, lpBuffer=0x260d0ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x260d0ec*, lpNumberOfBytesRead=0x57ff3fc*=0x2be, lpOverlapped=0x0) returned 1
	[0192.171] CloseHandle (hObject=0x318) returned 1
	[0192.171] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.171] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.171] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260e188, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0192.171] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.171] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.171] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0192.171] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.171] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x260e240*=0x1, dwFlags=0x0) returned 1
	[0192.171] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x260e20c, dwFlags=0x0) returned 1
	[0192.172] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260e250*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x260e250*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0192.172] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260e51c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x260e51c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.172] CryptDestroyKey (hKey=0x82b540) returned 1
	[0192.172] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.172] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.172] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0192.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.172] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.173] GetFileType (hFile=0x318) returned 0x1
	[0192.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.173] GetFileType (hFile=0x318) returned 0x1
	[0192.173] WriteFile (in: hFile=0x318, lpBuffer=0x260e760*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x260e760*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0192.174] CloseHandle (hObject=0x318) returned 1
	[0192.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0192.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0192.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.174] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacdef678, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0192.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.174] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.175] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.176] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x260fd54 | out: lpFileInformation=0x260fd54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918c8c7c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6)) returned 1
	[0192.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.176] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.176] GetFileType (hFile=0x318) returned 0x1
	[0192.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.176] GetFileType (hFile=0x318) returned 0x1
	[0192.176] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1c6
	[0192.176] ReadFile (in: hFile=0x318, lpBuffer=0x26103c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26103c8*, lpNumberOfBytesRead=0x57ff3fc*=0x1c6, lpOverlapped=0x0) returned 1
	[0192.177] CloseHandle (hObject=0x318) returned 1
	[0192.177] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0192.177] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.177] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2611464, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0192.177] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.177] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.178] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b100) returned 1
	[0192.178] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.178] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x261151c*=0x1, dwFlags=0x0) returned 1
	[0192.178] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x26114e8, dwFlags=0x0) returned 1
	[0192.178] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261152c*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x261152c*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0192.178] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2611708*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2611708*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.178] CryptDestroyKey (hKey=0x82b100) returned 1
	[0192.178] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.178] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.178] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.179] GetFileType (hFile=0x318) returned 0x1
	[0192.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.179] GetFileType (hFile=0x318) returned 0x1
	[0192.179] WriteFile (in: hFile=0x318, lpBuffer=0x2611964*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2611964*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0192.180] CloseHandle (hObject=0x318) returned 1
	[0192.180] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.180] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.180] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xace158ab, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0192.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.180] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.182] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x95
	[0192.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.182] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2612f7c | out: lpFileInformation=0x2612f7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918c8c7c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5)) returned 1
	[0192.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.183] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x95
	[0192.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.183] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.183] GetFileType (hFile=0x318) returned 0x1
	[0192.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.183] GetFileType (hFile=0x318) returned 0x1
	[0192.183] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c5
	[0192.183] ReadFile (in: hFile=0x318, lpBuffer=0x26136a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26136a0*, lpNumberOfBytesRead=0x57ff3fc*=0x2c5, lpOverlapped=0x0) returned 1
	[0192.185] CloseHandle (hObject=0x318) returned 1
	[0192.185] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.185] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.185] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261473c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0192.185] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.185] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.185] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b200) returned 1
	[0192.185] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.185] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26147f4*=0x1, dwFlags=0x0) returned 1
	[0192.185] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26147c0, dwFlags=0x0) returned 1
	[0192.185] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2614804*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2614804*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.185] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2614ae0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2614ae0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.185] CryptDestroyKey (hKey=0x82b200) returned 1
	[0192.185] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.185] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.185] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x95
	[0192.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.185] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.186] GetFileType (hFile=0x318) returned 0x1
	[0192.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.187] GetFileType (hFile=0x318) returned 0x1
	[0192.187] WriteFile (in: hFile=0x318, lpBuffer=0x2614d14*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2614d14*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.187] CloseHandle (hObject=0x318) returned 1
	[0192.188] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x95
	[0192.188] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc4
	[0192.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.188] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xace158ab, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.188] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.189] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x95
	[0192.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.189] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26162e8 | out: lpFileInformation=0x26162e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918eeee8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1)) returned 1
	[0192.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.189] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x95
	[0192.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.189] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.189] GetFileType (hFile=0x318) returned 0x1
	[0192.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.189] GetFileType (hFile=0x318) returned 0x1
	[0192.190] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c1
	[0192.190] ReadFile (in: hFile=0x318, lpBuffer=0x2616a08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2616a08*, lpNumberOfBytesRead=0x57ff3fc*=0x2c1, lpOverlapped=0x0) returned 1
	[0192.191] CloseHandle (hObject=0x318) returned 1
	[0192.191] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.191] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.191] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2617aa4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b400) returned 1
	[0192.191] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.191] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.191] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0192.191] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.191] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2617b5c*=0x1, dwFlags=0x0) returned 1
	[0192.191] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2617b28, dwFlags=0x0) returned 1
	[0192.191] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2617b6c*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2617b6c*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.191] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2617e48*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2617e48*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.192] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.192] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.192] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.192] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x95
	[0192.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.192] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.193] GetFileType (hFile=0x318) returned 0x1
	[0192.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.193] GetFileType (hFile=0x318) returned 0x1
	[0192.193] WriteFile (in: hFile=0x318, lpBuffer=0x261807c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x261807c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.194] CloseHandle (hObject=0x318) returned 1
	[0192.194] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x95
	[0192.194] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc4
	[0192.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.195] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xace3ba62, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.195] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.196] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.196] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2619650 | out: lpFileInformation=0x2619650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918eeee8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c3)) returned 1
	[0192.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.196] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.196] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.196] GetFileType (hFile=0x318) returned 0x1
	[0192.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.196] GetFileType (hFile=0x318) returned 0x1
	[0192.196] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1c3
	[0192.196] ReadFile (in: hFile=0x318, lpBuffer=0x2619cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2619cc0*, lpNumberOfBytesRead=0x57ff3fc*=0x1c3, lpOverlapped=0x0) returned 1
	[0192.197] CloseHandle (hObject=0x318) returned 1
	[0192.197] CryptDestroyKey (hKey=0x82b400) returned 1
	[0192.197] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.197] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261ad5c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0192.197] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.198] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.198] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b400) returned 1
	[0192.198] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.198] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x261ae14*=0x1, dwFlags=0x0) returned 1
	[0192.198] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x261ade0, dwFlags=0x0) returned 1
	[0192.198] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261ae24*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x261ae24*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0192.198] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261b000*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x261b000*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.198] CryptDestroyKey (hKey=0x82b400) returned 1
	[0192.198] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.198] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.198] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.198] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.199] GetFileType (hFile=0x318) returned 0x1
	[0192.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.199] GetFileType (hFile=0x318) returned 0x1
	[0192.199] WriteFile (in: hFile=0x318, lpBuffer=0x261b25c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x261b25c*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0192.200] CloseHandle (hObject=0x318) returned 1
	[0192.200] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.200] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.200] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xace3ba62, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0192.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.201] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.202] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.202] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x261c874 | out: lpFileInformation=0x261c874*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918eeee8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0192.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.203] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.203] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.203] GetFileType (hFile=0x318) returned 0x1
	[0192.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.203] GetFileType (hFile=0x318) returned 0x1
	[0192.203] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ca
	[0192.203] ReadFile (in: hFile=0x318, lpBuffer=0x261cfcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x261cfcc*, lpNumberOfBytesRead=0x57ff3fc*=0x2ca, lpOverlapped=0x0) returned 1
	[0192.204] CloseHandle (hObject=0x318) returned 1
	[0192.204] CryptDestroyKey (hKey=0x82b540) returned 1
	[0192.204] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.204] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261e068, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0192.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.204] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.205] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b540) returned 1
	[0192.205] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.205] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x261e120*=0x1, dwFlags=0x0) returned 1
	[0192.205] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x261e0ec, dwFlags=0x0) returned 1
	[0192.205] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261e130*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x261e130*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.205] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261e40c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x261e40c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.205] CryptDestroyKey (hKey=0x82b540) returned 1
	[0192.205] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.205] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.205] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.206] WriteFile (in: hFile=0x318, lpBuffer=0x261e658*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x261e658*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.207] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.230] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.230] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.230] GetFileType (hFile=0x318) returned 0x1
	[0192.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.230] GetFileType (hFile=0x318) returned 0x1
	[0192.231] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c5
	[0192.231] ReadFile (in: hFile=0x318, lpBuffer=0x26203b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26203b0*, lpNumberOfBytesRead=0x57ff3fc*=0x2c5, lpOverlapped=0x0) returned 1
	[0192.232] CloseHandle (hObject=0x318) returned 1
	[0192.232] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.232] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.232] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262144c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b0c0) returned 1
	[0192.232] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.232] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.232] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0192.232] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.232] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2621504*=0x1, dwFlags=0x0) returned 1
	[0192.232] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26214d0, dwFlags=0x0) returned 1
	[0192.232] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2621514*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2621514*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.232] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26217f0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26217f0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.232] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0192.233] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.233] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.233] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.233] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.234] GetFileType (hFile=0x318) returned 0x1
	[0192.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.234] GetFileType (hFile=0x318) returned 0x1
	[0192.234] WriteFile (in: hFile=0x318, lpBuffer=0x2621a3c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2621a3c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.235] CloseHandle (hObject=0x318) returned 1
	[0192.235] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.235] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0192.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.235] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xace87fa6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.235] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.236] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.236] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2623040 | out: lpFileInformation=0x2623040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918eeee8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7)) returned 1
	[0192.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.237] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.237] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.237] GetFileType (hFile=0x318) returned 0x1
	[0192.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.237] GetFileType (hFile=0x318) returned 0x1
	[0192.237] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c7
	[0192.237] ReadFile (in: hFile=0x318, lpBuffer=0x26237b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26237b4*, lpNumberOfBytesRead=0x57ff3fc*=0x2c7, lpOverlapped=0x0) returned 1
	[0192.238] CloseHandle (hObject=0x318) returned 1
	[0192.238] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0192.238] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.238] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2624850, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b5c0) returned 1
	[0192.238] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.239] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.239] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0192.239] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.239] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2624908*=0x1, dwFlags=0x0) returned 1
	[0192.239] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26248d4, dwFlags=0x0) returned 1
	[0192.239] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2624918*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2624918*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.239] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2624bf4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2624bf4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.239] CryptDestroyKey (hKey=0x82b480) returned 1
	[0192.239] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.239] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.239] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.239] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.241] GetFileType (hFile=0x318) returned 0x1
	[0192.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.241] GetFileType (hFile=0x318) returned 0x1
	[0192.241] WriteFile (in: hFile=0x318, lpBuffer=0x2624e50*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2624e50*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.241] CloseHandle (hObject=0x318) returned 1
	[0192.242] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.242] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.242] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaceae124, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.242] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.243] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.243] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2626468 | out: lpFileInformation=0x2626468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918eeee8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0192.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.243] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.243] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.243] GetFileType (hFile=0x318) returned 0x1
	[0192.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.244] GetFileType (hFile=0x318) returned 0x1
	[0192.244] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c9
	[0192.244] ReadFile (in: hFile=0x318, lpBuffer=0x2626be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2626be0*, lpNumberOfBytesRead=0x57ff3fc*=0x2c9, lpOverlapped=0x0) returned 1
	[0192.245] CloseHandle (hObject=0x318) returned 1
	[0192.245] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0192.245] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.245] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2627c7c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b4c0) returned 1
	[0192.245] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.245] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.245] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b300) returned 1
	[0192.245] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.245] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2627d34*=0x1, dwFlags=0x0) returned 1
	[0192.245] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2627d00, dwFlags=0x0) returned 1
	[0192.246] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2627d44*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2627d44*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.246] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2628020*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2628020*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.246] CryptDestroyKey (hKey=0x82b300) returned 1
	[0192.246] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.246] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.246] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.246] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.247] GetFileType (hFile=0x318) returned 0x1
	[0192.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.247] GetFileType (hFile=0x318) returned 0x1
	[0192.248] WriteFile (in: hFile=0x318, lpBuffer=0x262827c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x262827c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.249] CloseHandle (hObject=0x318) returned 1
	[0192.249] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.249] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.249] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaceae124, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.249] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.250] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0192.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.250] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2629894 | out: lpFileInformation=0x2629894*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91915157, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0192.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.250] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0192.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.251] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.251] GetFileType (hFile=0x318) returned 0x1
	[0192.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.251] GetFileType (hFile=0x318) returned 0x1
	[0192.251] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ca
	[0192.251] ReadFile (in: hFile=0x318, lpBuffer=0x262a01c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x262a01c*, lpNumberOfBytesRead=0x57ff3fc*=0x2ca, lpOverlapped=0x0) returned 1
	[0192.252] CloseHandle (hObject=0x318) returned 1
	[0192.252] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0192.252] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.252] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262b0b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0192.252] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.252] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.252] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0192.252] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.253] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x262b170*=0x1, dwFlags=0x0) returned 1
	[0192.253] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x262b13c, dwFlags=0x0) returned 1
	[0192.253] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262b180*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x262b180*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.253] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262b45c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x262b45c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.253] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0192.253] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.253] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.253] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0192.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.253] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.254] GetFileType (hFile=0x318) returned 0x1
	[0192.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.254] GetFileType (hFile=0x318) returned 0x1
	[0192.254] WriteFile (in: hFile=0x318, lpBuffer=0x262b6c0*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x262b6c0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.255] CloseHandle (hObject=0x318) returned 1
	[0192.255] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa1
	[0192.255] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd0
	[0192.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.255] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaced43d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.256] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.257] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.257] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x262ccf4 | out: lpFileInformation=0x262ccf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90353002, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0192.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.257] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.257] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.258] GetFileType (hFile=0x318) returned 0x1
	[0192.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.258] GetFileType (hFile=0x318) returned 0x1
	[0192.258] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ca
	[0192.258] ReadFile (in: hFile=0x318, lpBuffer=0x262d46c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x262d46c*, lpNumberOfBytesRead=0x57ff3fc*=0x2ca, lpOverlapped=0x0) returned 1
	[0192.259] CloseHandle (hObject=0x318) returned 1
	[0192.259] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.259] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.259] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262e508, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b280) returned 1
	[0192.259] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.259] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.259] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b340) returned 1
	[0192.260] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.260] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x262e5c0*=0x1, dwFlags=0x0) returned 1
	[0192.260] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x262e58c, dwFlags=0x0) returned 1
	[0192.260] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262e5d0*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x262e5d0*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.260] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262e8ac*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x262e8ac*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.260] CryptDestroyKey (hKey=0x82b340) returned 1
	[0192.260] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.260] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.260] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.260] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.261] GetFileType (hFile=0x318) returned 0x1
	[0192.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.261] GetFileType (hFile=0x318) returned 0x1
	[0192.261] WriteFile (in: hFile=0x318, lpBuffer=0x262eb08*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x262eb08*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.262] CloseHandle (hObject=0x318) returned 1
	[0192.265] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0192.265] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0192.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.265] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaced43d9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.265] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.266] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x263012c | out: lpFileInformation=0x263012c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91915157, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x309)) returned 1
	[0192.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.266] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.267] GetFileType (hFile=0x318) returned 0x1
	[0192.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.267] GetFileType (hFile=0x318) returned 0x1
	[0192.267] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x309
	[0192.267] ReadFile (in: hFile=0x318, lpBuffer=0x2630924, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2630924*, lpNumberOfBytesRead=0x57ff3fc*=0x309, lpOverlapped=0x0) returned 1
	[0192.286] CloseHandle (hObject=0x318) returned 1
	[0192.286] CryptDestroyKey (hKey=0x82b280) returned 1
	[0192.286] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.286] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26319c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0192.286] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.286] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.286] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0192.286] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.286] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2631a78*=0x1, dwFlags=0x0) returned 1
	[0192.286] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2631a44, dwFlags=0x0) returned 1
	[0192.286] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2631a88*, pdwDataLen=0x57ff404*=0x310, dwBufLen=0x310 | out: pbData=0x2631a88*, pdwDataLen=0x57ff404*=0x310) returned 1
	[0192.286] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2631da4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2631da4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.286] CryptDestroyKey (hKey=0x82b080) returned 1
	[0192.286] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.286] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.286] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.287] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.288] GetFileType (hFile=0x318) returned 0x1
	[0192.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.288] GetFileType (hFile=0x318) returned 0x1
	[0192.288] WriteFile (in: hFile=0x318, lpBuffer=0x2632020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2632020*, lpNumberOfBytesWritten=0x57ff3c4*=0x310, lpOverlapped=0x0) returned 1
	[0192.289] CloseHandle (hObject=0x318) returned 1
	[0192.289] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.289] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0192.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.289] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacf20997, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1
	[0192.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.289] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.290] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", lpFilePart=0x0) returned 0xb0
	[0192.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.290] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2633684 | out: lpFileInformation=0x2633684*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91915157, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c8)) returned 1
	[0192.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.291] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", lpFilePart=0x0) returned 0xb0
	[0192.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.291] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.291] GetFileType (hFile=0x318) returned 0x1
	[0192.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.291] GetFileType (hFile=0x318) returned 0x1
	[0192.291] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1c8
	[0192.291] ReadFile (in: hFile=0x318, lpBuffer=0x2633d88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2633d88*, lpNumberOfBytesRead=0x57ff3fc*=0x1c8, lpOverlapped=0x0) returned 1
	[0192.292] CloseHandle (hObject=0x318) returned 1
	[0192.292] CryptDestroyKey (hKey=0x82b540) returned 1
	[0192.292] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.292] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2634e24, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0192.292] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.293] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.293] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b200) returned 1
	[0192.293] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.293] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2634edc*=0x1, dwFlags=0x0) returned 1
	[0192.293] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2634ea8, dwFlags=0x0) returned 1
	[0192.293] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2634eec*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x2634eec*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0192.293] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26350c8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26350c8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.293] CryptDestroyKey (hKey=0x82b200) returned 1
	[0192.293] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.293] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", lpFilePart=0x0) returned 0xb0
	[0192.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.293] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.294] GetFileType (hFile=0x318) returned 0x1
	[0192.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.295] GetFileType (hFile=0x318) returned 0x1
	[0192.295] WriteFile (in: hFile=0x318, lpBuffer=0x263536c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x263536c*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0192.295] CloseHandle (hObject=0x318) returned 1
	[0192.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", lpFilePart=0x0) returned 0xb0
	[0192.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdf
	[0192.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.296] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacf20997, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0192.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.296] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.297] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", lpFilePart=0x0) returned 0xa7
	[0192.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.297] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2636a14 | out: lpFileInformation=0x2636a14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91915157, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1bf)) returned 1
	[0192.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.297] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", lpFilePart=0x0) returned 0xa7
	[0192.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.298] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.298] GetFileType (hFile=0x318) returned 0x1
	[0192.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.298] GetFileType (hFile=0x318) returned 0x1
	[0192.298] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1bf
	[0192.298] ReadFile (in: hFile=0x318, lpBuffer=0x26370c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26370c0*, lpNumberOfBytesRead=0x57ff3fc*=0x1bf, lpOverlapped=0x0) returned 1
	[0192.299] CloseHandle (hObject=0x318) returned 1
	[0192.299] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.299] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.299] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263815c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b000) returned 1
	[0192.299] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.299] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.299] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b440) returned 1
	[0192.299] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.299] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2638214*=0x1, dwFlags=0x0) returned 1
	[0192.299] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26381e0, dwFlags=0x0) returned 1
	[0192.299] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2638224*, pdwDataLen=0x57ff404*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x2638224*, pdwDataLen=0x57ff404*=0x1c0) returned 1
	[0192.299] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26383f0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26383f0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.299] CryptDestroyKey (hKey=0x82b440) returned 1
	[0192.299] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.299] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.299] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", lpFilePart=0x0) returned 0xa7
	[0192.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.299] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.301] GetFileType (hFile=0x318) returned 0x1
	[0192.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.301] GetFileType (hFile=0x318) returned 0x1
	[0192.301] WriteFile (in: hFile=0x318, lpBuffer=0x263866c*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x263866c*, lpNumberOfBytesWritten=0x57ff3c4*=0x1c0, lpOverlapped=0x0) returned 1
	[0192.302] CloseHandle (hObject=0x318) returned 1
	[0192.302] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", lpFilePart=0x0) returned 0xa7
	[0192.302] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0192.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.302] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacf46b95, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1c0)) returned 1
	[0192.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.302] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.304] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0192.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.304] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2639cd0 | out: lpFileInformation=0x2639cd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91915157, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd)) returned 1
	[0192.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.305] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0192.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.305] ReadFile (in: hFile=0x318, lpBuffer=0x263a44c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x263a44c*, lpNumberOfBytesRead=0x57ff3fc*=0x2bd, lpOverlapped=0x0) returned 1
	[0192.306] CryptDestroyKey (hKey=0x82b000) returned 1
	[0192.306] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.306] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263b4e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0192.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.306] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0192.306] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.306] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x263b5a0*=0x1, dwFlags=0x0) returned 1
	[0192.306] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x263b56c, dwFlags=0x0) returned 1
	[0192.307] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263b5b0*, pdwDataLen=0x57ff404*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x263b5b0*, pdwDataLen=0x57ff404*=0x2c0) returned 1
	[0192.307] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263b87c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x263b87c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.307] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0192.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.307] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.307] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0192.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.307] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.308] GetFileType (hFile=0x318) returned 0x1
	[0192.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.308] GetFileType (hFile=0x318) returned 0x1
	[0192.308] WriteFile (in: hFile=0x318, lpBuffer=0x263bae0*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x263bae0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2c0, lpOverlapped=0x0) returned 1
	[0192.309] CloseHandle (hObject=0x318) returned 1
	[0192.309] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0192.309] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0192.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.309] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacf46b95, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0192.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.309] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0192.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.310] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x263d108 | out: lpFileInformation=0x263d108*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9193b3c3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x399)) returned 1
	[0192.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.311] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0192.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.311] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.311] GetFileType (hFile=0x318) returned 0x1
	[0192.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.311] GetFileType (hFile=0x318) returned 0x1
	[0192.311] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x399
	[0192.311] ReadFile (in: hFile=0x318, lpBuffer=0x263d940, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x263d940*, lpNumberOfBytesRead=0x57ff3fc*=0x399, lpOverlapped=0x0) returned 1
	[0192.312] CloseHandle (hObject=0x318) returned 1
	[0192.312] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.312] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.312] CryptImportKey (in: hProv=0x7f93c0, pbData=0x263e9dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0192.312] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.312] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.313] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b2c0) returned 1
	[0192.313] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.313] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x263ea94*=0x1, dwFlags=0x0) returned 1
	[0192.313] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x263ea60, dwFlags=0x0) returned 1
	[0192.313] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x263eaa4*, pdwDataLen=0x57ff404*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x263eaa4*, pdwDataLen=0x57ff404*=0x3a0) returned 1
	[0192.313] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263ee50*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x263ee50*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.313] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0192.313] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.313] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.313] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0192.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.313] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.314] GetFileType (hFile=0x318) returned 0x1
	[0192.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.314] GetFileType (hFile=0x318) returned 0x1
	[0192.314] WriteFile (in: hFile=0x318, lpBuffer=0x263f0a4*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x263f0a4*, lpNumberOfBytesWritten=0x57ff3c4*=0x3a0, lpOverlapped=0x0) returned 1
	[0192.315] CloseHandle (hObject=0x318) returned 1
	[0192.315] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0192.315] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0192.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.315] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacf46b95, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1
	[0192.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.315] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0192.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.316] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26406ac | out: lpFileInformation=0x26406ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9193b3c3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9)) returned 1
	[0192.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.317] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0192.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.317] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.317] GetFileType (hFile=0x318) returned 0x1
	[0192.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.317] GetFileType (hFile=0x318) returned 0x1
	[0192.317] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1c9
	[0192.317] ReadFile (in: hFile=0x318, lpBuffer=0x2640ca4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2640ca4*, lpNumberOfBytesRead=0x57ff3fc*=0x1c9, lpOverlapped=0x0) returned 1
	[0192.318] CloseHandle (hObject=0x318) returned 1
	[0192.318] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.318] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.318] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2641d40, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0192.318] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.318] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.318] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b4c0) returned 1
	[0192.318] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.318] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2641df8*=0x1, dwFlags=0x0) returned 1
	[0192.318] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x2641dc4, dwFlags=0x0) returned 1
	[0192.318] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2641e08*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x2641e08*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0192.318] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2641fe4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2641fe4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.318] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0192.319] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.319] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.319] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0192.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.319] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.320] GetFileType (hFile=0x318) returned 0x1
	[0192.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.320] GetFileType (hFile=0x318) returned 0x1
	[0192.320] WriteFile (in: hFile=0x318, lpBuffer=0x2642200*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2642200*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0192.321] CloseHandle (hObject=0x318) returned 1
	[0192.321] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0192.321] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0192.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.321] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacf6cde5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0192.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.321] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.347] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0192.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.347] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26437a4 | out: lpFileInformation=0x26437a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9193b3c3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x387)) returned 1
	[0192.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.348] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0192.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.348] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.348] GetFileType (hFile=0x318) returned 0x1
	[0192.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.348] GetFileType (hFile=0x318) returned 0x1
	[0192.348] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x387
	[0192.348] ReadFile (in: hFile=0x318, lpBuffer=0x2643fc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2643fc8*, lpNumberOfBytesRead=0x57ff3fc*=0x387, lpOverlapped=0x0) returned 1
	[0192.350] CloseHandle (hObject=0x318) returned 1
	[0192.350] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.350] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.350] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2645064, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b040) returned 1
	[0192.350] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.350] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.350] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b000) returned 1
	[0192.350] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.350] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x264511c*=0x1, dwFlags=0x0) returned 1
	[0192.350] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x26450e8, dwFlags=0x0) returned 1
	[0192.350] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264512c*, pdwDataLen=0x57ff404*=0x390, dwBufLen=0x390 | out: pbData=0x264512c*, pdwDataLen=0x57ff404*=0x390) returned 1
	[0192.350] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26454c8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26454c8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.350] CryptDestroyKey (hKey=0x82b000) returned 1
	[0192.350] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.350] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.350] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0192.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.350] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.352] GetFileType (hFile=0x318) returned 0x1
	[0192.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.352] GetFileType (hFile=0x318) returned 0x1
	[0192.352] WriteFile (in: hFile=0x318, lpBuffer=0x264571c*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x264571c*, lpNumberOfBytesWritten=0x57ff3c4*=0x390, lpOverlapped=0x0) returned 1
	[0192.352] CloseHandle (hObject=0x318) returned 1
	[0192.353] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0192.353] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0192.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.353] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacfb91e5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x390)) returned 1
	[0192.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.353] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.354] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb8
	[0192.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.354] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2646d24 | out: lpFileInformation=0x2646d24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9193b3c3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6)) returned 1
	[0192.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.354] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb8
	[0192.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.354] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.354] GetFileType (hFile=0x318) returned 0x1
	[0192.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.355] GetFileType (hFile=0x318) returned 0x1
	[0192.355] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d6
	[0192.355] ReadFile (in: hFile=0x318, lpBuffer=0x2647578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2647578*, lpNumberOfBytesRead=0x57ff3fc*=0x2d6, lpOverlapped=0x0) returned 1
	[0192.361] CloseHandle (hObject=0x318) returned 1
	[0192.361] CryptDestroyKey (hKey=0x82b040) returned 1
	[0192.361] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.361] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2648614, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b300) returned 1
	[0192.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.361] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0192.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.362] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26486cc*=0x1, dwFlags=0x0) returned 1
	[0192.362] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2648698, dwFlags=0x0) returned 1
	[0192.362] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26486dc*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26486dc*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0192.362] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26489c8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26489c8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.362] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.362] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.362] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.362] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb8
	[0192.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.362] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.363] GetFileType (hFile=0x318) returned 0x1
	[0192.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.363] GetFileType (hFile=0x318) returned 0x1
	[0192.363] WriteFile (in: hFile=0x318, lpBuffer=0x2648c8c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2648c8c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0192.364] CloseHandle (hObject=0x318) returned 1
	[0192.364] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb8
	[0192.364] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe7
	[0192.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.364] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacfdf424, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0192.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.365] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.366] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.366] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x264a374 | out: lpFileInformation=0x264a374*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9193b3c3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ca)) returned 1
	[0192.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.366] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.366] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.366] GetFileType (hFile=0x318) returned 0x1
	[0192.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.366] GetFileType (hFile=0x318) returned 0x1
	[0192.366] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1ca
	[0192.366] ReadFile (in: hFile=0x318, lpBuffer=0x264a9ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x264a9ec*, lpNumberOfBytesRead=0x57ff3fc*=0x1ca, lpOverlapped=0x0) returned 1
	[0192.367] CloseHandle (hObject=0x318) returned 1
	[0192.367] CryptDestroyKey (hKey=0x82b300) returned 1
	[0192.367] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.368] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264ba88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0192.368] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.368] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.368] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0192.368] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.368] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x264bb40*=0x1, dwFlags=0x0) returned 1
	[0192.368] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x264bb0c, dwFlags=0x0) returned 1
	[0192.368] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264bb50*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x264bb50*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0192.368] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264bd2c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x264bd2c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.368] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.368] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.368] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.368] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.368] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.369] GetFileType (hFile=0x318) returned 0x1
	[0192.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.369] GetFileType (hFile=0x318) returned 0x1
	[0192.369] WriteFile (in: hFile=0x318, lpBuffer=0x264bf88*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x264bf88*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0192.370] CloseHandle (hObject=0x318) returned 1
	[0192.370] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.370] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.371] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacfdf424, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0192.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.371] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0192.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.373] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x264d5a0 | out: lpFileInformation=0x264d5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91961627, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5)) returned 1
	[0192.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0192.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.374] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.374] GetFileType (hFile=0x318) returned 0x1
	[0192.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.374] GetFileType (hFile=0x318) returned 0x1
	[0192.374] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c5
	[0192.374] ReadFile (in: hFile=0x318, lpBuffer=0x264dd04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x264dd04*, lpNumberOfBytesRead=0x57ff3fc*=0x2c5, lpOverlapped=0x0) returned 1
	[0192.375] CloseHandle (hObject=0x318) returned 1
	[0192.375] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0192.375] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.375] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264eda0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0192.375] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.375] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.375] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0192.376] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.376] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x264ee58*=0x1, dwFlags=0x0) returned 1
	[0192.376] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x264ee24, dwFlags=0x0) returned 1
	[0192.376] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264ee68*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x264ee68*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.376] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264f144*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x264f144*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.376] CryptDestroyKey (hKey=0x82b080) returned 1
	[0192.376] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.376] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.376] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0192.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.376] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.377] GetFileType (hFile=0x318) returned 0x1
	[0192.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.377] GetFileType (hFile=0x318) returned 0x1
	[0192.377] WriteFile (in: hFile=0x318, lpBuffer=0x264f398*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x264f398*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.378] CloseHandle (hObject=0x318) returned 1
	[0192.378] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9c
	[0192.378] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcb
	[0192.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.378] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xacfdf424, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.379] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0192.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.406] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26509a0 | out: lpFileInformation=0x26509a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90353002, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c8)) returned 1
	[0192.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0192.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.406] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.406] GetFileType (hFile=0x318) returned 0x1
	[0192.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.407] GetFileType (hFile=0x318) returned 0x1
	[0192.407] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1c8
	[0192.407] ReadFile (in: hFile=0x318, lpBuffer=0x2651004, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2651004*, lpNumberOfBytesRead=0x57ff3fc*=0x1c8, lpOverlapped=0x0) returned 1
	[0192.407] CloseHandle (hObject=0x318) returned 1
	[0192.408] CryptDestroyKey (hKey=0x82b540) returned 1
	[0192.408] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.408] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26520a0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b200) returned 1
	[0192.408] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.408] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.408] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0192.408] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.408] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2652158*=0x1, dwFlags=0x0) returned 1
	[0192.408] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2652124, dwFlags=0x0) returned 1
	[0192.408] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2652168*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x2652168*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0192.408] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2652344*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2652344*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.408] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0192.408] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.408] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.408] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0192.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.408] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.409] GetFileType (hFile=0x318) returned 0x1
	[0192.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.409] GetFileType (hFile=0x318) returned 0x1
	[0192.409] WriteFile (in: hFile=0x318, lpBuffer=0x2652598*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2652598*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0192.410] CloseHandle (hObject=0x318) returned 1
	[0192.410] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9d
	[0192.410] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0192.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.411] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad02b97c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0192.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.411] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.412] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0192.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.413] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2653bac | out: lpFileInformation=0x2653bac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91961627, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300)) returned 1
	[0192.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.413] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0192.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.413] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.413] GetFileType (hFile=0x318) returned 0x1
	[0192.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.413] GetFileType (hFile=0x318) returned 0x1
	[0192.413] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x300
	[0192.413] ReadFile (in: hFile=0x318, lpBuffer=0x2654388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2654388*, lpNumberOfBytesRead=0x57ff3fc*=0x300, lpOverlapped=0x0) returned 1
	[0192.414] CloseHandle (hObject=0x318) returned 1
	[0192.414] CryptDestroyKey (hKey=0x82b200) returned 1
	[0192.414] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.415] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2655424, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b400) returned 1
	[0192.415] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.415] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.415] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0192.415] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.415] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26554dc*=0x1, dwFlags=0x0) returned 1
	[0192.415] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26554a8, dwFlags=0x0) returned 1
	[0192.415] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26554ec*, pdwDataLen=0x57ff404*=0x310, dwBufLen=0x310 | out: pbData=0x26554ec*, pdwDataLen=0x57ff404*=0x310) returned 1
	[0192.415] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2655808*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2655808*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.415] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.415] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.415] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0192.416] WriteFile (in: hFile=0x318, lpBuffer=0x2655a7c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2655a7c*, lpNumberOfBytesWritten=0x57ff3c4*=0x310, lpOverlapped=0x0) returned 1
	[0192.417] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.418] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.418] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.419] GetFileType (hFile=0x318) returned 0x1
	[0192.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.419] GetFileType (hFile=0x318) returned 0x1
	[0192.419] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1d3
	[0192.419] ReadFile (in: hFile=0x318, lpBuffer=0x2657744, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2657744*, lpNumberOfBytesRead=0x57ff3fc*=0x1d3, lpOverlapped=0x0) returned 1
	[0192.420] CloseHandle (hObject=0x318) returned 1
	[0192.420] CryptDestroyKey (hKey=0x82b400) returned 1
	[0192.420] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.420] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26587e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b2c0) returned 1
	[0192.420] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.420] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.420] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0192.420] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.420] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2658898*=0x1, dwFlags=0x0) returned 1
	[0192.420] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2658864, dwFlags=0x0) returned 1
	[0192.420] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26588a8*, pdwDataLen=0x57ff404*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x26588a8*, pdwDataLen=0x57ff404*=0x1e0) returned 1
	[0192.420] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2658a94*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2658a94*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.420] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.420] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.420] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.420] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.421] GetFileType (hFile=0x318) returned 0x1
	[0192.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.421] GetFileType (hFile=0x318) returned 0x1
	[0192.421] WriteFile (in: hFile=0x318, lpBuffer=0x2658cf0*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2658cf0*, lpNumberOfBytesWritten=0x57ff3c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0192.422] CloseHandle (hObject=0x318) returned 1
	[0192.422] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0192.422] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.422] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad051bde, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0192.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.422] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.424] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", lpFilePart=0x0) returned 0xb0
	[0192.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.424] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), fInfoLevelId=0x0, lpFileInformation=0x265a308 | out: lpFileInformation=0x265a308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91961627, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c8)) returned 1
	[0192.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.424] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", lpFilePart=0x0) returned 0xb0
	[0192.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.424] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.424] GetFileType (hFile=0x318) returned 0x1
	[0192.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.424] GetFileType (hFile=0x318) returned 0x1
	[0192.424] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1c8
	[0192.425] ReadFile (in: hFile=0x318, lpBuffer=0x265aa0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x265aa0c*, lpNumberOfBytesRead=0x57ff3fc*=0x1c8, lpOverlapped=0x0) returned 1
	[0192.426] CloseHandle (hObject=0x318) returned 1
	[0192.426] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0192.426] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.426] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265baa8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b2c0) returned 1
	[0192.426] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.426] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.426] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b480) returned 1
	[0192.426] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.426] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x265bb60*=0x1, dwFlags=0x0) returned 1
	[0192.426] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x265bb2c, dwFlags=0x0) returned 1
	[0192.426] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265bb70*, pdwDataLen=0x57ff404*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x265bb70*, pdwDataLen=0x57ff404*=0x1d0) returned 1
	[0192.426] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265bd4c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x265bd4c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.426] CryptDestroyKey (hKey=0x82b480) returned 1
	[0192.426] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.426] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.426] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", lpFilePart=0x0) returned 0xb0
	[0192.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.426] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.427] GetFileType (hFile=0x318) returned 0x1
	[0192.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.428] GetFileType (hFile=0x318) returned 0x1
	[0192.428] WriteFile (in: hFile=0x318, lpBuffer=0x265bff0*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x265bff0*, lpNumberOfBytesWritten=0x57ff3c4*=0x1d0, lpOverlapped=0x0) returned 1
	[0192.428] CloseHandle (hObject=0x318) returned 1
	[0192.428] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", lpFilePart=0x0) returned 0xb0
	[0192.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdf
	[0192.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.429] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad077da3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0192.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.429] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.430] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", lpFilePart=0x0) returned 0xa7
	[0192.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.430] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), fInfoLevelId=0x0, lpFileInformation=0x265d698 | out: lpFileInformation=0x265d698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91961627, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1bf)) returned 1
	[0192.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.430] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", lpFilePart=0x0) returned 0xa7
	[0192.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.430] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.430] GetFileType (hFile=0x318) returned 0x1
	[0192.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.430] GetFileType (hFile=0x318) returned 0x1
	[0192.431] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1bf
	[0192.431] ReadFile (in: hFile=0x318, lpBuffer=0x265dd44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x265dd44*, lpNumberOfBytesRead=0x57ff3fc*=0x1bf, lpOverlapped=0x0) returned 1
	[0192.431] CloseHandle (hObject=0x318) returned 1
	[0192.431] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0192.431] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.432] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265ede0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0192.432] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.432] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.432] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b080) returned 1
	[0192.432] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.432] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x265ee98*=0x1, dwFlags=0x0) returned 1
	[0192.432] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x265ee64, dwFlags=0x0) returned 1
	[0192.432] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265eea8*, pdwDataLen=0x57ff404*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x265eea8*, pdwDataLen=0x57ff404*=0x1c0) returned 1
	[0192.432] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x265f074*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x265f074*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.432] CryptDestroyKey (hKey=0x82b080) returned 1
	[0192.432] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.432] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", lpFilePart=0x0) returned 0xa7
	[0192.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.432] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.433] GetFileType (hFile=0x318) returned 0x1
	[0192.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.433] GetFileType (hFile=0x318) returned 0x1
	[0192.433] WriteFile (in: hFile=0x318, lpBuffer=0x265f2f0*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x265f2f0*, lpNumberOfBytesWritten=0x57ff3c4*=0x1c0, lpOverlapped=0x0) returned 1
	[0192.434] CloseHandle (hObject=0x318) returned 1
	[0192.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", lpFilePart=0x0) returned 0xa7
	[0192.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0192.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.434] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad077da3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1c0)) returned 1
	[0192.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.434] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.436] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.436] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2660954 | out: lpFileInformation=0x2660954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90353002, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x316)) returned 1
	[0192.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.437] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.437] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.437] GetFileType (hFile=0x318) returned 0x1
	[0192.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.437] GetFileType (hFile=0x318) returned 0x1
	[0192.437] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x316
	[0192.437] ReadFile (in: hFile=0x318, lpBuffer=0x26610f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26610f8*, lpNumberOfBytesRead=0x57ff3fc*=0x316, lpOverlapped=0x0) returned 1
	[0192.438] CloseHandle (hObject=0x318) returned 1
	[0192.438] CryptDestroyKey (hKey=0x82b540) returned 1
	[0192.439] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.439] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2662194, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b480) returned 1
	[0192.439] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.439] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.439] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0192.439] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.439] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x266224c*=0x1, dwFlags=0x0) returned 1
	[0192.439] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2662218, dwFlags=0x0) returned 1
	[0192.439] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266225c*, pdwDataLen=0x57ff404*=0x320, dwBufLen=0x320 | out: pbData=0x266225c*, pdwDataLen=0x57ff404*=0x320) returned 1
	[0192.439] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2662588*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2662588*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.439] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.439] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.439] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.439] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.439] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.440] GetFileType (hFile=0x318) returned 0x1
	[0192.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.440] GetFileType (hFile=0x318) returned 0x1
	[0192.441] WriteFile (in: hFile=0x318, lpBuffer=0x26627d4*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26627d4*, lpNumberOfBytesWritten=0x57ff3c4*=0x320, lpOverlapped=0x0) returned 1
	[0192.441] CloseHandle (hObject=0x318) returned 1
	[0192.441] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.441] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0192.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.442] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad077da3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1
	[0192.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.442] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.464] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0192.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.464] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2663dd8 | out: lpFileInformation=0x2663dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90353002, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da)) returned 1
	[0192.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0192.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.465] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.465] GetFileType (hFile=0x318) returned 0x1
	[0192.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.465] GetFileType (hFile=0x318) returned 0x1
	[0192.465] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2da
	[0192.465] ReadFile (in: hFile=0x318, lpBuffer=0x2664570, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2664570*, lpNumberOfBytesRead=0x57ff3fc*=0x2da, lpOverlapped=0x0) returned 1
	[0192.466] CloseHandle (hObject=0x318) returned 1
	[0192.466] CryptDestroyKey (hKey=0x82b480) returned 1
	[0192.466] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.466] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266560c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b5c0) returned 1
	[0192.466] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.467] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.467] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b0c0) returned 1
	[0192.467] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.467] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26656c4*=0x1, dwFlags=0x0) returned 1
	[0192.467] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x2665690, dwFlags=0x0) returned 1
	[0192.467] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26656d4*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26656d4*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0192.467] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26659c0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26659c0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.467] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0192.467] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.467] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.467] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0192.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.467] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.468] GetFileType (hFile=0x318) returned 0x1
	[0192.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.468] GetFileType (hFile=0x318) returned 0x1
	[0192.468] WriteFile (in: hFile=0x318, lpBuffer=0x2665c24*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2665c24*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0192.469] CloseHandle (hObject=0x318) returned 1
	[0192.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0192.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcf
	[0192.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.469] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad0c436a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0192.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.470] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0192.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.471] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x266724c | out: lpFileInformation=0x266724c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90353002, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e2)) returned 1
	[0192.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0192.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.471] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.471] GetFileType (hFile=0x318) returned 0x1
	[0192.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.471] GetFileType (hFile=0x318) returned 0x1
	[0192.471] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1e2
	[0192.471] ReadFile (in: hFile=0x318, lpBuffer=0x266785c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x266785c*, lpNumberOfBytesRead=0x57ff3fc*=0x1e2, lpOverlapped=0x0) returned 1
	[0192.472] CloseHandle (hObject=0x318) returned 1
	[0192.472] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0192.472] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.472] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26688f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b400) returned 1
	[0192.472] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.472] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.473] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0192.473] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.473] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x26689b0*=0x1, dwFlags=0x0) returned 1
	[0192.473] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x266897c, dwFlags=0x0) returned 1
	[0192.473] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26689c0*, pdwDataLen=0x57ff404*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x26689c0*, pdwDataLen=0x57ff404*=0x1f0) returned 1
	[0192.473] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2668bbc*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2668bbc*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.473] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0192.473] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.473] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0192.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.473] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.474] GetFileType (hFile=0x318) returned 0x1
	[0192.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.474] GetFileType (hFile=0x318) returned 0x1
	[0192.474] WriteFile (in: hFile=0x318, lpBuffer=0x2668dd8*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2668dd8*, lpNumberOfBytesWritten=0x57ff3c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0192.475] CloseHandle (hObject=0x318) returned 1
	[0192.475] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0192.475] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbd
	[0192.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.476] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad0ea61d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0192.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.476] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.477] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0192.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.477] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x266a370 | out: lpFileInformation=0x266a370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9037926e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9037926e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9037926e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x291)) returned 1
	[0192.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.478] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0192.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.478] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.478] GetFileType (hFile=0x318) returned 0x1
	[0192.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.478] GetFileType (hFile=0x318) returned 0x1
	[0192.478] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x291
	[0192.478] ReadFile (in: hFile=0x318, lpBuffer=0x266aa90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x266aa90*, lpNumberOfBytesRead=0x57ff3fc*=0x291, lpOverlapped=0x0) returned 1
	[0192.479] CloseHandle (hObject=0x318) returned 1
	[0192.479] CryptDestroyKey (hKey=0x82b400) returned 1
	[0192.479] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.479] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266bb2c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0192.479] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.479] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.480] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b200) returned 1
	[0192.480] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.480] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x266bbe4*=0x1, dwFlags=0x0) returned 1
	[0192.480] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x266bbb0, dwFlags=0x0) returned 1
	[0192.480] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266bbf4*, pdwDataLen=0x57ff404*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x266bbf4*, pdwDataLen=0x57ff404*=0x2a0) returned 1
	[0192.480] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266bea0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x266bea0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.480] CryptDestroyKey (hKey=0x82b200) returned 1
	[0192.480] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.480] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.480] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0192.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.480] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.481] GetFileType (hFile=0x318) returned 0x1
	[0192.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.481] GetFileType (hFile=0x318) returned 0x1
	[0192.481] WriteFile (in: hFile=0x318, lpBuffer=0x266c0ec*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x266c0ec*, lpNumberOfBytesWritten=0x57ff3c4*=0x2a0, lpOverlapped=0x0) returned 1
	[0192.482] CloseHandle (hObject=0x318) returned 1
	[0192.482] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0192.482] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0192.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.482] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9037926e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9037926e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad0ea61d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0192.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.483] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.484] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0192.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.484] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x266d6e4 | out: lpFileInformation=0x266d6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9037926e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9037926e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9037926e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.484] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0192.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.484] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.484] GetFileType (hFile=0x318) returned 0x1
	[0192.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.484] GetFileType (hFile=0x318) returned 0x1
	[0192.484] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d0
	[0192.485] ReadFile (in: hFile=0x318, lpBuffer=0x266dea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x266dea0*, lpNumberOfBytesRead=0x57ff3fc*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.486] CloseHandle (hObject=0x318) returned 1
	[0192.486] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.486] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.486] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266ef3c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b540) returned 1
	[0192.487] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.487] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.487] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b340) returned 1
	[0192.487] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.487] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x266eff4*=0x1, dwFlags=0x0) returned 1
	[0192.487] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x266efc0, dwFlags=0x0) returned 1
	[0192.487] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x266f004*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x266f004*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0192.487] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266f2f0*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x266f2f0*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.487] CryptDestroyKey (hKey=0x82b340) returned 1
	[0192.487] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.487] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.487] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0192.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.487] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.489] GetFileType (hFile=0x318) returned 0x1
	[0192.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.489] GetFileType (hFile=0x318) returned 0x1
	[0192.489] WriteFile (in: hFile=0x318, lpBuffer=0x266f56c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x266f56c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0192.490] CloseHandle (hObject=0x318) returned 1
	[0192.490] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa6
	[0192.490] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd5
	[0192.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.490] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9037926e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9037926e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad110db5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0192.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.491] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.492] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0192.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.492] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2670bc4 | out: lpFileInformation=0x2670bc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9037926e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9037926e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9037926e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28c)) returned 1
	[0192.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.493] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0192.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.493] ReadFile (in: hFile=0x318, lpBuffer=0x267131c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x267131c*, lpNumberOfBytesRead=0x57ff3fc*=0x28c, lpOverlapped=0x0) returned 1
	[0192.495] CryptDestroyKey (hKey=0x82b540) returned 1
	[0192.495] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.495] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26723b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b200) returned 1
	[0192.495] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.495] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.495] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0192.495] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.495] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2672470*=0x1, dwFlags=0x0) returned 1
	[0192.495] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x267243c, dwFlags=0x0) returned 1
	[0192.495] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2672480*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x2672480*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0192.495] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267271c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x267271c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.495] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.495] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.495] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.495] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0192.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.495] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.497] GetFileType (hFile=0x318) returned 0x1
	[0192.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.497] GetFileType (hFile=0x318) returned 0x1
	[0192.497] WriteFile (in: hFile=0x318, lpBuffer=0x2672988*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2672988*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0192.498] CloseHandle (hObject=0x318) returned 1
	[0192.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0192.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd2
	[0192.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.499] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9037926e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9037926e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad110db5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0192.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.499] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0192.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.500] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2673fcc | out: lpFileInformation=0x2673fcc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9037926e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9037926e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9037926e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0192.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0192.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.501] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.501] GetFileType (hFile=0x318) returned 0x1
	[0192.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.501] GetFileType (hFile=0x318) returned 0x1
	[0192.501] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x290
	[0192.501] ReadFile (in: hFile=0x318, lpBuffer=0x26746e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26746e8*, lpNumberOfBytesRead=0x57ff3fc*=0x290, lpOverlapped=0x0) returned 1
	[0192.532] CloseHandle (hObject=0x318) returned 1
	[0192.532] CryptDestroyKey (hKey=0x82b200) returned 1
	[0192.532] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.532] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2675784, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0192.532] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.532] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.532] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b000) returned 1
	[0192.532] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.532] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x267583c*=0x1, dwFlags=0x0) returned 1
	[0192.533] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2675808, dwFlags=0x0) returned 1
	[0192.533] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267584c*, pdwDataLen=0x57ff404*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x267584c*, pdwDataLen=0x57ff404*=0x2a0) returned 1
	[0192.533] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2675af8*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2675af8*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.533] CryptDestroyKey (hKey=0x82b000) returned 1
	[0192.533] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.533] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.533] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0192.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.533] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.535] GetFileType (hFile=0x318) returned 0x1
	[0192.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.535] GetFileType (hFile=0x318) returned 0x1
	[0192.535] WriteFile (in: hFile=0x318, lpBuffer=0x2675d44*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2675d44*, lpNumberOfBytesWritten=0x57ff3c4*=0x2a0, lpOverlapped=0x0) returned 1
	[0192.537] CloseHandle (hObject=0x318) returned 1
	[0192.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0192.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0192.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.537] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9037926e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9037926e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad185849, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0192.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.537] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.540] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0192.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.540] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x267733c | out: lpFileInformation=0x267733c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9039f4d9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286)) returned 1
	[0192.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.542] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0192.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.542] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.542] GetFileType (hFile=0x318) returned 0x1
	[0192.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.543] GetFileType (hFile=0x318) returned 0x1
	[0192.543] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x286
	[0192.543] ReadFile (in: hFile=0x318, lpBuffer=0x2677a50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2677a50*, lpNumberOfBytesRead=0x57ff3fc*=0x286, lpOverlapped=0x0) returned 1
	[0192.545] CloseHandle (hObject=0x318) returned 1
	[0192.545] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0192.545] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.545] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2678aec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b440) returned 1
	[0192.545] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.545] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.545] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0192.545] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.545] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2678ba4*=0x1, dwFlags=0x0) returned 1
	[0192.545] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2678b70, dwFlags=0x0) returned 1
	[0192.546] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2678bb4*, pdwDataLen=0x57ff404*=0x290, dwBufLen=0x290 | out: pbData=0x2678bb4*, pdwDataLen=0x57ff404*=0x290) returned 1
	[0192.546] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2678e50*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2678e50*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.546] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.546] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.546] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.546] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0192.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.546] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.548] GetFileType (hFile=0x318) returned 0x1
	[0192.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.548] GetFileType (hFile=0x318) returned 0x1
	[0192.548] WriteFile (in: hFile=0x318, lpBuffer=0x267909c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x267909c*, lpNumberOfBytesWritten=0x57ff3c4*=0x290, lpOverlapped=0x0) returned 1
	[0192.550] CloseHandle (hObject=0x318) returned 1
	[0192.550] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0192.550] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0192.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.550] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad1a557d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0192.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.551] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.552] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0192.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.552] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x267a694 | out: lpFileInformation=0x267a694*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900f0949, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7)) returned 1
	[0192.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.553] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0192.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.553] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.553] GetFileType (hFile=0x318) returned 0x1
	[0192.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.553] GetFileType (hFile=0x318) returned 0x1
	[0192.553] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d7
	[0192.553] ReadFile (in: hFile=0x318, lpBuffer=0x267ae38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x267ae38*, lpNumberOfBytesRead=0x57ff3fc*=0x2d7, lpOverlapped=0x0) returned 1
	[0192.556] CloseHandle (hObject=0x318) returned 1
	[0192.556] CryptDestroyKey (hKey=0x82b440) returned 1
	[0192.556] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.556] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267bed4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82afc0) returned 1
	[0192.556] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.556] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.556] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b6c0) returned 1
	[0192.557] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.557] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x267bf8c*=0x1, dwFlags=0x0) returned 1
	[0192.557] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x267bf58, dwFlags=0x0) returned 1
	[0192.557] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267bf9c*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x267bf9c*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0192.557] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267c288*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x267c288*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.557] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.557] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.557] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.557] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0192.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.557] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.559] GetFileType (hFile=0x318) returned 0x1
	[0192.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.559] GetFileType (hFile=0x318) returned 0x1
	[0192.559] WriteFile (in: hFile=0x318, lpBuffer=0x267c4f4*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x267c4f4*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0192.560] CloseHandle (hObject=0x318) returned 1
	[0192.560] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0192.561] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd2
	[0192.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.561] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad1bf010, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0192.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.561] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.563] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0192.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.563] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x267db38 | out: lpFileInformation=0x267db38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9039f4d9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1)) returned 1
	[0192.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.563] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0192.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.564] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.564] GetFileType (hFile=0x318) returned 0x1
	[0192.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.564] GetFileType (hFile=0x318) returned 0x1
	[0192.564] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d1
	[0192.564] ReadFile (in: hFile=0x318, lpBuffer=0x267e2e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x267e2e8*, lpNumberOfBytesRead=0x57ff3fc*=0x2d1, lpOverlapped=0x0) returned 1
	[0192.566] CloseHandle (hObject=0x318) returned 1
	[0192.566] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0192.567] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.567] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267f384, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0192.567] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.567] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.567] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b440) returned 1
	[0192.567] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.567] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x267f43c*=0x1, dwFlags=0x0) returned 1
	[0192.567] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x267f408, dwFlags=0x0) returned 1
	[0192.567] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267f44c*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x267f44c*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0192.567] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267f738*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x267f738*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.568] CryptDestroyKey (hKey=0x82b440) returned 1
	[0192.568] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.568] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.568] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0192.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.568] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.570] GetFileType (hFile=0x318) returned 0x1
	[0192.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.571] GetFileType (hFile=0x318) returned 0x1
	[0192.571] WriteFile (in: hFile=0x318, lpBuffer=0x267f9ac*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x267f9ac*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0192.573] CloseHandle (hObject=0x318) returned 1
	[0192.585] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0192.585] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0192.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.585] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad1dd066, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0192.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.585] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.587] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.587] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2681000 | out: lpFileInformation=0x2681000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9039f4d9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2)) returned 1
	[0192.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.588] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.588] GetFileType (hFile=0x318) returned 0x1
	[0192.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.588] GetFileType (hFile=0x318) returned 0x1
	[0192.588] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c2
	[0192.588] ReadFile (in: hFile=0x318, lpBuffer=0x2681750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2681750*, lpNumberOfBytesRead=0x57ff3fc*=0x2c2, lpOverlapped=0x0) returned 1
	[0192.590] CloseHandle (hObject=0x318) returned 1
	[0192.590] CryptDestroyKey (hKey=0x82b100) returned 1
	[0192.590] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.590] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26827ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b040) returned 1
	[0192.590] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.590] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.590] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b000) returned 1
	[0192.590] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.590] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x26828a4*=0x1, dwFlags=0x0) returned 1
	[0192.590] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2682870, dwFlags=0x0) returned 1
	[0192.591] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26828b4*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26828b4*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.591] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2682b90*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2682b90*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.591] CryptDestroyKey (hKey=0x82b000) returned 1
	[0192.591] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.591] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.591] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.592] GetFileType (hFile=0x318) returned 0x1
	[0192.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.593] GetFileType (hFile=0x318) returned 0x1
	[0192.593] WriteFile (in: hFile=0x318, lpBuffer=0x2682ddc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2682ddc*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.594] CloseHandle (hObject=0x318) returned 1
	[0192.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0192.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0192.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.594] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad1f6c92, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.594] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0192.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.596] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26843e0 | out: lpFileInformation=0x26843e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9039f4d9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8)) returned 1
	[0192.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0192.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.596] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.597] GetFileType (hFile=0x318) returned 0x1
	[0192.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.597] GetFileType (hFile=0x318) returned 0x1
	[0192.597] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1d8
	[0192.597] ReadFile (in: hFile=0x318, lpBuffer=0x26849e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26849e4*, lpNumberOfBytesRead=0x57ff3fc*=0x1d8, lpOverlapped=0x0) returned 1
	[0192.598] CloseHandle (hObject=0x318) returned 1
	[0192.598] CryptDestroyKey (hKey=0x82b040) returned 1
	[0192.598] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.598] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2685a80, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b040) returned 1
	[0192.598] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.598] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.598] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b000) returned 1
	[0192.598] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.598] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2685b38*=0x1, dwFlags=0x0) returned 1
	[0192.598] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2685b04, dwFlags=0x0) returned 1
	[0192.599] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2685b48*, pdwDataLen=0x57ff404*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x2685b48*, pdwDataLen=0x57ff404*=0x1e0) returned 1
	[0192.599] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2685d34*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2685d34*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.599] CryptDestroyKey (hKey=0x82b000) returned 1
	[0192.599] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.599] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.599] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0192.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.599] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.601] GetFileType (hFile=0x318) returned 0x1
	[0192.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.601] GetFileType (hFile=0x318) returned 0x1
	[0192.601] WriteFile (in: hFile=0x318, lpBuffer=0x2685f50*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2685f50*, lpNumberOfBytesWritten=0x57ff3c4*=0x1e0, lpOverlapped=0x0) returned 1
	[0192.602] CloseHandle (hObject=0x318) returned 1
	[0192.602] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0192.602] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbd
	[0192.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.602] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad21d2a7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0192.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.603] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.605] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26874e8 | out: lpFileInformation=0x26874e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9039f4d9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0192.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.605] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.605] GetFileType (hFile=0x318) returned 0x1
	[0192.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.605] GetFileType (hFile=0x318) returned 0x1
	[0192.605] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cd
	[0192.606] ReadFile (in: hFile=0x318, lpBuffer=0x2687c64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2687c64*, lpNumberOfBytesRead=0x57ff3fc*=0x2cd, lpOverlapped=0x0) returned 1
	[0192.607] CloseHandle (hObject=0x318) returned 1
	[0192.607] CryptDestroyKey (hKey=0x82b040) returned 1
	[0192.607] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.607] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2688d00, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0192.607] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.607] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.608] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b5c0) returned 1
	[0192.608] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.608] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2688db8*=0x1, dwFlags=0x0) returned 1
	[0192.608] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2688d84, dwFlags=0x0) returned 1
	[0192.608] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2688dc8*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2688dc8*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.608] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26890a4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26890a4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.608] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0192.608] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.608] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.608] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.608] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.610] GetFileType (hFile=0x318) returned 0x1
	[0192.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.610] GetFileType (hFile=0x318) returned 0x1
	[0192.610] WriteFile (in: hFile=0x318, lpBuffer=0x2689300*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2689300*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.611] CloseHandle (hObject=0x318) returned 1
	[0192.611] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.611] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.611] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad21d2a7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.611] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.613] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x268a918 | out: lpFileInformation=0x268a918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903c5745, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903c5745, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x903c5745, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.613] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.613] GetFileType (hFile=0x318) returned 0x1
	[0192.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.613] GetFileType (hFile=0x318) returned 0x1
	[0192.613] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d0
	[0192.614] ReadFile (in: hFile=0x318, lpBuffer=0x268b0d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x268b0d4*, lpNumberOfBytesRead=0x57ff3fc*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.615] CloseHandle (hObject=0x318) returned 1
	[0192.616] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.616] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.616] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268c170, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0192.616] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.616] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.616] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b2c0) returned 1
	[0192.616] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.616] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x268c228*=0x1, dwFlags=0x0) returned 1
	[0192.616] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x268c1f4, dwFlags=0x0) returned 1
	[0192.616] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268c238*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x268c238*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0192.616] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268c524*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x268c524*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.616] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0192.616] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.616] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.616] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.617] WriteFile (in: hFile=0x318, lpBuffer=0x268c7a0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x268c7a0*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0192.619] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.622] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.622] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.622] GetFileType (hFile=0x318) returned 0x1
	[0192.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.622] GetFileType (hFile=0x318) returned 0x1
	[0192.622] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cf
	[0192.622] ReadFile (in: hFile=0x318, lpBuffer=0x268e5c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x268e5c0*, lpNumberOfBytesRead=0x57ff3fc*=0x2cf, lpOverlapped=0x0) returned 1
	[0192.646] CloseHandle (hObject=0x318) returned 1
	[0192.647] CryptDestroyKey (hKey=0x82b100) returned 1
	[0192.647] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.647] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268f65c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b100) returned 1
	[0192.647] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.647] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.647] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b1c0) returned 1
	[0192.647] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.647] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x268f714*=0x1, dwFlags=0x0) returned 1
	[0192.647] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x268f6e0, dwFlags=0x0) returned 1
	[0192.647] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x268f724*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x268f724*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.647] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268fa00*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x268fa00*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.647] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.647] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.647] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.647] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.647] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.649] GetFileType (hFile=0x318) returned 0x1
	[0192.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.649] GetFileType (hFile=0x318) returned 0x1
	[0192.649] WriteFile (in: hFile=0x318, lpBuffer=0x268fc7c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x268fc7c*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.650] CloseHandle (hObject=0x318) returned 1
	[0192.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0192.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.651] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903c5745, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903c5745, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad28f924, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.651] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.652] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0192.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.652] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26912e0 | out: lpFileInformation=0x26912e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903c5745, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903c5745, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x903c5745, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0192.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.653] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0192.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.653] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.653] GetFileType (hFile=0x318) returned 0x1
	[0192.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.653] GetFileType (hFile=0x318) returned 0x1
	[0192.653] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x1e0
	[0192.653] ReadFile (in: hFile=0x318, lpBuffer=0x26918ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26918ec*, lpNumberOfBytesRead=0x57ff3fc*=0x1e0, lpOverlapped=0x0) returned 1
	[0192.654] CloseHandle (hObject=0x318) returned 1
	[0192.654] CryptDestroyKey (hKey=0x82b100) returned 1
	[0192.654] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.655] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2692988, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b200) returned 1
	[0192.655] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.655] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.655] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82afc0) returned 1
	[0192.655] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.655] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2692a40*=0x1, dwFlags=0x0) returned 1
	[0192.655] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2692a0c, dwFlags=0x0) returned 1
	[0192.655] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2692a50*, pdwDataLen=0x57ff404*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x2692a50*, pdwDataLen=0x57ff404*=0x1f0) returned 1
	[0192.655] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2692c4c*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2692c4c*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.655] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0192.655] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.655] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.655] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0192.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.655] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.657] GetFileType (hFile=0x318) returned 0x1
	[0192.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.657] GetFileType (hFile=0x318) returned 0x1
	[0192.657] WriteFile (in: hFile=0x318, lpBuffer=0x2692e68*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2692e68*, lpNumberOfBytesWritten=0x57ff3c4*=0x1f0, lpOverlapped=0x0) returned 1
	[0192.658] CloseHandle (hObject=0x318) returned 1
	[0192.658] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8e
	[0192.658] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbd
	[0192.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.658] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903c5745, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903c5745, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad28f924, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0192.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.659] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.673] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.673] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2694400 | out: lpFileInformation=0x2694400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903c5745, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903c5745, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x903c5745, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0192.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.673] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.673] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.673] GetFileType (hFile=0x318) returned 0x1
	[0192.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.674] GetFileType (hFile=0x318) returned 0x1
	[0192.674] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2c8
	[0192.674] ReadFile (in: hFile=0x318, lpBuffer=0x2694b74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2694b74*, lpNumberOfBytesRead=0x57ff3fc*=0x2c8, lpOverlapped=0x0) returned 1
	[0192.681] CloseHandle (hObject=0x318) returned 1
	[0192.681] CryptDestroyKey (hKey=0x82b200) returned 1
	[0192.681] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.681] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2695c10, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b1c0) returned 1
	[0192.681] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.681] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.681] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b400) returned 1
	[0192.681] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.681] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2695cc8*=0x1, dwFlags=0x0) returned 1
	[0192.681] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2695c94, dwFlags=0x0) returned 1
	[0192.681] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2695cd8*, pdwDataLen=0x57ff404*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2695cd8*, pdwDataLen=0x57ff404*=0x2d0) returned 1
	[0192.681] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2695fb4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x2695fb4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.681] CryptDestroyKey (hKey=0x82b400) returned 1
	[0192.681] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.682] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.682] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.682] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.683] GetFileType (hFile=0x318) returned 0x1
	[0192.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.683] GetFileType (hFile=0x318) returned 0x1
	[0192.683] WriteFile (in: hFile=0x318, lpBuffer=0x2696210*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2696210*, lpNumberOfBytesWritten=0x57ff3c4*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.685] CloseHandle (hObject=0x318) returned 1
	[0192.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0192.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0192.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.685] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903c5745, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903c5745, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad2dbd14, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.685] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.687] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb3
	[0192.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.687] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2697828 | out: lpFileInformation=0x2697828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903eb9ac, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903eb9ac, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x903eb9ac, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee)) returned 1
	[0192.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.687] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb3
	[0192.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.688] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.688] GetFileType (hFile=0x318) returned 0x1
	[0192.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.688] GetFileType (hFile=0x318) returned 0x1
	[0192.688] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2ee
	[0192.688] ReadFile (in: hFile=0x318, lpBuffer=0x2698064, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x2698064*, lpNumberOfBytesRead=0x57ff3fc*=0x2ee, lpOverlapped=0x0) returned 1
	[0192.690] CloseHandle (hObject=0x318) returned 1
	[0192.690] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0192.690] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.690] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2699100, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b6c0) returned 1
	[0192.690] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.690] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.690] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b280) returned 1
	[0192.690] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.690] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26991b8*=0x1, dwFlags=0x0) returned 1
	[0192.690] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2699184, dwFlags=0x0) returned 1
	[0192.690] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26991c8*, pdwDataLen=0x57ff404*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x26991c8*, pdwDataLen=0x57ff404*=0x2f0) returned 1
	[0192.690] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26994c4*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x26994c4*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.690] CryptDestroyKey (hKey=0x82b280) returned 1
	[0192.691] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.691] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.691] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb3
	[0192.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.691] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.692] GetFileType (hFile=0x318) returned 0x1
	[0192.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.693] GetFileType (hFile=0x318) returned 0x1
	[0192.693] WriteFile (in: hFile=0x318, lpBuffer=0x2699770*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x2699770*, lpNumberOfBytesWritten=0x57ff3c4*=0x2f0, lpOverlapped=0x0) returned 1
	[0192.694] CloseHandle (hObject=0x318) returned 1
	[0192.694] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb3
	[0192.694] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe2
	[0192.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.694] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903eb9ac, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903eb9ac, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad301fde, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0192.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.694] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.696] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.696] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x269ae34 | out: lpFileInformation=0x269ae34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903eb9ac, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903eb9ac, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x903eb9ac, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0192.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.696] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.697] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.697] GetFileType (hFile=0x318) returned 0x1
	[0192.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.697] GetFileType (hFile=0x318) returned 0x1
	[0192.697] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2d0
	[0192.697] ReadFile (in: hFile=0x318, lpBuffer=0x269b5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x269b5f0*, lpNumberOfBytesRead=0x57ff3fc*=0x2d0, lpOverlapped=0x0) returned 1
	[0192.718] CloseHandle (hObject=0x318) returned 1
	[0192.718] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0192.718] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.718] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269c68c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b040) returned 1
	[0192.718] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.718] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.718] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x57ff398 | out: phKey=0x57ff398*=0x82b2c0) returned 1
	[0192.718] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0192.718] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x269c744*=0x1, dwFlags=0x0) returned 1
	[0192.718] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x269c710, dwFlags=0x0) returned 1
	[0192.719] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269c754*, pdwDataLen=0x57ff404*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x269c754*, pdwDataLen=0x57ff404*=0x2e0) returned 1
	[0192.719] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x269ca40*, pdwDataLen=0x57ff40c*=0x0, dwBufLen=0x10 | out: pbData=0x269ca40*, pdwDataLen=0x57ff40c*=0x10) returned 1
	[0192.719] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0192.719] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.719] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff340) returned 1
	[0192.719] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.721] GetFileType (hFile=0x318) returned 0x1
	[0192.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff33c) returned 1
	[0192.721] GetFileType (hFile=0x318) returned 0x1
	[0192.721] WriteFile (in: hFile=0x318, lpBuffer=0x269ccbc*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x57ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x269ccbc*, lpNumberOfBytesWritten=0x57ff3c4*=0x2e0, lpOverlapped=0x0) returned 1
	[0192.722] CloseHandle (hObject=0x318) returned 1
	[0192.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0192.723] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x57fef20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0192.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff3d4) returned 1
	[0192.723] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x57ff450 | out: lpFileInformation=0x57ff450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903eb9ac, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903eb9ac, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xad34a190, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0192.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff3d0) returned 1
	[0192.723] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0192.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fedf0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0192.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff2f0) returned 1
	[0192.725] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x269e320 | out: lpFileInformation=0x269e320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90116bb1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90116bb1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90116bb1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf)) returned 1
	[0192.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff2ec) returned 1
	[0192.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x57fee10, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa3
	[0192.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x57ff354) returned 1
	[0192.726] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0192.727] GetFileType (hFile=0x318) returned 0x1
	[0192.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x57ff350) returned 1
	[0192.727] GetFileType (hFile=0x318) returned 0x1
	[0192.727] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x57ff450 | out: lpFileSizeHigh=0x57ff450*=0x0) returned 0x2cf
	[0192.727] ReadFile (in: hFile=0x318, lpBuffer=0x269eabc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x57ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x269eabc*, lpNumberOfBytesRead=0x57ff3fc*=0x2cf, lpOverlapped=0x0) returned 1
	[0192.729] CloseHandle (hObject=0x318) returned 1
	[0192.729] CryptDestroyKey (hKey=0x82b040) returned 1
	[0192.729] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0192.729] CryptImportKey (in: hProv=0x7f93c0, pbData=0x269fb58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x57ff3a8 | out: phKey=0x57ff3a8*=0x82b5c0) returned 1
	[0192.729] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1

Thread:
	id = 25
	os_tid = 0xd40

	[0155.222] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0155.223] CoGetContextToken (in: pToken=0x99f564 | out: pToken=0x99f564) returned 0x0
	[0155.223] CObjectContext::QueryInterface () returned 0x0
	[0155.223] CObjectContext::GetCurrentThreadType () returned 0x0
	[0155.223] Release () returned 0x0
	[0155.223] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1
	[0155.223] CoUninitialize () 
	[0155.223] RoInitialize () returned 0x1
	[0155.223] RoUninitialize () returned 0x0
	[0155.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.261] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.358] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0155.652] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.089] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.230] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.699] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0156.988] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0157.081] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0160.867] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0160.972] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.207] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.331] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.474] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.519] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.644] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0161.957] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.003] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.207] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.304] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.348] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.381] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.455] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.487] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.519] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.597] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.641] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.644] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.669] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.674] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.676] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.707] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.708] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.709] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.715] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.716] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.717] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.717] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.718] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.722] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.725] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.732] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.739] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.853] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.855] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.865] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.881] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.882] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.883] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.891] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0162.905] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.904] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.945] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.949] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.950] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.961] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.962] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.964] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.965] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.967] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.968] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.971] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.972] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.974] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.975] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.976] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.977] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.982] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.983] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.985] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.986] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.988] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.988] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.991] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.992] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.994] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.994] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.996] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0167.998] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.000] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.001] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.002] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.003] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.006] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.006] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.008] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.009] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.011] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.011] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.013] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.014] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.017] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.019] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.020] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.023] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.024] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.026] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0168.410] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash", lpFilePart=0x0) returned 0x5e
	[0168.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0168.410] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.410] GetFileType (hFile=0x318) returned 0x1
	[0168.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0168.410] GetFileType (hFile=0x318) returned 0x1
	[0168.410] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x66
	[0168.411] ReadFile (in: hFile=0x318, lpBuffer=0x260e064, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x260e064*, lpNumberOfBytesRead=0x99f04c*=0x66, lpOverlapped=0x0) returned 1
	[0168.412] CloseHandle (hObject=0x318) returned 1
	[0168.412] CryptDestroyKey (hKey=0x82b040) returned 1
	[0168.412] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.412] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260f100, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b480) returned 1
	[0168.412] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.412] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.412] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b080) returned 1
	[0168.412] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.412] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x260f1b8*=0x1, dwFlags=0x0) returned 1
	[0168.412] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x260f184, dwFlags=0x0) returned 1
	[0168.412] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260f1c8*, pdwDataLen=0x99f054*=0x70, dwBufLen=0x70 | out: pbData=0x260f1c8*, pdwDataLen=0x99f054*=0x70) returned 1
	[0168.412] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260f244*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x260f244*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0168.412] CryptDestroyKey (hKey=0x82b080) returned 1
	[0168.412] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.412] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.412] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash", lpFilePart=0x0) returned 0x5e
	[0168.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0168.413] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.414] GetFileType (hFile=0x318) returned 0x1
	[0168.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0168.414] GetFileType (hFile=0x318) returned 0x1
	[0168.414] WriteFile (in: hFile=0x318, lpBuffer=0x260f3b0*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x260f3b0*, lpNumberOfBytesWritten=0x99f014*=0x70, lpOverlapped=0x0) returned 1
	[0168.415] CloseHandle (hObject=0x318) returned 1
	[0168.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash", lpFilePart=0x0) returned 0x5e
	[0168.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8d
	[0168.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0168.415] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9eb5f01a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
	[0168.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0168.415] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0168.416] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a
	[0168.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0168.416] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x26107c8 | out: lpFileInformation=0x26107c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4)) returned 1
	[0168.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0168.416] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a
	[0168.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0168.416] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.417] GetFileType (hFile=0x318) returned 0x1
	[0168.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0168.417] GetFileType (hFile=0x318) returned 0x1
	[0168.417] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xd77c4
	[0168.419] ReadFile (in: hFile=0x318, lpBuffer=0x34494c8, nNumberOfBytesToRead=0xd77c4, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesRead=0x99f04c*=0xd77c4, lpOverlapped=0x0) returned 1
	[0168.478] CloseHandle (hObject=0x318) returned 1
	[0168.478] CryptDestroyKey (hKey=0x82b480) returned 1
	[0168.478] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.478] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2610b78, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b100) returned 1
	[0168.478] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.478] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.478] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0168.478] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.478] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2610c30*=0x1, dwFlags=0x0) returned 1
	[0168.478] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2610bfc, dwFlags=0x0) returned 1
	[0168.481] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3520ca8*, pdwDataLen=0x99f054*=0xd77d0, dwBufLen=0xd77d0 | out: pbData=0x3520ca8*, pdwDataLen=0x99f054*=0xd77d0) returned 1
	[0168.481] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2610c40*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2610c40*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0168.482] CryptDestroyKey (hKey=0x82b540) returned 1
	[0168.482] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.482] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.482] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a
	[0168.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0168.482] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.489] GetFileType (hFile=0x318) returned 0x1
	[0168.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0168.489] GetFileType (hFile=0x318) returned 0x1
	[0168.489] WriteFile (in: hFile=0x318, lpBuffer=0x3520ca8*, nNumberOfBytesToWrite=0xd77d0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x3520ca8*, lpNumberOfBytesWritten=0x99f040*=0xd77d0, lpOverlapped=0x0) returned 1
	[0168.549] CloseHandle (hObject=0x318) returned 1
	[0168.549] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a
	[0168.549] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x99
	[0168.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0168.549] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9ecb59ed, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xd77d0)) returned 1
	[0168.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0168.550] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0168.550] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x6e
	[0168.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0168.550] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2611248 | out: lpFileInformation=0x2611248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd54fbe00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5211)) returned 1
	[0168.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0168.551] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x6e
	[0168.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0168.551] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.551] GetFileType (hFile=0x318) returned 0x1
	[0168.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0168.551] GetFileType (hFile=0x318) returned 0x1
	[0168.551] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x5211
	[0168.551] ReadFile (in: hFile=0x318, lpBuffer=0x261232c, nNumberOfBytesToRead=0x5211, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x261232c*, lpNumberOfBytesRead=0x99f04c*=0x5211, lpOverlapped=0x0) returned 1
	[0168.570] CloseHandle (hObject=0x318) returned 1
	[0168.570] CryptDestroyKey (hKey=0x82b100) returned 1
	[0168.570] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.570] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26175dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0168.570] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.570] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.570] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b400) returned 1
	[0168.570] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.570] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2617694*=0x1, dwFlags=0x0) returned 1
	[0168.570] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2617660, dwFlags=0x0) returned 1
	[0168.570] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26176a4*, pdwDataLen=0x99f054*=0x5220, dwBufLen=0x5220 | out: pbData=0x26176a4*, pdwDataLen=0x99f054*=0x5220) returned 1
	[0168.570] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261c8d0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x261c8d0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0168.570] CryptDestroyKey (hKey=0x82b400) returned 1
	[0168.570] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.571] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.571] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x6e
	[0168.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0168.571] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.572] GetFileType (hFile=0x318) returned 0x1
	[0168.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0168.572] GetFileType (hFile=0x318) returned 0x1
	[0168.572] WriteFile (in: hFile=0x318, lpBuffer=0x26176a4*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x26176a4*, lpNumberOfBytesWritten=0x99f040*=0x5220, lpOverlapped=0x0) returned 1
	[0168.573] CloseHandle (hObject=0x318) returned 1
	[0168.573] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x6e
	[0168.573] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9d
	[0168.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0168.573] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9ecdbbef, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x5220)) returned 1
	[0168.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0168.574] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0168.574] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash", lpFilePart=0x0) returned 0x5c
	[0168.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0168.574] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash"), fInfoLevelId=0x0, lpFileInformation=0x261cf04 | out: lpFileInformation=0x261cf04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66)) returned 1
	[0168.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0168.575] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash", lpFilePart=0x0) returned 0x5c
	[0168.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0168.575] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.575] GetFileType (hFile=0x318) returned 0x1
	[0168.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0168.575] GetFileType (hFile=0x318) returned 0x1
	[0168.575] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x66
	[0168.575] ReadFile (in: hFile=0x318, lpBuffer=0x261d220, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x261d220*, lpNumberOfBytesRead=0x99f04c*=0x66, lpOverlapped=0x0) returned 1
	[0168.576] CloseHandle (hObject=0x318) returned 1
	[0168.576] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0168.576] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.576] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261e2bc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0168.576] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.576] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.576] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0168.576] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.577] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x261e374*=0x1, dwFlags=0x0) returned 1
	[0168.577] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x261e340, dwFlags=0x0) returned 1
	[0168.577] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261e384*, pdwDataLen=0x99f054*=0x70, dwBufLen=0x70 | out: pbData=0x261e384*, pdwDataLen=0x99f054*=0x70) returned 1
	[0168.577] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261e400*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x261e400*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0168.577] CryptDestroyKey (hKey=0x82b280) returned 1
	[0168.577] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.577] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.577] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash", lpFilePart=0x0) returned 0x5c
	[0168.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0168.577] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.578] GetFileType (hFile=0x318) returned 0x1
	[0168.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0168.578] GetFileType (hFile=0x318) returned 0x1
	[0168.578] WriteFile (in: hFile=0x318, lpBuffer=0x261e560*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x261e560*, lpNumberOfBytesWritten=0x99f014*=0x70, lpOverlapped=0x0) returned 1
	[0168.579] CloseHandle (hObject=0x318) returned 1
	[0168.579] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash", lpFilePart=0x0) returned 0x5c
	[0168.579] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8b
	[0168.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0168.579] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9ed01f13, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
	[0168.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0168.579] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0168.580] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c
	[0168.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0168.580] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x261f968 | out: lpFileInformation=0x261f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a)) returned 1
	[0168.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0168.581] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c
	[0168.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0168.581] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.581] GetFileType (hFile=0x318) returned 0x1
	[0168.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0168.581] GetFileType (hFile=0x318) returned 0x1
	[0168.581] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x38480a
	[0168.590] ReadFile (in: hFile=0x318, lpBuffer=0x3d014f0, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x3d014f0*, lpNumberOfBytesRead=0x99f04c*=0x38480a, lpOverlapped=0x0) returned 1
	[0168.772] CloseHandle (hObject=0x318) returned 1
	[0168.772] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0168.772] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.772] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261fd20, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b200) returned 1
	[0168.772] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.772] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.772] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0168.772] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0168.772] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x261fdd8*=0x1, dwFlags=0x0) returned 1
	[0168.773] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x261fda4, dwFlags=0x0) returned 1
	[0168.872] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34494c8*, pdwDataLen=0x99f054*=0x384810, dwBufLen=0x384810 | out: pbData=0x34494c8*, pdwDataLen=0x99f054*=0x384810) returned 1
	[0168.875] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2600f5c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2600f5c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0168.875] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0168.875] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.875] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0168.875] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c
	[0168.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0168.876] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.882] GetFileType (hFile=0x318) returned 0x1
	[0168.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0168.882] GetFileType (hFile=0x318) returned 0x1
	[0168.882] WriteFile (in: hFile=0x318, lpBuffer=0x34494c8*, nNumberOfBytesToWrite=0x384810, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesWritten=0x99f040*=0x384810, lpOverlapped=0x0) returned 1
	[0168.972] CloseHandle (hObject=0x318) returned 1
	[0168.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c
	[0168.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x9b
	[0168.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0168.972] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9f09573a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x384810)) returned 1
	[0168.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0168.972] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0168.974] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFilePart=0x0) returned 0x75
	[0168.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0168.974] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), fInfoLevelId=0x0, lpFileInformation=0x260259c | out: lpFileInformation=0x260259c*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1)) returned 1
	[0168.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0168.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFilePart=0x0) returned 0x75
	[0168.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0168.975] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0168.975] GetFileType (hFile=0x318) returned 0x1
	[0168.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0168.975] GetFileType (hFile=0x318) returned 0x1
	[0168.975] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x8b1
	[0168.979] ReadFile (in: hFile=0x318, lpBuffer=0x2602a50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2602a50*, lpNumberOfBytesRead=0x99f04c*=0x8b1, lpOverlapped=0x0) returned 1
	[0168.999] CloseHandle (hObject=0x318) returned 1
	[0168.999] CryptDestroyKey (hKey=0x82b200) returned 1
	[0168.999] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.000] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2603aec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b480) returned 1
	[0169.000] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.000] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.000] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b0c0) returned 1
	[0169.000] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.000] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x2603ba4*=0x1, dwFlags=0x0) returned 1
	[0169.000] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x2603b70, dwFlags=0x0) returned 1
	[0169.000] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2603bb4*, pdwDataLen=0x99f054*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x2603bb4*, pdwDataLen=0x99f054*=0x8c0) returned 1
	[0169.000] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2604480*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2604480*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.000] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0169.000] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.000] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFilePart=0x0) returned 0x75
	[0169.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.000] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.003] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFilePart=0x0) returned 0x72
	[0169.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.003] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), fInfoLevelId=0x0, lpFileInformation=0x2604f00 | out: lpFileInformation=0x2604f00*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38)) returned 1
	[0169.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.003] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFilePart=0x0) returned 0x72
	[0169.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.003] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.003] GetFileType (hFile=0x318) returned 0x1
	[0169.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.003] GetFileType (hFile=0x318) returned 0x1
	[0169.004] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x38
	[0169.004] ReadFile (in: hFile=0x318, lpBuffer=0x2605334, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2605334*, lpNumberOfBytesRead=0x99f04c*=0x38, lpOverlapped=0x0) returned 1
	[0169.005] CloseHandle (hObject=0x318) returned 1
	[0169.005] CryptDestroyKey (hKey=0x82b480) returned 1
	[0169.005] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.005] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26063d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b340) returned 1
	[0169.005] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.005] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.005] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b480) returned 1
	[0169.005] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.005] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2606488*=0x1, dwFlags=0x0) returned 1
	[0169.005] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2606454, dwFlags=0x0) returned 1
	[0169.005] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2606498*, pdwDataLen=0x99f054*=0x40, dwBufLen=0x40 | out: pbData=0x2606498*, pdwDataLen=0x99f054*=0x40) returned 1
	[0169.006] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26064e4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26064e4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.006] CryptDestroyKey (hKey=0x82b480) returned 1
	[0169.006] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.006] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.006] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFilePart=0x0) returned 0x72
	[0169.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.006] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.008] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x62
	[0169.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.008] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), fInfoLevelId=0x0, lpFileInformation=0x2606ee0 | out: lpFileInformation=0x2606ee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1)) returned 1
	[0169.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x62
	[0169.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.023] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.023] GetFileType (hFile=0x318) returned 0x1
	[0169.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.023] GetFileType (hFile=0x318) returned 0x1
	[0169.023] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1fad1
	[0169.024] ReadFile (in: hFile=0x318, lpBuffer=0x37cdcf8, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x37cdcf8*, lpNumberOfBytesRead=0x99f04c*=0x1fad1, lpOverlapped=0x0) returned 1
	[0169.113] CloseHandle (hObject=0x318) returned 1
	[0169.113] CryptDestroyKey (hKey=0x82b340) returned 1
	[0169.113] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.114] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2607248, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0169.114] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.114] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.114] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0169.114] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.114] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2607300*=0x1, dwFlags=0x0) returned 1
	[0169.114] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26072cc, dwFlags=0x0) returned 1
	[0169.114] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x37ed7e8*, pdwDataLen=0x99f054*=0x1fae0, dwBufLen=0x1fae0 | out: pbData=0x37ed7e8*, pdwDataLen=0x99f054*=0x1fae0) returned 1
	[0169.115] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2607310*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2607310*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.115] CryptDestroyKey (hKey=0x82b280) returned 1
	[0169.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.115] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.115] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x62
	[0169.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.115] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.117] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFilePart=0x0) returned 0x60
	[0169.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.117] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), fInfoLevelId=0x0, lpFileInformation=0x26079f0 | out: lpFileInformation=0x26079f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61)) returned 1
	[0169.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFilePart=0x0) returned 0x60
	[0169.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.118] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.118] GetFileType (hFile=0x318) returned 0x1
	[0169.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.118] GetFileType (hFile=0x318) returned 0x1
	[0169.119] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xb61
	[0169.119] ReadFile (in: hFile=0x318, lpBuffer=0x2608828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2608828*, lpNumberOfBytesRead=0x99f04c*=0xb61, lpOverlapped=0x0) returned 1
	[0169.146] CloseHandle (hObject=0x318) returned 1
	[0169.146] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0169.146] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.146] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26098c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b0c0) returned 1
	[0169.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.146] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0169.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.146] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x260997c*=0x1, dwFlags=0x0) returned 1
	[0169.146] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2609948, dwFlags=0x0) returned 1
	[0169.146] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260998c*, pdwDataLen=0x99f054*=0xb70, dwBufLen=0xb70 | out: pbData=0x260998c*, pdwDataLen=0x99f054*=0xb70) returned 1
	[0169.146] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260a508*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x260a508*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.146] CryptDestroyKey (hKey=0x82b300) returned 1
	[0169.146] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.147] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.147] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFilePart=0x0) returned 0x60
	[0169.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.147] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.149] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x5e
	[0169.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.149] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), fInfoLevelId=0x0, lpFileInformation=0x260abd4 | out: lpFileInformation=0x260abd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8)) returned 1
	[0169.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x5e
	[0169.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.178] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.178] GetFileType (hFile=0x318) returned 0x1
	[0169.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.178] GetFileType (hFile=0x318) returned 0x1
	[0169.178] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xadc8
	[0169.178] ReadFile (in: hFile=0x318, lpBuffer=0x260ae8c, nNumberOfBytesToRead=0xadc8, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x260ae8c*, lpNumberOfBytesRead=0x99f04c*=0xadc8, lpOverlapped=0x0) returned 1
	[0169.201] CloseHandle (hObject=0x318) returned 1
	[0169.201] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0169.201] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.201] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2615cf0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0169.201] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.201] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.201] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0169.201] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.201] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2615da8*=0x1, dwFlags=0x0) returned 1
	[0169.202] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2615d74, dwFlags=0x0) returned 1
	[0169.202] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2615db8*, pdwDataLen=0x99f054*=0xadd0, dwBufLen=0xadd0 | out: pbData=0x2615db8*, pdwDataLen=0x99f054*=0xadd0) returned 1
	[0169.202] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2620b94*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2620b94*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.202] CryptDestroyKey (hKey=0x82b300) returned 1
	[0169.202] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.202] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.202] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x5e
	[0169.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.202] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.204] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x5f
	[0169.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.204] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), fInfoLevelId=0x0, lpFileInformation=0x262124c | out: lpFileInformation=0x262124c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1)) returned 1
	[0169.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.226] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x5f
	[0169.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.226] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.226] GetFileType (hFile=0x318) returned 0x1
	[0169.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.226] GetFileType (hFile=0x318) returned 0x1
	[0169.226] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x70c1
	[0169.227] ReadFile (in: hFile=0x318, lpBuffer=0x2621504, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2621504*, lpNumberOfBytesRead=0x99f04c*=0x70c1, lpOverlapped=0x0) returned 1
	[0169.241] CloseHandle (hObject=0x318) returned 1
	[0169.241] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0169.241] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.241] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2628664, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b380) returned 1
	[0169.242] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.242] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.242] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b340) returned 1
	[0169.242] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.242] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x262871c*=0x1, dwFlags=0x0) returned 1
	[0169.242] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26286e8, dwFlags=0x0) returned 1
	[0169.242] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262872c*, pdwDataLen=0x99f054*=0x70d0, dwBufLen=0x70d0 | out: pbData=0x262872c*, pdwDataLen=0x99f054*=0x70d0) returned 1
	[0169.242] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262f808*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x262f808*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.242] CryptDestroyKey (hKey=0x82b340) returned 1
	[0169.242] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.242] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.242] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x5f
	[0169.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.242] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.244] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x60
	[0169.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.244] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), fInfoLevelId=0x0, lpFileInformation=0x262fec4 | out: lpFileInformation=0x262fec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3)) returned 1
	[0169.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.263] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x60
	[0169.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.263] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.263] GetFileType (hFile=0x318) returned 0x1
	[0169.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.263] GetFileType (hFile=0x318) returned 0x1
	[0169.264] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x99d3
	[0169.264] ReadFile (in: hFile=0x318, lpBuffer=0x263018c, nNumberOfBytesToRead=0x99d3, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x263018c*, lpNumberOfBytesRead=0x99f04c*=0x99d3, lpOverlapped=0x0) returned 1
	[0169.274] CloseHandle (hObject=0x318) returned 1
	[0169.274] CryptDestroyKey (hKey=0x82b380) returned 1
	[0169.274] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.274] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2639bfc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0169.274] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.274] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.274] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b200) returned 1
	[0169.274] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.275] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2639cb4*=0x1, dwFlags=0x0) returned 1
	[0169.275] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x2639c80, dwFlags=0x0) returned 1
	[0169.275] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2639cc4*, pdwDataLen=0x99f054*=0x99e0, dwBufLen=0x99e0 | out: pbData=0x2639cc4*, pdwDataLen=0x99f054*=0x99e0) returned 1
	[0169.275] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26436b0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26436b0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.275] CryptDestroyKey (hKey=0x82b200) returned 1
	[0169.275] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.275] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.275] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x60
	[0169.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.275] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.277] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x62
	[0169.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.277] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), fInfoLevelId=0x0, lpFileInformation=0x2643d7c | out: lpFileInformation=0x2643d7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1)) returned 1
	[0169.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.285] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x62
	[0169.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.285] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.285] GetFileType (hFile=0x318) returned 0x1
	[0169.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.285] GetFileType (hFile=0x318) returned 0x1
	[0169.286] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1fad1
	[0169.286] ReadFile (in: hFile=0x318, lpBuffer=0x380d2e8, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x380d2e8*, lpNumberOfBytesRead=0x99f04c*=0x1fad1, lpOverlapped=0x0) returned 1
	[0169.321] CloseHandle (hObject=0x318) returned 1
	[0169.321] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0169.321] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.321] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26440e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b5c0) returned 1
	[0169.321] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.322] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.322] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0169.322] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.322] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x264419c*=0x1, dwFlags=0x0) returned 1
	[0169.322] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2644168, dwFlags=0x0) returned 1
	[0169.322] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x382cdd8*, pdwDataLen=0x99f054*=0x1fae0, dwBufLen=0x1fae0 | out: pbData=0x382cdd8*, pdwDataLen=0x99f054*=0x1fae0) returned 1
	[0169.322] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26441ac*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26441ac*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.323] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0169.323] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.323] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.323] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x62
	[0169.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.323] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.325] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFilePart=0x0) returned 0x60
	[0169.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.325] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), fInfoLevelId=0x0, lpFileInformation=0x264488c | out: lpFileInformation=0x264488c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf)) returned 1
	[0169.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFilePart=0x0) returned 0x60
	[0169.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.326] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.326] GetFileType (hFile=0x318) returned 0x1
	[0169.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.326] GetFileType (hFile=0x318) returned 0x1
	[0169.326] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x6cf
	[0169.326] ReadFile (in: hFile=0x318, lpBuffer=0x2645230, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2645230*, lpNumberOfBytesRead=0x99f04c*=0x6cf, lpOverlapped=0x0) returned 1
	[0169.328] CloseHandle (hObject=0x318) returned 1
	[0169.328] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0169.328] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.328] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26462cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0169.328] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.329] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.329] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b5c0) returned 1
	[0169.329] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.329] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2646384*=0x1, dwFlags=0x0) returned 1
	[0169.329] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2646350, dwFlags=0x0) returned 1
	[0169.329] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2646394*, pdwDataLen=0x99f054*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x2646394*, pdwDataLen=0x99f054*=0x6d0) returned 1
	[0169.329] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2646a70*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2646a70*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.329] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0169.329] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.329] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.329] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFilePart=0x0) returned 0x60
	[0169.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.329] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.331] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x61
	[0169.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.331] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), fInfoLevelId=0x0, lpFileInformation=0x264713c | out: lpFileInformation=0x264713c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1)) returned 1
	[0169.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.332] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x61
	[0169.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.332] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.332] GetFileType (hFile=0x318) returned 0x1
	[0169.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.332] GetFileType (hFile=0x318) returned 0x1
	[0169.332] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x70c1
	[0169.332] ReadFile (in: hFile=0x318, lpBuffer=0x2647404, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2647404*, lpNumberOfBytesRead=0x99f04c*=0x70c1, lpOverlapped=0x0) returned 1
	[0169.343] CloseHandle (hObject=0x318) returned 1
	[0169.343] CryptDestroyKey (hKey=0x82b540) returned 1
	[0169.343] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.343] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264e564, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0169.343] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.343] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.344] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0169.344] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.344] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x264e61c*=0x1, dwFlags=0x0) returned 1
	[0169.344] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x264e5e8, dwFlags=0x0) returned 1
	[0169.344] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264e62c*, pdwDataLen=0x99f054*=0x70d0, dwBufLen=0x70d0 | out: pbData=0x264e62c*, pdwDataLen=0x99f054*=0x70d0) returned 1
	[0169.344] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2655708*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2655708*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.344] CryptDestroyKey (hKey=0x82b280) returned 1
	[0169.344] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.344] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.344] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x61
	[0169.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.344] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.346] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFilePart=0x0) returned 0x5c
	[0169.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.346] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), fInfoLevelId=0x0, lpFileInformation=0x2655dd8 | out: lpFileInformation=0x2655dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3)) returned 1
	[0169.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.357] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFilePart=0x0) returned 0x5c
	[0169.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.357] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.357] GetFileType (hFile=0x318) returned 0x1
	[0169.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.358] GetFileType (hFile=0x318) returned 0x1
	[0169.358] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xd0a3
	[0169.358] ReadFile (in: hFile=0x318, lpBuffer=0x2656088, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2656088*, lpNumberOfBytesRead=0x99f04c*=0xd0a3, lpOverlapped=0x0) returned 1
	[0169.367] CloseHandle (hObject=0x318) returned 1
	[0169.367] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0169.367] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.367] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26631c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0169.367] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.367] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.367] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b5c0) returned 1
	[0169.367] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.367] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2663280*=0x1, dwFlags=0x0) returned 1
	[0169.367] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x266324c, dwFlags=0x0) returned 1
	[0169.368] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2663290*, pdwDataLen=0x99f054*=0xd0b0, dwBufLen=0xd0b0 | out: pbData=0x2663290*, pdwDataLen=0x99f054*=0xd0b0) returned 1
	[0169.368] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267034c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x267034c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.368] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0169.368] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.368] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.368] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFilePart=0x0) returned 0x5c
	[0169.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.368] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.370] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", lpFilePart=0x0) returned 0x5c
	[0169.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.370] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), fInfoLevelId=0x0, lpFileInformation=0x26709f4 | out: lpFileInformation=0x26709f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee)) returned 1
	[0169.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.372] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", lpFilePart=0x0) returned 0x5c
	[0169.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.460] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.490] GetFileType (hFile=0x318) returned 0x1
	[0169.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.491] GetFileType (hFile=0x318) returned 0x1
	[0169.491] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x72ee
	[0169.491] ReadFile (in: hFile=0x318, lpBuffer=0x2670ca4, nNumberOfBytesToRead=0x72ee, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2670ca4*, lpNumberOfBytesRead=0x99f04c*=0x72ee, lpOverlapped=0x0) returned 1
	[0169.503] CloseHandle (hObject=0x318) returned 1
	[0169.503] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0169.503] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.503] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2678030, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0169.503] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.503] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.503] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0169.503] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.503] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26780e8*=0x1, dwFlags=0x0) returned 1
	[0169.503] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26780b4, dwFlags=0x0) returned 1
	[0169.504] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26780f8*, pdwDataLen=0x99f054*=0x72f0, dwBufLen=0x72f0 | out: pbData=0x26780f8*, pdwDataLen=0x99f054*=0x72f0) returned 1
	[0169.504] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267f3f4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x267f3f4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.504] CryptDestroyKey (hKey=0x82b540) returned 1
	[0169.504] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.504] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", lpFilePart=0x0) returned 0x5c
	[0169.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.504] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.506] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", lpFilePart=0x0) returned 0x5e
	[0169.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.506] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), fInfoLevelId=0x0, lpFileInformation=0x267fa9c | out: lpFileInformation=0x267fa9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668)) returned 1
	[0169.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.506] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", lpFilePart=0x0) returned 0x5e
	[0169.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.507] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.507] GetFileType (hFile=0x318) returned 0x1
	[0169.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.507] GetFileType (hFile=0x318) returned 0x1
	[0169.507] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x14668
	[0169.507] ReadFile (in: hFile=0x318, lpBuffer=0x267fd5c, nNumberOfBytesToRead=0x14668, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x267fd5c*, lpNumberOfBytesRead=0x99f04c*=0x14668, lpOverlapped=0x0) returned 1
	[0169.533] CloseHandle (hObject=0x318) returned 1
	[0169.533] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0169.533] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.533] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2694460, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b400) returned 1
	[0169.533] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.533] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.533] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0169.533] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.533] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2694518*=0x1, dwFlags=0x0) returned 1
	[0169.533] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26944e4, dwFlags=0x0) returned 1
	[0169.533] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2694528*, pdwDataLen=0x99f054*=0x14670, dwBufLen=0x14670 | out: pbData=0x2694528*, pdwDataLen=0x99f054*=0x14670) returned 1
	[0169.534] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a8ba4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26a8ba4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.534] CryptDestroyKey (hKey=0x82b300) returned 1
	[0169.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.534] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", lpFilePart=0x0) returned 0x5e
	[0169.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.534] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.536] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x5e
	[0169.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.536] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), fInfoLevelId=0x0, lpFileInformation=0x26a9260 | out: lpFileInformation=0x26a9260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536)) returned 1
	[0169.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x5e
	[0169.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.537] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.537] GetFileType (hFile=0x318) returned 0x1
	[0169.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.537] GetFileType (hFile=0x318) returned 0x1
	[0169.537] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x536
	[0169.537] ReadFile (in: hFile=0x318, lpBuffer=0x26a9a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26a9a64*, lpNumberOfBytesRead=0x99f04c*=0x536, lpOverlapped=0x0) returned 1
	[0169.539] CloseHandle (hObject=0x318) returned 1
	[0169.539] CryptDestroyKey (hKey=0x82b400) returned 1
	[0169.539] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.539] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26aab00, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0169.539] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.539] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.539] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0169.539] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.540] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26aabb8*=0x1, dwFlags=0x0) returned 1
	[0169.540] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26aab84, dwFlags=0x0) returned 1
	[0169.540] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26aabc8*, pdwDataLen=0x99f054*=0x540, dwBufLen=0x540 | out: pbData=0x26aabc8*, pdwDataLen=0x99f054*=0x540) returned 1
	[0169.540] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ab114*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26ab114*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.540] CryptDestroyKey (hKey=0x82b280) returned 1
	[0169.540] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.540] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.540] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x5e
	[0169.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.540] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.542] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", lpFilePart=0x0) returned 0x5f
	[0169.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.542] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), fInfoLevelId=0x0, lpFileInformation=0x26ab7d0 | out: lpFileInformation=0x26ab7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9)) returned 1
	[0169.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.543] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", lpFilePart=0x0) returned 0x5f
	[0169.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.543] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.543] GetFileType (hFile=0x318) returned 0x1
	[0169.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.543] GetFileType (hFile=0x318) returned 0x1
	[0169.543] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xcaa9
	[0169.543] ReadFile (in: hFile=0x318, lpBuffer=0x26aba90, nNumberOfBytesToRead=0xcaa9, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26aba90*, lpNumberOfBytesRead=0x99f04c*=0xcaa9, lpOverlapped=0x0) returned 1
	[0169.556] CloseHandle (hObject=0x318) returned 1
	[0169.556] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0169.556] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.557] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b85d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0169.557] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.557] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.557] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b040) returned 1
	[0169.557] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.557] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x26b8690*=0x1, dwFlags=0x0) returned 1
	[0169.557] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x26b865c, dwFlags=0x0) returned 1
	[0169.557] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b86a0*, pdwDataLen=0x99f054*=0xcab0, dwBufLen=0xcab0 | out: pbData=0x26b86a0*, pdwDataLen=0x99f054*=0xcab0) returned 1
	[0169.557] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c515c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26c515c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.557] CryptDestroyKey (hKey=0x82b040) returned 1
	[0169.557] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.557] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.557] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", lpFilePart=0x0) returned 0x5f
	[0169.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.558] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.559] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", lpFilePart=0x0) returned 0x5e
	[0169.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.560] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), fInfoLevelId=0x0, lpFileInformation=0x26c581c | out: lpFileInformation=0x26c581c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850)) returned 1
	[0169.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.561] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", lpFilePart=0x0) returned 0x5e
	[0169.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.561] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.561] GetFileType (hFile=0x318) returned 0x1
	[0169.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.561] GetFileType (hFile=0x318) returned 0x1
	[0169.561] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x10850
	[0169.562] ReadFile (in: hFile=0x318, lpBuffer=0x26c5adc, nNumberOfBytesToRead=0x10850, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26c5adc*, lpNumberOfBytesRead=0x99f04c*=0x10850, lpOverlapped=0x0) returned 1
	[0169.582] CloseHandle (hObject=0x318) returned 1
	[0169.582] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0169.582] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.582] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d63c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b100) returned 1
	[0169.582] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.582] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.583] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0169.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.583] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26d6480*=0x1, dwFlags=0x0) returned 1
	[0169.583] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26d644c, dwFlags=0x0) returned 1
	[0169.583] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d6490*, pdwDataLen=0x99f054*=0x10860, dwBufLen=0x10860 | out: pbData=0x26d6490*, pdwDataLen=0x99f054*=0x10860) returned 1
	[0169.583] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e6cfc*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26e6cfc*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.583] CryptDestroyKey (hKey=0x82b280) returned 1
	[0169.583] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.583] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.583] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", lpFilePart=0x0) returned 0x5e
	[0169.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.583] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.585] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", lpFilePart=0x0) returned 0x5a
	[0169.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.585] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), fInfoLevelId=0x0, lpFileInformation=0x26e73b8 | out: lpFileInformation=0x26e73b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b)) returned 1
	[0169.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", lpFilePart=0x0) returned 0x5a
	[0169.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.586] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.586] GetFileType (hFile=0x318) returned 0x1
	[0169.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.586] GetFileType (hFile=0x318) returned 0x1
	[0169.586] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xc04b
	[0169.586] ReadFile (in: hFile=0x318, lpBuffer=0x26e7658, nNumberOfBytesToRead=0xc04b, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26e7658*, lpNumberOfBytesRead=0x99f04c*=0xc04b, lpOverlapped=0x0) returned 1
	[0169.611] CloseHandle (hObject=0x318) returned 1
	[0169.611] CryptDestroyKey (hKey=0x82b100) returned 1
	[0169.612] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.612] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f3740, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b480) returned 1
	[0169.612] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.612] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.612] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b080) returned 1
	[0169.612] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.612] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x26f37f8*=0x1, dwFlags=0x0) returned 1
	[0169.612] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x26f37c4, dwFlags=0x0) returned 1
	[0169.612] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f3808*, pdwDataLen=0x99f054*=0xc050, dwBufLen=0xc050 | out: pbData=0x26f3808*, pdwDataLen=0x99f054*=0xc050) returned 1
	[0169.612] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ff864*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26ff864*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.613] CryptDestroyKey (hKey=0x82b080) returned 1
	[0169.613] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.613] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", lpFilePart=0x0) returned 0x5a
	[0169.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.613] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.615] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFilePart=0x0) returned 0x5b
	[0169.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.615] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), fInfoLevelId=0x0, lpFileInformation=0x26ffef8 | out: lpFileInformation=0x26ffef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff)) returned 1
	[0169.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.619] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFilePart=0x0) returned 0x5b
	[0169.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.619] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.620] GetFileType (hFile=0x318) returned 0x1
	[0169.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.620] GetFileType (hFile=0x318) returned 0x1
	[0169.620] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2aff
	[0169.620] ReadFile (in: hFile=0x318, lpBuffer=0x2700198, nNumberOfBytesToRead=0x2aff, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2700198*, lpNumberOfBytesRead=0x99f04c*=0x2aff, lpOverlapped=0x0) returned 1
	[0169.631] CloseHandle (hObject=0x318) returned 1
	[0169.631] CryptDestroyKey (hKey=0x82b480) returned 1
	[0169.631] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.631] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2702d34, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0169.631] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.631] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.631] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0169.631] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.632] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2702dec*=0x1, dwFlags=0x0) returned 1
	[0169.632] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2702db8, dwFlags=0x0) returned 1
	[0169.632] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2702dfc*, pdwDataLen=0x99f054*=0x2b00, dwBufLen=0x2b00 | out: pbData=0x2702dfc*, pdwDataLen=0x99f054*=0x2b00) returned 1
	[0169.632] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2705908*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2705908*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.632] CryptDestroyKey (hKey=0x82b280) returned 1
	[0169.632] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.632] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.632] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFilePart=0x0) returned 0x5b
	[0169.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.632] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.634] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", lpFilePart=0x0) returned 0x59
	[0169.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.634] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), fInfoLevelId=0x0, lpFileInformation=0x2705fa0 | out: lpFileInformation=0x2705fa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4)) returned 1
	[0169.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.635] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", lpFilePart=0x0) returned 0x59
	[0169.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.635] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.635] GetFileType (hFile=0x318) returned 0x1
	[0169.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.635] GetFileType (hFile=0x318) returned 0x1
	[0169.635] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1b9f4
	[0169.636] ReadFile (in: hFile=0x318, lpBuffer=0x384c8d8, nNumberOfBytesToRead=0x1b9f4, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x384c8d8*, lpNumberOfBytesRead=0x99f04c*=0x1b9f4, lpOverlapped=0x0) returned 1
	[0169.655] CloseHandle (hObject=0x318) returned 1
	[0169.655] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0169.655] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.655] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27062c0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b5c0) returned 1
	[0169.655] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.655] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.655] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0169.655] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.655] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2706378*=0x1, dwFlags=0x0) returned 1
	[0169.655] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2706344, dwFlags=0x0) returned 1
	[0169.656] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38682e8*, pdwDataLen=0x99f054*=0x1ba00, dwBufLen=0x1ba00 | out: pbData=0x38682e8*, pdwDataLen=0x99f054*=0x1ba00) returned 1
	[0169.656] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2706388*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2706388*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.656] CryptDestroyKey (hKey=0x82b280) returned 1
	[0169.656] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.656] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.656] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", lpFilePart=0x0) returned 0x59
	[0169.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.656] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.658] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFilePart=0x0) returned 0x5c
	[0169.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.658] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), fInfoLevelId=0x0, lpFileInformation=0x2706a0c | out: lpFileInformation=0x2706a0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3)) returned 1
	[0169.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.659] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFilePart=0x0) returned 0x5c
	[0169.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.659] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.659] GetFileType (hFile=0x318) returned 0x1
	[0169.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.659] GetFileType (hFile=0x318) returned 0x1
	[0169.659] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xd0a3
	[0169.660] ReadFile (in: hFile=0x318, lpBuffer=0x2706cbc, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2706cbc*, lpNumberOfBytesRead=0x99f04c*=0xd0a3, lpOverlapped=0x0) returned 1
	[0169.678] CloseHandle (hObject=0x318) returned 1
	[0169.678] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0169.679] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.679] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2713dfc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0169.679] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.679] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.679] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0169.679] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.679] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2713eb4*=0x1, dwFlags=0x0) returned 1
	[0169.679] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2713e80, dwFlags=0x0) returned 1
	[0169.679] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2713ec4*, pdwDataLen=0x99f054*=0xd0b0, dwBufLen=0xd0b0 | out: pbData=0x2713ec4*, pdwDataLen=0x99f054*=0xd0b0) returned 1
	[0169.680] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2720f80*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2720f80*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.680] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0169.680] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.680] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFilePart=0x0) returned 0x5c
	[0169.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.680] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.682] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", lpFilePart=0x0) returned 0x60
	[0169.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.682] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), fInfoLevelId=0x0, lpFileInformation=0x2721628 | out: lpFileInformation=0x2721628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8)) returned 1
	[0169.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.682] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", lpFilePart=0x0) returned 0x60
	[0169.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.683] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.683] GetFileType (hFile=0x318) returned 0x1
	[0169.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.683] GetFileType (hFile=0x318) returned 0x1
	[0169.683] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xe3c8
	[0169.683] ReadFile (in: hFile=0x318, lpBuffer=0x27218f8, nNumberOfBytesToRead=0xe3c8, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27218f8*, lpNumberOfBytesRead=0x99f04c*=0xe3c8, lpOverlapped=0x0) returned 1
	[0169.690] CloseHandle (hObject=0x318) returned 1
	[0169.690] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0169.690] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.690] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272fd5c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b040) returned 1
	[0169.690] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.690] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.690] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b200) returned 1
	[0169.690] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.690] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x272fe14*=0x1, dwFlags=0x0) returned 1
	[0169.690] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x272fde0, dwFlags=0x0) returned 1
	[0169.691] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272fe24*, pdwDataLen=0x99f054*=0xe3d0, dwBufLen=0xe3d0 | out: pbData=0x272fe24*, pdwDataLen=0x99f054*=0xe3d0) returned 1
	[0169.691] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273e200*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x273e200*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.691] CryptDestroyKey (hKey=0x82b200) returned 1
	[0169.691] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.691] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.691] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", lpFilePart=0x0) returned 0x60
	[0169.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.691] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.693] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", lpFilePart=0x0) returned 0x64
	[0169.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.693] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), fInfoLevelId=0x0, lpFileInformation=0x273e8d0 | out: lpFileInformation=0x273e8d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8)) returned 1
	[0169.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.694] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", lpFilePart=0x0) returned 0x64
	[0169.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.694] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.694] GetFileType (hFile=0x318) returned 0x1
	[0169.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.694] GetFileType (hFile=0x318) returned 0x1
	[0169.694] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xebb8
	[0169.694] ReadFile (in: hFile=0x318, lpBuffer=0x273ebc0, nNumberOfBytesToRead=0xebb8, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x273ebc0*, lpNumberOfBytesRead=0x99f04c*=0xebb8, lpOverlapped=0x0) returned 1
	[0169.698] CloseHandle (hObject=0x318) returned 1
	[0169.699] CryptDestroyKey (hKey=0x82b040) returned 1
	[0169.699] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.699] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274d814, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0169.699] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.699] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.699] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0169.699] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.699] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x274d8cc*=0x1, dwFlags=0x0) returned 1
	[0169.699] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x274d898, dwFlags=0x0) returned 1
	[0169.699] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274d8dc*, pdwDataLen=0x99f054*=0xebc0, dwBufLen=0xebc0 | out: pbData=0x274d8dc*, pdwDataLen=0x99f054*=0xebc0) returned 1
	[0169.700] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275c4a8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x275c4a8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.700] CryptDestroyKey (hKey=0x82b540) returned 1
	[0169.700] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.700] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.700] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", lpFilePart=0x0) returned 0x64
	[0169.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.700] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.702] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", lpFilePart=0x0) returned 0x61
	[0169.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.702] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), fInfoLevelId=0x0, lpFileInformation=0x275cba0 | out: lpFileInformation=0x275cba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5)) returned 1
	[0169.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.702] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", lpFilePart=0x0) returned 0x61
	[0169.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.703] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.703] GetFileType (hFile=0x318) returned 0x1
	[0169.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.703] GetFileType (hFile=0x318) returned 0x1
	[0169.703] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xdff5
	[0169.703] ReadFile (in: hFile=0x318, lpBuffer=0x275ce70, nNumberOfBytesToRead=0xdff5, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x275ce70*, lpNumberOfBytesRead=0x99f04c*=0xdff5, lpOverlapped=0x0) returned 1
	[0169.726] CloseHandle (hObject=0x318) returned 1
	[0169.726] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0169.726] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.726] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276af04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b4c0) returned 1
	[0169.726] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.726] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.726] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b2c0) returned 1
	[0169.726] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.726] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x276afbc*=0x1, dwFlags=0x0) returned 1
	[0169.727] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x276af88, dwFlags=0x0) returned 1
	[0169.727] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276afcc*, pdwDataLen=0x99f054*=0xe000, dwBufLen=0xe000 | out: pbData=0x276afcc*, pdwDataLen=0x99f054*=0xe000) returned 1
	[0169.727] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2778fd8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2778fd8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.727] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0169.727] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.727] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.727] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", lpFilePart=0x0) returned 0x61
	[0169.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.727] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", lpFilePart=0x0) returned 0x5b
	[0169.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.729] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), fInfoLevelId=0x0, lpFileInformation=0x27796ac | out: lpFileInformation=0x27796ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75)) returned 1
	[0169.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.730] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", lpFilePart=0x0) returned 0x5b
	[0169.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.730] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.730] GetFileType (hFile=0x318) returned 0x1
	[0169.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.730] GetFileType (hFile=0x318) returned 0x1
	[0169.730] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xec75
	[0169.730] ReadFile (in: hFile=0x318, lpBuffer=0x277994c, nNumberOfBytesToRead=0xec75, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x277994c*, lpNumberOfBytesRead=0x99f04c*=0xec75, lpOverlapped=0x0) returned 1
	[0169.740] CloseHandle (hObject=0x318) returned 1
	[0169.740] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0169.740] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.740] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2788660, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b200) returned 1
	[0169.740] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.740] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.740] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0169.740] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.740] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2788718*=0x1, dwFlags=0x0) returned 1
	[0169.740] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27886e4, dwFlags=0x0) returned 1
	[0169.740] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2788728*, pdwDataLen=0x99f054*=0xec80, dwBufLen=0xec80 | out: pbData=0x2788728*, pdwDataLen=0x99f054*=0xec80) returned 1
	[0169.741] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27973b4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27973b4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.741] CryptDestroyKey (hKey=0x82b300) returned 1
	[0169.741] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.741] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", lpFilePart=0x0) returned 0x5b
	[0169.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.741] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.743] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", lpFilePart=0x0) returned 0x63
	[0169.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.743] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), fInfoLevelId=0x0, lpFileInformation=0x2797a4c | out: lpFileInformation=0x2797a4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654)) returned 1
	[0169.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.743] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", lpFilePart=0x0) returned 0x63
	[0169.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.744] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.744] GetFileType (hFile=0x318) returned 0x1
	[0169.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.744] GetFileType (hFile=0x318) returned 0x1
	[0169.744] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x10654
	[0169.744] ReadFile (in: hFile=0x318, lpBuffer=0x2797d2c, nNumberOfBytesToRead=0x10654, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2797d2c*, lpNumberOfBytesRead=0x99f04c*=0x10654, lpOverlapped=0x0) returned 1
	[0169.746] CloseHandle (hObject=0x318) returned 1
	[0169.746] CryptDestroyKey (hKey=0x82b200) returned 1
	[0169.746] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.746] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27a841c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b4c0) returned 1
	[0169.746] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.747] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.747] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0169.747] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.747] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27a84d4*=0x1, dwFlags=0x0) returned 1
	[0169.747] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27a84a0, dwFlags=0x0) returned 1
	[0169.747] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a84e4*, pdwDataLen=0x99f054*=0x10660, dwBufLen=0x10660 | out: pbData=0x27a84e4*, pdwDataLen=0x99f054*=0x10660) returned 1
	[0169.747] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b8b50*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27b8b50*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.748] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0169.748] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.748] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", lpFilePart=0x0) returned 0x63
	[0169.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.748] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.750] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", lpFilePart=0x0) returned 0x63
	[0169.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.750] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), fInfoLevelId=0x0, lpFileInformation=0x27b9238 | out: lpFileInformation=0x27b9238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2)) returned 1
	[0169.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.751] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", lpFilePart=0x0) returned 0x63
	[0169.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.751] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.751] GetFileType (hFile=0x318) returned 0x1
	[0169.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.751] GetFileType (hFile=0x318) returned 0x1
	[0169.751] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xf8c2
	[0169.751] ReadFile (in: hFile=0x318, lpBuffer=0x27b9518, nNumberOfBytesToRead=0xf8c2, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27b9518*, lpNumberOfBytesRead=0x99f04c*=0xf8c2, lpOverlapped=0x0) returned 1
	[0169.765] CloseHandle (hObject=0x318) returned 1
	[0169.765] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0169.765] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.765] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c8e78, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0169.765] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.765] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.765] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b100) returned 1
	[0169.765] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.766] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27c8f30*=0x1, dwFlags=0x0) returned 1
	[0169.766] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27c8efc, dwFlags=0x0) returned 1
	[0169.766] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c8f40*, pdwDataLen=0x99f054*=0xf8d0, dwBufLen=0xf8d0 | out: pbData=0x27c8f40*, pdwDataLen=0x99f054*=0xf8d0) returned 1
	[0169.766] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27d881c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27d881c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.766] CryptDestroyKey (hKey=0x82b100) returned 1
	[0169.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.766] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", lpFilePart=0x0) returned 0x63
	[0169.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.766] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.768] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5b
	[0169.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.768] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), fInfoLevelId=0x0, lpFileInformation=0x27d8f04 | out: lpFileInformation=0x27d8f04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64)) returned 1
	[0169.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.768] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5b
	[0169.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.768] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.768] GetFileType (hFile=0x318) returned 0x1
	[0169.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.768] GetFileType (hFile=0x318) returned 0x1
	[0169.768] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2c64
	[0169.769] ReadFile (in: hFile=0x318, lpBuffer=0x27d91a4, nNumberOfBytesToRead=0x2c64, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27d91a4*, lpNumberOfBytesRead=0x99f04c*=0x2c64, lpOverlapped=0x0) returned 1
	[0169.789] CloseHandle (hObject=0x318) returned 1
	[0169.789] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0169.789] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.789] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27dbea4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0169.789] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.789] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.789] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0169.789] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.789] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27dbf5c*=0x1, dwFlags=0x0) returned 1
	[0169.790] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27dbf28, dwFlags=0x0) returned 1
	[0169.790] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27dbf6c*, pdwDataLen=0x99f054*=0x2c70, dwBufLen=0x2c70 | out: pbData=0x27dbf6c*, pdwDataLen=0x99f054*=0x2c70) returned 1
	[0169.790] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27debe8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27debe8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.790] CryptDestroyKey (hKey=0x82b540) returned 1
	[0169.790] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.790] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.790] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5b
	[0169.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.790] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0169.792] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl", lpFilePart=0x0) returned 0x57
	[0169.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.792] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl"), fInfoLevelId=0x0, lpFileInformation=0x27df280 | out: lpFileInformation=0x27df280*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000)) returned 1
	[0169.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.792] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl", lpFilePart=0x0) returned 0x57
	[0169.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.793] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.793] GetFileType (hFile=0x318) returned 0x1
	[0169.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.793] GetFileType (hFile=0x318) returned 0x1
	[0169.793] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x30000
	[0169.794] ReadFile (in: hFile=0x318, lpBuffer=0x3883d08, nNumberOfBytesToRead=0x30000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x3883d08*, lpNumberOfBytesRead=0x99f04c*=0x30000, lpOverlapped=0x0) returned 1
	[0169.869] CloseHandle (hObject=0x318) returned 1
	[0169.869] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0169.870] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.870] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27df600, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b340) returned 1
	[0169.870] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.870] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.870] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b080) returned 1
	[0169.870] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.870] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x27df6b8*=0x1, dwFlags=0x0) returned 1
	[0169.870] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x27df684, dwFlags=0x0) returned 1
	[0169.871] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38b3d28*, pdwDataLen=0x99f054*=0x30010, dwBufLen=0x30010 | out: pbData=0x38b3d28*, pdwDataLen=0x99f054*=0x30010) returned 1
	[0169.871] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27df6c8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27df6c8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.871] CryptDestroyKey (hKey=0x82b080) returned 1
	[0169.871] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.871] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl", lpFilePart=0x0) returned 0x57
	[0169.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.871] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.874] GetFileType (hFile=0x318) returned 0x1
	[0169.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0169.874] GetFileType (hFile=0x318) returned 0x1
	[0169.874] WriteFile (in: hFile=0x318, lpBuffer=0x38b3d28*, nNumberOfBytesToWrite=0x30010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x38b3d28*, lpNumberOfBytesWritten=0x99f040*=0x30010, lpOverlapped=0x0) returned 1
	[0169.877] CloseHandle (hObject=0x318) returned 1
	[0169.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl", lpFilePart=0x0) returned 0x57
	[0169.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x86
	[0169.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0169.878] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0x9f960149, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x30010)) returned 1
	[0169.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0169.878] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl"), lpNewFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0169.879] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl", lpFilePart=0x0) returned 0x5b
	[0169.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.879] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\autologger-diagtrack-listener.etl"), fInfoLevelId=0x0, lpFileInformation=0x27dfc24 | out: lpFileInformation=0x27dfc24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000)) returned 1
	[0169.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.879] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl", lpFilePart=0x0) returned 0x5b
	[0169.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.879] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\autologger-diagtrack-listener.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0169.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0169.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.881] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x27e0460 | out: lpFileInformation=0x27e0460*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243)) returned 1
	[0169.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.882] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.882] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.882] GetFileType (hFile=0x318) returned 0x1
	[0169.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.882] GetFileType (hFile=0x318) returned 0x1
	[0169.882] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x243
	[0169.882] ReadFile (in: hFile=0x318, lpBuffer=0x27e0960, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27e0960*, lpNumberOfBytesRead=0x99f04c*=0x243, lpOverlapped=0x0) returned 1
	[0169.883] CloseHandle (hObject=0x318) returned 1
	[0169.883] CryptDestroyKey (hKey=0x82b340) returned 1
	[0169.883] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.883] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e19fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0169.884] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.884] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.884] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0169.884] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.884] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27e1ab4*=0x1, dwFlags=0x0) returned 1
	[0169.884] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27e1a80, dwFlags=0x0) returned 1
	[0169.884] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e1ac4*, pdwDataLen=0x99f054*=0x250, dwBufLen=0x250 | out: pbData=0x27e1ac4*, pdwDataLen=0x99f054*=0x250) returned 1
	[0169.884] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e1d20*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27e1d20*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.884] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0169.884] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.884] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.884] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.884] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.885] GetFileType (hFile=0x318) returned 0x1
	[0169.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0169.886] GetFileType (hFile=0x318) returned 0x1
	[0169.886] WriteFile (in: hFile=0x318, lpBuffer=0x27e1e84*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27e1e84*, lpNumberOfBytesWritten=0x99f014*=0x250, lpOverlapped=0x0) returned 1
	[0169.887] CloseHandle (hObject=0x318) returned 1
	[0169.887] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.887] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0169.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0169.887] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9f960149, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1
	[0169.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0169.887] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0169.888] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.888] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x27e3298 | out: lpFileInformation=0x27e3298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab)) returned 1
	[0169.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.895] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.896] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.896] GetFileType (hFile=0x318) returned 0x1
	[0169.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.896] GetFileType (hFile=0x318) returned 0x1
	[0169.896] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1ab
	[0169.896] ReadFile (in: hFile=0x318, lpBuffer=0x27e3700, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27e3700*, lpNumberOfBytesRead=0x99f04c*=0x1ab, lpOverlapped=0x0) returned 1
	[0169.897] CloseHandle (hObject=0x318) returned 1
	[0169.897] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0169.897] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.897] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e479c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0169.897] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.898] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.898] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b5c0) returned 1
	[0169.898] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.898] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27e4854*=0x1, dwFlags=0x0) returned 1
	[0169.898] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27e4820, dwFlags=0x0) returned 1
	[0169.898] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e4864*, pdwDataLen=0x99f054*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x27e4864*, pdwDataLen=0x99f054*=0x1b0) returned 1
	[0169.898] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e4a20*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27e4a20*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.898] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0169.898] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.898] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.898] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.898] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.899] GetFileType (hFile=0x318) returned 0x1
	[0169.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0169.899] GetFileType (hFile=0x318) returned 0x1
	[0169.899] WriteFile (in: hFile=0x318, lpBuffer=0x27e4b84*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27e4b84*, lpNumberOfBytesWritten=0x99f014*=0x1b0, lpOverlapped=0x0) returned 1
	[0169.900] CloseHandle (hObject=0x318) returned 1
	[0169.901] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.901] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0169.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0169.901] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9f986843, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1b0)) returned 1
	[0169.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0169.901] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0169.902] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.902] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x27e5f98 | out: lpFileInformation=0x27e5f98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb)) returned 1
	[0169.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.903] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.903] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.903] GetFileType (hFile=0x318) returned 0x1
	[0169.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.903] GetFileType (hFile=0x318) returned 0x1
	[0169.903] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xfb
	[0169.903] ReadFile (in: hFile=0x318, lpBuffer=0x27e6350, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27e6350*, lpNumberOfBytesRead=0x99f04c*=0xfb, lpOverlapped=0x0) returned 1
	[0169.904] CloseHandle (hObject=0x318) returned 1
	[0169.905] CryptDestroyKey (hKey=0x82b540) returned 1
	[0169.905] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.905] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27e73ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0169.905] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.905] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.905] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0169.905] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.905] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27e74a4*=0x1, dwFlags=0x0) returned 1
	[0169.905] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27e7470, dwFlags=0x0) returned 1
	[0169.905] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27e74b4*, pdwDataLen=0x99f054*=0x100, dwBufLen=0x100 | out: pbData=0x27e74b4*, pdwDataLen=0x99f054*=0x100) returned 1
	[0169.905] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e75c0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27e75c0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.905] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0169.906] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.906] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.906] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.906] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.907] GetFileType (hFile=0x318) returned 0x1
	[0169.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0169.907] GetFileType (hFile=0x318) returned 0x1
	[0169.907] WriteFile (in: hFile=0x318, lpBuffer=0x27e7724*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27e7724*, lpNumberOfBytesWritten=0x99f014*=0x100, lpOverlapped=0x0) returned 1
	[0169.908] CloseHandle (hObject=0x318) returned 1
	[0169.908] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.909] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0169.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0169.909] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9f9af10b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x100)) returned 1
	[0169.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0169.909] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0169.910] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.910] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x27e8b38 | out: lpFileInformation=0x27e8b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac)) returned 1
	[0169.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.910] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.910] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.910] GetFileType (hFile=0x318) returned 0x1
	[0169.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.911] GetFileType (hFile=0x318) returned 0x1
	[0169.911] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1ac
	[0169.911] ReadFile (in: hFile=0x318, lpBuffer=0x27e8fa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27e8fa0*, lpNumberOfBytesRead=0x99f04c*=0x1ac, lpOverlapped=0x0) returned 1
	[0169.919] CloseHandle (hObject=0x318) returned 1
	[0169.919] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0169.920] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.920] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ea03c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b5c0) returned 1
	[0169.920] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.920] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.920] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0169.920] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.920] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27ea0f4*=0x1, dwFlags=0x0) returned 1
	[0169.920] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27ea0c0, dwFlags=0x0) returned 1
	[0169.920] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ea104*, pdwDataLen=0x99f054*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x27ea104*, pdwDataLen=0x99f054*=0x1b0) returned 1
	[0169.920] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ea2c0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27ea2c0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.920] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0169.920] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.920] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.920] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.920] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.922] GetFileType (hFile=0x318) returned 0x1
	[0169.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0169.922] GetFileType (hFile=0x318) returned 0x1
	[0169.922] WriteFile (in: hFile=0x318, lpBuffer=0x27ea424*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27ea424*, lpNumberOfBytesWritten=0x99f014*=0x1b0, lpOverlapped=0x0) returned 1
	[0169.923] CloseHandle (hObject=0x318) returned 1
	[0169.923] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.923] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0169.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0169.923] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9f9d28bf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1b0)) returned 1
	[0169.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0169.923] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0169.924] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.924] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x27eb838 | out: lpFileInformation=0x27eb838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb)) returned 1
	[0169.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.924] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.924] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.925] GetFileType (hFile=0x318) returned 0x1
	[0169.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.925] GetFileType (hFile=0x318) returned 0x1
	[0169.925] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xfb
	[0169.925] ReadFile (in: hFile=0x318, lpBuffer=0x27ebbf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27ebbf0*, lpNumberOfBytesRead=0x99f04c*=0xfb, lpOverlapped=0x0) returned 1
	[0169.926] CloseHandle (hObject=0x318) returned 1
	[0169.926] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0169.926] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.926] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ecc8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0169.926] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.926] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.926] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b100) returned 1
	[0169.926] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.926] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x27ecd44*=0x1, dwFlags=0x0) returned 1
	[0169.926] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x27ecd10, dwFlags=0x0) returned 1
	[0169.926] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ecd54*, pdwDataLen=0x99f054*=0x100, dwBufLen=0x100 | out: pbData=0x27ecd54*, pdwDataLen=0x99f054*=0x100) returned 1
	[0169.926] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27ece60*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27ece60*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.926] CryptDestroyKey (hKey=0x82b100) returned 1
	[0169.926] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.926] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.927] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.928] GetFileType (hFile=0x318) returned 0x1
	[0169.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0169.928] GetFileType (hFile=0x318) returned 0x1
	[0169.928] WriteFile (in: hFile=0x318, lpBuffer=0x27ecfc4*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27ecfc4*, lpNumberOfBytesWritten=0x99f014*=0x100, lpOverlapped=0x0) returned 1
	[0169.929] CloseHandle (hObject=0x318) returned 1
	[0169.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0169.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0169.929] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9f9d28bf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x100)) returned 1
	[0169.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0169.929] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0169.930] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.930] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x27ee3d8 | out: lpFileInformation=0x27ee3d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257)) returned 1
	[0169.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.930] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.930] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.931] GetFileType (hFile=0x318) returned 0x1
	[0169.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.931] GetFileType (hFile=0x318) returned 0x1
	[0169.931] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x257
	[0169.931] ReadFile (in: hFile=0x318, lpBuffer=0x27ee8ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27ee8ec*, lpNumberOfBytesRead=0x99f04c*=0x257, lpOverlapped=0x0) returned 1
	[0169.932] CloseHandle (hObject=0x318) returned 1
	[0169.932] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0169.932] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.932] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ef988, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b380) returned 1
	[0169.932] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.932] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.932] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0169.932] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.932] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27efa40*=0x1, dwFlags=0x0) returned 1
	[0169.932] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27efa0c, dwFlags=0x0) returned 1
	[0169.932] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27efa50*, pdwDataLen=0x99f054*=0x260, dwBufLen=0x260 | out: pbData=0x27efa50*, pdwDataLen=0x99f054*=0x260) returned 1
	[0169.932] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27efcbc*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27efcbc*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.932] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0169.932] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.933] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.933] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.933] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.934] GetFileType (hFile=0x318) returned 0x1
	[0169.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0169.934] GetFileType (hFile=0x318) returned 0x1
	[0169.934] WriteFile (in: hFile=0x318, lpBuffer=0x27efe20*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27efe20*, lpNumberOfBytesWritten=0x99f014*=0x260, lpOverlapped=0x0) returned 1
	[0169.935] CloseHandle (hObject=0x318) returned 1
	[0169.939] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.939] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0169.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0169.939] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9f9f8b34, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x260)) returned 1
	[0169.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0169.939] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0169.945] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.945] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x27f1234 | out: lpFileInformation=0x27f1234*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f)) returned 1
	[0169.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.946] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.946] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.946] GetFileType (hFile=0x318) returned 0x1
	[0169.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.946] GetFileType (hFile=0x318) returned 0x1
	[0169.946] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x23f
	[0169.946] ReadFile (in: hFile=0x318, lpBuffer=0x27f1730, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27f1730*, lpNumberOfBytesRead=0x99f04c*=0x23f, lpOverlapped=0x0) returned 1
	[0169.947] CloseHandle (hObject=0x318) returned 1
	[0169.947] CryptDestroyKey (hKey=0x82b380) returned 1
	[0169.947] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.948] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f27cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0169.948] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.948] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.948] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0169.948] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.948] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27f2884*=0x1, dwFlags=0x0) returned 1
	[0169.948] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27f2850, dwFlags=0x0) returned 1
	[0169.948] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f2894*, pdwDataLen=0x99f054*=0x240, dwBufLen=0x240 | out: pbData=0x27f2894*, pdwDataLen=0x99f054*=0x240) returned 1
	[0169.948] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f2ae0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27f2ae0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.948] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0169.948] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.948] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.948] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.948] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.949] GetFileType (hFile=0x318) returned 0x1
	[0169.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0169.949] GetFileType (hFile=0x318) returned 0x1
	[0169.949] WriteFile (in: hFile=0x318, lpBuffer=0x27f2c44*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27f2c44*, lpNumberOfBytesWritten=0x99f014*=0x240, lpOverlapped=0x0) returned 1
	[0169.950] CloseHandle (hObject=0x318) returned 1
	[0169.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0169.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0169.951] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9fa1ed53, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x240)) returned 1
	[0169.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0169.951] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0169.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.952] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x27f4058 | out: lpFileInformation=0x27f4058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102)) returned 1
	[0169.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.952] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.952] GetFileType (hFile=0x318) returned 0x1
	[0169.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.952] GetFileType (hFile=0x318) returned 0x1
	[0169.952] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x102
	[0169.953] ReadFile (in: hFile=0x318, lpBuffer=0x27f4418, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27f4418*, lpNumberOfBytesRead=0x99f04c*=0x102, lpOverlapped=0x0) returned 1
	[0169.971] CloseHandle (hObject=0x318) returned 1
	[0169.971] CryptDestroyKey (hKey=0x82b540) returned 1
	[0169.971] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.971] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f54b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b100) returned 1
	[0169.971] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.971] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.971] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0169.971] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.972] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27f556c*=0x1, dwFlags=0x0) returned 1
	[0169.972] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27f5538, dwFlags=0x0) returned 1
	[0169.972] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f557c*, pdwDataLen=0x99f054*=0x110, dwBufLen=0x110 | out: pbData=0x27f557c*, pdwDataLen=0x99f054*=0x110) returned 1
	[0169.972] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f5698*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27f5698*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.972] CryptDestroyKey (hKey=0x82b280) returned 1
	[0169.972] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.972] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.972] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.973] GetFileType (hFile=0x318) returned 0x1
	[0169.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0169.973] GetFileType (hFile=0x318) returned 0x1
	[0169.973] WriteFile (in: hFile=0x318, lpBuffer=0x27f57fc*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27f57fc*, lpNumberOfBytesWritten=0x99f014*=0x110, lpOverlapped=0x0) returned 1
	[0169.974] CloseHandle (hObject=0x318) returned 1
	[0169.974] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.974] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0169.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0169.975] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9fa45022, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0169.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0169.975] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0169.976] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.977] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.977] ReadFile (in: hFile=0x318, lpBuffer=0x27f6fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27f6fd0*, lpNumberOfBytesRead=0x99f04c*=0x102, lpOverlapped=0x0) returned 1
	[0169.978] CloseHandle (hObject=0x318) returned 1
	[0169.978] CryptDestroyKey (hKey=0x82b100) returned 1
	[0169.979] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.979] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f806c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0169.979] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.979] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.979] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0169.979] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.979] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27f8124*=0x1, dwFlags=0x0) returned 1
	[0169.979] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27f80f0, dwFlags=0x0) returned 1
	[0169.979] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f8134*, pdwDataLen=0x99f054*=0x110, dwBufLen=0x110 | out: pbData=0x27f8134*, pdwDataLen=0x99f054*=0x110) returned 1
	[0169.979] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27f8250*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27f8250*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.979] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0169.979] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.979] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.979] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.979] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.981] GetFileType (hFile=0x318) returned 0x1
	[0169.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0169.981] GetFileType (hFile=0x318) returned 0x1
	[0169.981] WriteFile (in: hFile=0x318, lpBuffer=0x27f83b4*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27f83b4*, lpNumberOfBytesWritten=0x99f014*=0x110, lpOverlapped=0x0) returned 1
	[0169.982] CloseHandle (hObject=0x318) returned 1
	[0169.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0169.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0169.982] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9fa6b246, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1
	[0169.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0169.982] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0169.983] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.983] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x27f97c8 | out: lpFileInformation=0x27f97c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc)) returned 1
	[0169.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.984] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.984] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.984] GetFileType (hFile=0x318) returned 0x1
	[0169.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.984] GetFileType (hFile=0x318) returned 0x1
	[0169.984] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1cc
	[0169.984] ReadFile (in: hFile=0x318, lpBuffer=0x27f9c50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27f9c50*, lpNumberOfBytesRead=0x99f04c*=0x1cc, lpOverlapped=0x0) returned 1
	[0169.985] CloseHandle (hObject=0x318) returned 1
	[0169.985] CryptDestroyKey (hKey=0x82b540) returned 1
	[0169.985] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.985] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27facec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b200) returned 1
	[0169.985] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.985] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.986] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0169.986] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.986] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27fada4*=0x1, dwFlags=0x0) returned 1
	[0169.986] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27fad70, dwFlags=0x0) returned 1
	[0169.986] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27fadb4*, pdwDataLen=0x99f054*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27fadb4*, pdwDataLen=0x99f054*=0x1d0) returned 1
	[0169.986] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27faf90*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27faf90*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.986] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0169.986] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.986] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.986] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.986] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.987] GetFileType (hFile=0x318) returned 0x1
	[0169.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0169.987] GetFileType (hFile=0x318) returned 0x1
	[0169.988] WriteFile (in: hFile=0x318, lpBuffer=0x27fb0f4*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27fb0f4*, lpNumberOfBytesWritten=0x99f014*=0x1d0, lpOverlapped=0x0) returned 1
	[0169.988] CloseHandle (hObject=0x318) returned 1
	[0169.989] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.989] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0169.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0169.989] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9fa6b246, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0169.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0169.989] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0169.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.990] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x27fc508 | out: lpFileInformation=0x27fc508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc)) returned 1
	[0169.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.990] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.991] GetFileType (hFile=0x318) returned 0x1
	[0169.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.991] GetFileType (hFile=0x318) returned 0x1
	[0169.991] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1cc
	[0169.991] ReadFile (in: hFile=0x318, lpBuffer=0x27fc990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27fc990*, lpNumberOfBytesRead=0x99f04c*=0x1cc, lpOverlapped=0x0) returned 1
	[0169.992] CloseHandle (hObject=0x318) returned 1
	[0169.992] CryptDestroyKey (hKey=0x82b200) returned 1
	[0169.992] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.992] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fda2c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0169.992] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.992] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.992] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0169.992] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.992] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27fdae4*=0x1, dwFlags=0x0) returned 1
	[0169.992] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27fdab0, dwFlags=0x0) returned 1
	[0169.992] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27fdaf4*, pdwDataLen=0x99f054*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27fdaf4*, pdwDataLen=0x99f054*=0x1d0) returned 1
	[0169.993] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27fdcd0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27fdcd0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.993] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0169.993] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.993] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.993] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0169.993] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.994] GetFileType (hFile=0x318) returned 0x1
	[0169.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0169.994] GetFileType (hFile=0x318) returned 0x1
	[0169.994] WriteFile (in: hFile=0x318, lpBuffer=0x27fde34*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27fde34*, lpNumberOfBytesWritten=0x99f014*=0x1d0, lpOverlapped=0x0) returned 1
	[0169.995] CloseHandle (hObject=0x318) returned 1
	[0169.995] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.995] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0169.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0169.995] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9fa6b246, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0169.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0169.996] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0169.997] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0169.997] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x27ff248 | out: lpFileInformation=0x27ff248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb)) returned 1
	[0169.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0169.997] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0169.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0169.997] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0169.998] GetFileType (hFile=0x318) returned 0x1
	[0169.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0169.998] GetFileType (hFile=0x318) returned 0x1
	[0169.998] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xfb
	[0169.998] ReadFile (in: hFile=0x318, lpBuffer=0x27ff600, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27ff600*, lpNumberOfBytesRead=0x99f04c*=0xfb, lpOverlapped=0x0) returned 1
	[0169.999] CloseHandle (hObject=0x318) returned 1
	[0169.999] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0169.999] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0169.999] CryptImportKey (in: hProv=0x7f93c0, pbData=0x280069c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b280) returned 1
	[0169.999] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.999] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.999] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b040) returned 1
	[0169.999] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0169.999] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2800754*=0x1, dwFlags=0x0) returned 1
	[0169.999] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2800720, dwFlags=0x0) returned 1
	[0169.999] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2800764*, pdwDataLen=0x99f054*=0x100, dwBufLen=0x100 | out: pbData=0x2800764*, pdwDataLen=0x99f054*=0x100) returned 1
	[0169.999] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2800870*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2800870*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0169.999] CryptDestroyKey (hKey=0x82b040) returned 1
	[0169.999] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.000] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0170.000] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.001] GetFileType (hFile=0x318) returned 0x1
	[0170.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0170.001] GetFileType (hFile=0x318) returned 0x1
	[0170.001] WriteFile (in: hFile=0x318, lpBuffer=0x28009d4*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x28009d4*, lpNumberOfBytesWritten=0x99f014*=0x100, lpOverlapped=0x0) returned 1
	[0170.002] CloseHandle (hObject=0x318) returned 1
	[0170.002] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.002] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0170.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0170.002] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9fa914a5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x100)) returned 1
	[0170.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0170.002] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0170.003] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0170.003] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x2801de8 | out: lpFileInformation=0x2801de8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc)) returned 1
	[0170.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0170.004] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0170.004] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.004] GetFileType (hFile=0x318) returned 0x1
	[0170.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0170.004] GetFileType (hFile=0x318) returned 0x1
	[0170.004] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1cc
	[0170.004] ReadFile (in: hFile=0x318, lpBuffer=0x2802270, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2802270*, lpNumberOfBytesRead=0x99f04c*=0x1cc, lpOverlapped=0x0) returned 1
	[0170.018] CloseHandle (hObject=0x318) returned 1
	[0170.018] CryptDestroyKey (hKey=0x82b280) returned 1
	[0170.018] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.018] CryptImportKey (in: hProv=0x7f93c0, pbData=0x280330c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0170.018] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.018] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.018] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0170.018] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.018] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x28033c4*=0x1, dwFlags=0x0) returned 1
	[0170.019] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2803390, dwFlags=0x0) returned 1
	[0170.019] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28033d4*, pdwDataLen=0x99f054*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x28033d4*, pdwDataLen=0x99f054*=0x1d0) returned 1
	[0170.019] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28035b0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x28035b0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0170.019] CryptDestroyKey (hKey=0x82b540) returned 1
	[0170.019] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.019] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.019] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0170.019] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.020] GetFileType (hFile=0x318) returned 0x1
	[0170.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0170.020] GetFileType (hFile=0x318) returned 0x1
	[0170.025] WriteFile (in: hFile=0x318, lpBuffer=0x2604ba0*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2604ba0*, lpNumberOfBytesWritten=0x99f014*=0x1d0, lpOverlapped=0x0) returned 1
	[0170.030] CloseHandle (hObject=0x318) returned 1
	[0170.030] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.030] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0170.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0170.030] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9fae137b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0170.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0170.031] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0170.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0170.031] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x2605fb4 | out: lpFileInformation=0x2605fb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222)) returned 1
	[0170.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0170.032] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0170.032] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.032] GetFileType (hFile=0x318) returned 0x1
	[0170.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0170.032] GetFileType (hFile=0x318) returned 0x1
	[0170.032] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x222
	[0170.032] ReadFile (in: hFile=0x318, lpBuffer=0x2606494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2606494*, lpNumberOfBytesRead=0x99f04c*=0x222, lpOverlapped=0x0) returned 1
	[0170.033] CloseHandle (hObject=0x318) returned 1
	[0170.033] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0170.033] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.033] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2607530, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0170.033] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.033] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.033] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b380) returned 1
	[0170.033] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.033] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26075e8*=0x1, dwFlags=0x0) returned 1
	[0170.033] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x26075b4, dwFlags=0x0) returned 1
	[0170.033] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26075f8*, pdwDataLen=0x99f054*=0x230, dwBufLen=0x230 | out: pbData=0x26075f8*, pdwDataLen=0x99f054*=0x230) returned 1
	[0170.033] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2607834*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2607834*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0170.034] CryptDestroyKey (hKey=0x82b380) returned 1
	[0170.034] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.034] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.034] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0170.034] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.035] GetFileType (hFile=0x318) returned 0x1
	[0170.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0170.035] GetFileType (hFile=0x318) returned 0x1
	[0170.035] WriteFile (in: hFile=0x318, lpBuffer=0x2607998*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2607998*, lpNumberOfBytesWritten=0x99f014*=0x230, lpOverlapped=0x0) returned 1
	[0170.036] CloseHandle (hObject=0x318) returned 1
	[0170.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0170.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0170.036] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9fae137b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1
	[0170.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0170.036] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0170.037] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0170.037] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x2608dac | out: lpFileInformation=0x2608dac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13)) returned 1
	[0170.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0170.038] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0170.038] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.038] GetFileType (hFile=0x318) returned 0x1
	[0170.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0170.038] GetFileType (hFile=0x318) returned 0x1
	[0170.038] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x4bf13
	[0170.039] ReadFile (in: hFile=0x318, lpBuffer=0x38e3d58, nNumberOfBytesToRead=0x4bf13, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x38e3d58*, lpNumberOfBytesRead=0x99f04c*=0x4bf13, lpOverlapped=0x0) returned 1
	[0170.054] CloseHandle (hObject=0x318) returned 1
	[0170.054] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0170.054] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.054] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26090ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b380) returned 1
	[0170.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.055] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0170.055] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.055] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26091a4*=0x1, dwFlags=0x0) returned 1
	[0170.055] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2609170, dwFlags=0x0) returned 1
	[0170.056] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x392fc88*, pdwDataLen=0x99f054*=0x4bf20, dwBufLen=0x4bf20 | out: pbData=0x392fc88*, pdwDataLen=0x99f054*=0x4bf20) returned 1
	[0170.056] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26091b4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26091b4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0170.056] CryptDestroyKey (hKey=0x82b280) returned 1
	[0170.056] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.057] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.057] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0170.057] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.061] GetFileType (hFile=0x318) returned 0x1
	[0170.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0170.061] GetFileType (hFile=0x318) returned 0x1
	[0170.061] WriteFile (in: hFile=0x318, lpBuffer=0x392fc88*, nNumberOfBytesToWrite=0x4bf20, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x392fc88*, lpNumberOfBytesWritten=0x99f040*=0x4bf20, lpOverlapped=0x0) returned 1
	[0170.067] CloseHandle (hObject=0x318) returned 1
	[0170.068] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.068] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0170.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0170.068] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9fb29e0d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4bf20)) returned 1
	[0170.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0170.068] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0170.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0170.069] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x2609720 | out: lpFileInformation=0x2609720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc)) returned 1
	[0170.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0170.070] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0170.070] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.070] GetFileType (hFile=0x318) returned 0x1
	[0170.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0170.070] GetFileType (hFile=0x318) returned 0x1
	[0170.070] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1cc
	[0170.070] ReadFile (in: hFile=0x318, lpBuffer=0x2609ba8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2609ba8*, lpNumberOfBytesRead=0x99f04c*=0x1cc, lpOverlapped=0x0) returned 1
	[0170.073] CloseHandle (hObject=0x318) returned 1
	[0170.073] CryptDestroyKey (hKey=0x82b380) returned 1
	[0170.073] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.073] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260ac44, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b0c0) returned 1
	[0170.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.074] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0170.074] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.074] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x260acfc*=0x1, dwFlags=0x0) returned 1
	[0170.074] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x260acc8, dwFlags=0x0) returned 1
	[0170.074] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260ad0c*, pdwDataLen=0x99f054*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x260ad0c*, pdwDataLen=0x99f054*=0x1d0) returned 1
	[0170.074] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260aee8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x260aee8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0170.074] CryptDestroyKey (hKey=0x82b300) returned 1
	[0170.074] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.074] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0170.074] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.076] GetFileType (hFile=0x318) returned 0x1
	[0170.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0170.076] GetFileType (hFile=0x318) returned 0x1
	[0170.076] WriteFile (in: hFile=0x318, lpBuffer=0x260b04c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x260b04c*, lpNumberOfBytesWritten=0x99f014*=0x1d0, lpOverlapped=0x0) returned 1
	[0170.077] CloseHandle (hObject=0x318) returned 1
	[0170.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0170.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0170.078] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9fb4ffee, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0170.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0170.078] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0170.079] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0170.079] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x260c460 | out: lpFileInformation=0x260c460*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb)) returned 1
	[0170.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0170.079] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0170.079] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.080] GetFileType (hFile=0x318) returned 0x1
	[0170.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0170.080] GetFileType (hFile=0x318) returned 0x1
	[0170.080] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xfb
	[0170.080] ReadFile (in: hFile=0x318, lpBuffer=0x260c818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x260c818*, lpNumberOfBytesRead=0x99f04c*=0xfb, lpOverlapped=0x0) returned 1
	[0170.081] CloseHandle (hObject=0x318) returned 1
	[0170.081] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0170.081] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.081] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260d8b4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0170.081] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.082] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.082] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b380) returned 1
	[0170.082] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.082] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x260d96c*=0x1, dwFlags=0x0) returned 1
	[0170.082] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x260d938, dwFlags=0x0) returned 1
	[0170.082] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x260d97c*, pdwDataLen=0x99f054*=0x100, dwBufLen=0x100 | out: pbData=0x260d97c*, pdwDataLen=0x99f054*=0x100) returned 1
	[0170.082] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x260da88*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x260da88*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0170.082] CryptDestroyKey (hKey=0x82b380) returned 1
	[0170.082] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.082] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0170.082] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.084] GetFileType (hFile=0x318) returned 0x1
	[0170.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0170.084] GetFileType (hFile=0x318) returned 0x1
	[0170.084] WriteFile (in: hFile=0x318, lpBuffer=0x260dbec*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x260dbec*, lpNumberOfBytesWritten=0x99f014*=0x100, lpOverlapped=0x0) returned 1
	[0170.085] CloseHandle (hObject=0x318) returned 1
	[0170.085] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.085] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0170.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0170.085] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9fb4ffee, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x100)) returned 1
	[0170.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0170.086] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0170.086] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0170.087] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x260f000 | out: lpFileInformation=0x260f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948)) returned 1
	[0170.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0170.087] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0170.087] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.087] GetFileType (hFile=0x318) returned 0x1
	[0170.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0170.087] GetFileType (hFile=0x318) returned 0x1
	[0170.087] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x948
	[0170.088] ReadFile (in: hFile=0x318, lpBuffer=0x260fc04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x260fc04*, lpNumberOfBytesRead=0x99f04c*=0x948, lpOverlapped=0x0) returned 1
	[0170.089] CloseHandle (hObject=0x318) returned 1
	[0170.089] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0170.089] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.090] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2610ca0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b340) returned 1
	[0170.090] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.090] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.090] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b100) returned 1
	[0170.090] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.090] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x2610d58*=0x1, dwFlags=0x0) returned 1
	[0170.090] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x2610d24, dwFlags=0x0) returned 1
	[0170.090] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2610d68*, pdwDataLen=0x99f054*=0x950, dwBufLen=0x950 | out: pbData=0x2610d68*, pdwDataLen=0x99f054*=0x950) returned 1
	[0170.090] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26116c4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26116c4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0170.090] CryptDestroyKey (hKey=0x82b100) returned 1
	[0170.090] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.090] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.090] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0170.091] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.092] GetFileType (hFile=0x318) returned 0x1
	[0170.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0170.092] GetFileType (hFile=0x318) returned 0x1
	[0170.092] WriteFile (in: hFile=0x318, lpBuffer=0x2611828*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2611828*, lpNumberOfBytesWritten=0x99f014*=0x950, lpOverlapped=0x0) returned 1
	[0170.093] CloseHandle (hObject=0x318) returned 1
	[0170.093] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml", lpFilePart=0x0) returned 0x5d
	[0170.094] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x8c
	[0170.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0170.094] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x9fb797d5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x950)) returned 1
	[0170.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0170.094] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0170.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFilePart=0x0) returned 0x75
	[0170.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0170.096] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x2612c3c | out: lpFileInformation=0x2612c3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be)) returned 1
	[0170.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0170.096] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFilePart=0x0) returned 0x75
	[0170.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0170.096] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.096] GetFileType (hFile=0x318) returned 0x1
	[0170.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0170.096] GetFileType (hFile=0x318) returned 0x1
	[0170.097] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xf36be
	[0170.099] ReadFile (in: hFile=0x318, lpBuffer=0x397bbc8, nNumberOfBytesToRead=0xf36be, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x397bbc8*, lpNumberOfBytesRead=0x99f04c*=0xf36be, lpOverlapped=0x0) returned 1
	[0170.124] CloseHandle (hObject=0x318) returned 1
	[0170.124] CryptDestroyKey (hKey=0x82b340) returned 1
	[0170.124] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.124] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2612fd4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b040) returned 1
	[0170.124] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.124] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.124] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0170.124] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.124] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x261308c*=0x1, dwFlags=0x0) returned 1
	[0170.125] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2613058, dwFlags=0x0) returned 1
	[0170.127] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a6f2a8*, pdwDataLen=0x99f054*=0xf36c0, dwBufLen=0xf36c0 | out: pbData=0x3a6f2a8*, pdwDataLen=0x99f054*=0xf36c0) returned 1
	[0170.128] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261309c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x261309c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0170.128] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0170.128] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.128] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.128] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFilePart=0x0) returned 0x75
	[0170.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0170.128] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.136] GetFileType (hFile=0x318) returned 0x1
	[0170.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0170.136] GetFileType (hFile=0x318) returned 0x1
	[0170.136] WriteFile (in: hFile=0x318, lpBuffer=0x3a6f2a8*, nNumberOfBytesToWrite=0xf36c0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x3a6f2a8*, lpNumberOfBytesWritten=0x99f040*=0xf36c0, lpOverlapped=0x0) returned 1
	[0170.161] CloseHandle (hObject=0x318) returned 1
	[0170.161] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFilePart=0x0) returned 0x75
	[0170.161] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa4
	[0170.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0170.161] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x9fc0ebfc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xf36c0)) returned 1
	[0170.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0170.161] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0170.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFilePart=0x0) returned 0x86
	[0170.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0170.179] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x26136f4 | out: lpFileInformation=0x26136f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000)) returned 1
	[0170.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0170.180] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFilePart=0x0) returned 0x86
	[0170.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0170.180] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.180] GetFileType (hFile=0x318) returned 0x1
	[0170.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0170.180] GetFileType (hFile=0x318) returned 0x1
	[0170.180] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x23000
	[0170.329] ReadFile (in: hFile=0x318, lpBuffer=0x34494c8, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesRead=0x99f04c*=0x23000, lpOverlapped=0x0) returned 1
	[0170.344] CloseHandle (hObject=0x318) returned 1
	[0170.344] CryptDestroyKey (hKey=0x82b040) returned 1
	[0170.344] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.344] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2604c30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0170.344] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.344] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.344] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b000) returned 1
	[0170.344] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.345] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x2604ce8*=0x1, dwFlags=0x0) returned 1
	[0170.345] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x2604cb4, dwFlags=0x0) returned 1
	[0170.346] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x346c4e8*, pdwDataLen=0x99f054*=0x23010, dwBufLen=0x23010 | out: pbData=0x346c4e8*, pdwDataLen=0x99f054*=0x23010) returned 1
	[0170.347] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2604cf8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2604cf8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0170.347] CryptDestroyKey (hKey=0x82b000) returned 1
	[0170.347] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.347] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.347] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFilePart=0x0) returned 0x86
	[0170.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0170.347] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.349] GetFileType (hFile=0x318) returned 0x1
	[0170.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0170.349] GetFileType (hFile=0x318) returned 0x1
	[0170.349] WriteFile (in: hFile=0x318, lpBuffer=0x346c4e8*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x346c4e8*, lpNumberOfBytesWritten=0x99f040*=0x23010, lpOverlapped=0x0) returned 1
	[0170.352] CloseHandle (hObject=0x318) returned 1
	[0170.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFilePart=0x0) returned 0x86
	[0170.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb5
	[0170.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0170.352] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x9fdd87da, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x23010)) returned 1
	[0170.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0170.352] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0170.353] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFilePart=0x0) returned 0x7a
	[0170.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0170.353] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x2605418 | out: lpFileInformation=0x2605418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124)) returned 1
	[0170.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0170.354] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFilePart=0x0) returned 0x7a
	[0170.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0170.354] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.354] GetFileType (hFile=0x318) returned 0x1
	[0170.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0170.354] GetFileType (hFile=0x318) returned 0x1
	[0170.354] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x588124
	[0170.368] ReadFile (in: hFile=0x318, lpBuffer=0x348f518, nNumberOfBytesToRead=0x588124, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x348f518*, lpNumberOfBytesRead=0x99f04c*=0x588124, lpOverlapped=0x0) returned 1
	[0170.643] CloseHandle (hObject=0x318) returned 1
	[0170.643] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0170.643] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.643] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26057c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0170.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.643] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0170.643] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0170.644] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2605880*=0x1, dwFlags=0x0) returned 1
	[0170.644] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x260584c, dwFlags=0x0) returned 1
	[0170.874] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a17658*, pdwDataLen=0x99f054*=0x588130, dwBufLen=0x588130 | out: pbData=0x3a17658*, pdwDataLen=0x99f054*=0x588130) returned 1
	[0170.878] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2604ba0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2604ba0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0170.879] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0170.879] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.879] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0170.879] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFilePart=0x0) returned 0x7a
	[0170.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0170.879] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0170.884] GetFileType (hFile=0x318) returned 0x1
	[0170.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0170.884] GetFileType (hFile=0x318) returned 0x1
	[0170.884] WriteFile (in: hFile=0x318, lpBuffer=0x3a17658*, nNumberOfBytesToWrite=0x588130, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x3a17658*, lpNumberOfBytesWritten=0x99f040*=0x588130, lpOverlapped=0x0) returned 1
	[0171.027] CloseHandle (hObject=0x318) returned 1
	[0171.027] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFilePart=0x0) returned 0x7a
	[0171.027] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa9
	[0171.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0171.027] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa0440cb4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x588130)) returned 1
	[0171.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0171.027] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0171.058] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFilePart=0x0) returned 0x8e
	[0171.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0171.058] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x2605228 | out: lpFileInformation=0x2605228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000)) returned 1
	[0171.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0171.062] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFilePart=0x0) returned 0x8e
	[0171.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0171.062] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0171.062] GetFileType (hFile=0x318) returned 0x1
	[0171.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0171.062] GetFileType (hFile=0x318) returned 0x1
	[0171.062] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x25000
	[0171.063] ReadFile (in: hFile=0x318, lpBuffer=0x34494c8, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesRead=0x99f04c*=0x25000, lpOverlapped=0x0) returned 1
	[0171.096] CloseHandle (hObject=0x318) returned 1
	[0171.097] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0171.097] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0171.097] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2613a84, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0171.097] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0171.097] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0171.097] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0171.097] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0171.097] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2613b3c*=0x1, dwFlags=0x0) returned 1
	[0171.097] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2613b08, dwFlags=0x0) returned 1
	[0171.099] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f9f7a8*, pdwDataLen=0x99f054*=0x25010, dwBufLen=0x25010 | out: pbData=0x3f9f7a8*, pdwDataLen=0x99f054*=0x25010) returned 1
	[0171.099] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2613b4c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2613b4c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0171.099] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0171.100] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0171.100] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0171.100] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFilePart=0x0) returned 0x8e
	[0171.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0171.100] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0171.102] GetFileType (hFile=0x318) returned 0x1
	[0171.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0171.102] GetFileType (hFile=0x318) returned 0x1
	[0171.102] WriteFile (in: hFile=0x318, lpBuffer=0x3f9f7a8*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x3f9f7a8*, lpNumberOfBytesWritten=0x99f040*=0x25010, lpOverlapped=0x0) returned 1
	[0171.105] CloseHandle (hObject=0x318) returned 1
	[0171.105] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFilePart=0x0) returned 0x8e
	[0171.105] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbd
	[0171.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0171.105] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0xa04ff877, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x25010)) returned 1
	[0171.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0171.106] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0171.106] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFilePart=0x0) returned 0x76
	[0171.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0171.107] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x26142c4 | out: lpFileInformation=0x26142c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb)) returned 1
	[0171.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0171.107] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFilePart=0x0) returned 0x76
	[0171.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0171.107] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0171.107] GetFileType (hFile=0x318) returned 0x1
	[0171.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0171.107] GetFileType (hFile=0x318) returned 0x1
	[0171.108] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x13babb
	[0171.111] ReadFile (in: hFile=0x318, lpBuffer=0x3fc47d8, nNumberOfBytesToRead=0x13babb, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x3fc47d8*, lpNumberOfBytesRead=0x99f04c*=0x13babb, lpOverlapped=0x0) returned 1
	[0171.193] CloseHandle (hObject=0x318) returned 1
	[0171.194] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0171.194] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0171.194] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2614664, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0171.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0171.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0171.194] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0171.194] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0171.194] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x261471c*=0x1, dwFlags=0x0) returned 1
	[0171.194] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26146e8, dwFlags=0x0) returned 1
	[0171.211] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x41002b0*, pdwDataLen=0x99f054*=0x13bac0, dwBufLen=0x13bac0 | out: pbData=0x41002b0*, pdwDataLen=0x99f054*=0x13bac0) returned 1
	[0171.212] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261472c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x261472c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0171.212] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0171.212] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0171.212] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0171.212] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFilePart=0x0) returned 0x76
	[0171.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0171.213] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0171.215] GetFileType (hFile=0x318) returned 0x1
	[0171.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0171.215] GetFileType (hFile=0x318) returned 0x1
	[0171.215] WriteFile (in: hFile=0x318, lpBuffer=0x41002b0*, nNumberOfBytesToWrite=0x13bac0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x41002b0*, lpNumberOfBytesWritten=0x99f040*=0x13bac0, lpOverlapped=0x0) returned 1
	[0171.253] CloseHandle (hObject=0x318) returned 1
	[0171.253] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFilePart=0x0) returned 0x76
	[0171.253] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa5
	[0171.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0171.253] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xa067d02e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13bac0)) returned 1
	[0171.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0171.253] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0171.328] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFilePart=0x0) returned 0x87
	[0171.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0171.328] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x2614d8c | out: lpFileInformation=0x2614d8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000)) returned 1
	[0171.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0171.329] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFilePart=0x0) returned 0x87
	[0171.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0171.329] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0171.329] GetFileType (hFile=0x318) returned 0x1
	[0171.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0171.329] GetFileType (hFile=0x318) returned 0x1
	[0171.329] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x24000
	[0171.330] ReadFile (in: hFile=0x318, lpBuffer=0x423bd90, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x423bd90*, lpNumberOfBytesRead=0x99f04c*=0x24000, lpOverlapped=0x0) returned 1
	[0171.390] CloseHandle (hObject=0x318) returned 1
	[0171.390] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0171.390] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0171.390] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26151ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b340) returned 1
	[0171.390] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0171.390] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0171.390] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b5c0) returned 1
	[0171.390] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0171.390] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2615264*=0x1, dwFlags=0x0) returned 1
	[0171.390] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2615230, dwFlags=0x0) returned 1
	[0171.392] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x425fdb0*, pdwDataLen=0x99f054*=0x24010, dwBufLen=0x24010 | out: pbData=0x425fdb0*, pdwDataLen=0x99f054*=0x24010) returned 1
	[0171.392] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2615274*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2615274*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0171.392] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0171.392] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0171.392] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0171.393] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFilePart=0x0) returned 0x87
	[0171.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0171.393] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0171.395] GetFileType (hFile=0x318) returned 0x1
	[0171.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0171.395] GetFileType (hFile=0x318) returned 0x1
	[0171.395] WriteFile (in: hFile=0x318, lpBuffer=0x425fdb0*, nNumberOfBytesToWrite=0x24010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x425fdb0*, lpNumberOfBytesWritten=0x99f040*=0x24010, lpOverlapped=0x0) returned 1
	[0171.398] CloseHandle (hObject=0x318) returned 1
	[0171.398] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFilePart=0x0) returned 0x87
	[0171.398] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb6
	[0171.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0171.398] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xa07d44d5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x24010)) returned 1
	[0171.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0171.398] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0171.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFilePart=0x0) returned 0x79
	[0171.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0171.399] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x26159a0 | out: lpFileInformation=0x26159a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e)) returned 1
	[0171.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0171.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFilePart=0x0) returned 0x79
	[0171.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0171.400] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0171.400] GetFileType (hFile=0x318) returned 0x1
	[0171.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0171.400] GetFileType (hFile=0x318) returned 0x1
	[0171.400] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x4f699e
	[0171.426] ReadFile (in: hFile=0x318, lpBuffer=0x5901018, nNumberOfBytesToRead=0x4f699e, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x5901018*, lpNumberOfBytesRead=0x99f04c*=0x4f699e, lpOverlapped=0x0) returned 1
	[0171.877] CloseHandle (hObject=0x318) returned 1
	[0171.877] CryptDestroyKey (hKey=0x82b340) returned 1
	[0171.877] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0171.877] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2615d48, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b000) returned 1
	[0171.877] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0171.877] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0171.878] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b2c0) returned 1
	[0171.878] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0171.878] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x2615e00*=0x1, dwFlags=0x0) returned 1
	[0171.878] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x2615dcc, dwFlags=0x0) returned 1
	[0171.980] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df79d8*, pdwDataLen=0x99f054*=0x4f69a0, dwBufLen=0x4f69a0 | out: pbData=0x5df79d8*, pdwDataLen=0x99f054*=0x4f69a0) returned 1
	[0171.984] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2615e10*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2615e10*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0171.984] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0171.984] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0171.984] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0171.984] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFilePart=0x0) returned 0x79
	[0171.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0171.984] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0171.994] GetFileType (hFile=0x318) returned 0x1
	[0171.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0171.994] GetFileType (hFile=0x318) returned 0x1
	[0171.994] WriteFile (in: hFile=0x318, lpBuffer=0x5df79d8*, nNumberOfBytesToWrite=0x4f69a0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x5df79d8*, lpNumberOfBytesWritten=0x99f040*=0x4f69a0, lpOverlapped=0x0) returned 1
	[0172.127] CloseHandle (hObject=0x318) returned 1
	[0172.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFilePart=0x0) returned 0x79
	[0172.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa8
	[0172.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0172.127] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xa0ec11dc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4f69a0)) returned 1
	[0172.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0172.127] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0172.130] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFilePart=0x0) returned 0x8d
	[0172.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0172.130] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x2616490 | out: lpFileInformation=0x2616490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000)) returned 1
	[0172.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0172.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFilePart=0x0) returned 0x8d
	[0172.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0172.131] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0172.131] GetFileType (hFile=0x318) returned 0x1
	[0172.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0172.131] GetFileType (hFile=0x318) returned 0x1
	[0172.131] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x23000
	[0172.132] ReadFile (in: hFile=0x318, lpBuffer=0x4283de0, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x4283de0*, lpNumberOfBytesRead=0x99f04c*=0x23000, lpOverlapped=0x0) returned 1
	[0172.146] CloseHandle (hObject=0x318) returned 1
	[0172.146] CryptDestroyKey (hKey=0x82b000) returned 1
	[0172.146] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0172.146] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26168d8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0172.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0172.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0172.146] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b0c0) returned 1
	[0172.146] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0172.146] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x2616990*=0x1, dwFlags=0x0) returned 1
	[0172.146] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x261695c, dwFlags=0x0) returned 1
	[0172.148] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x42a6e00*, pdwDataLen=0x99f054*=0x23010, dwBufLen=0x23010 | out: pbData=0x42a6e00*, pdwDataLen=0x99f054*=0x23010) returned 1
	[0172.148] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26169a0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26169a0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0172.148] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0172.148] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0172.148] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0172.158] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFilePart=0x0) returned 0x8d
	[0172.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0172.159] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0172.161] GetFileType (hFile=0x318) returned 0x1
	[0172.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0172.161] GetFileType (hFile=0x318) returned 0x1
	[0172.161] WriteFile (in: hFile=0x318, lpBuffer=0x42a6e00*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x42a6e00*, lpNumberOfBytesWritten=0x99f040*=0x23010, lpOverlapped=0x0) returned 1
	[0172.164] CloseHandle (hObject=0x318) returned 1
	[0172.164] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFilePart=0x0) returned 0x8d
	[0172.164] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbc
	[0172.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0172.164] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xa0f338fd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x23010)) returned 1
	[0172.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0172.164] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0172.166] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFilePart=0x0) returned 0x78
	[0172.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0172.166] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x2617110 | out: lpFileInformation=0x2617110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x165257)) returned 1
	[0172.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0172.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFilePart=0x0) returned 0x78
	[0172.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0172.167] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0172.167] GetFileType (hFile=0x318) returned 0x1
	[0172.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0172.167] GetFileType (hFile=0x318) returned 0x1
	[0172.167] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x165257
	[0172.171] ReadFile (in: hFile=0x318, lpBuffer=0x42c9e30, nNumberOfBytesToRead=0x165257, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x42c9e30*, lpNumberOfBytesRead=0x99f04c*=0x165257, lpOverlapped=0x0) returned 1
	[0172.243] CloseHandle (hObject=0x318) returned 1
	[0172.243] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0172.244] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0172.244] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26174b8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b4c0) returned 1
	[0172.244] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0172.244] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0172.244] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0172.244] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0172.244] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2617570*=0x1, dwFlags=0x0) returned 1
	[0172.244] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x261753c, dwFlags=0x0) returned 1
	[0172.376] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x62ee398*, pdwDataLen=0x99f054*=0x165260, dwBufLen=0x165260 | out: pbData=0x62ee398*, pdwDataLen=0x99f054*=0x165260) returned 1
	[0172.378] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2604ba0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2604ba0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0172.378] CryptDestroyKey (hKey=0x82b540) returned 1
	[0172.378] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0172.378] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0172.378] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFilePart=0x0) returned 0x78
	[0172.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0172.378] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0172.383] GetFileType (hFile=0x318) returned 0x1
	[0172.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0172.383] GetFileType (hFile=0x318) returned 0x1
	[0172.383] WriteFile (in: hFile=0x318, lpBuffer=0x62ee398*, nNumberOfBytesToWrite=0x165260, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x62ee398*, lpNumberOfBytesWritten=0x99f040*=0x165260, lpOverlapped=0x0) returned 1
	[0172.465] CloseHandle (hObject=0x318) returned 1
	[0172.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFilePart=0x0) returned 0x78
	[0172.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa7
	[0172.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0172.465] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xa120b0a2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x165260)) returned 1
	[0172.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0172.466] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0172.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFilePart=0x0) returned 0x89
	[0172.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0172.468] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x2605214 | out: lpFileInformation=0x2605214*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000)) returned 1
	[0172.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0172.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFilePart=0x0) returned 0x89
	[0172.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0172.469] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0172.469] GetFileType (hFile=0x318) returned 0x1
	[0172.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0172.469] GetFileType (hFile=0x318) returned 0x1
	[0172.469] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x24000
	[0172.470] ReadFile (in: hFile=0x318, lpBuffer=0x34494c8, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesRead=0x99f04c*=0x24000, lpOverlapped=0x0) returned 1
	[0172.502] CloseHandle (hObject=0x318) returned 1
	[0172.502] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0172.502] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0172.503] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260563c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b300) returned 1
	[0172.503] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0172.503] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0172.503] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b440) returned 1
	[0172.503] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0172.503] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26056f4*=0x1, dwFlags=0x0) returned 1
	[0172.503] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26056c0, dwFlags=0x0) returned 1
	[0172.503] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x346d4e8*, pdwDataLen=0x99f054*=0x24010, dwBufLen=0x24010 | out: pbData=0x346d4e8*, pdwDataLen=0x99f054*=0x24010) returned 1
	[0172.504] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2605704*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2605704*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0172.504] CryptDestroyKey (hKey=0x82b440) returned 1
	[0172.504] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0172.504] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0172.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFilePart=0x0) returned 0x89
	[0172.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0172.504] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0172.506] GetFileType (hFile=0x318) returned 0x1
	[0172.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0172.506] GetFileType (hFile=0x318) returned 0x1
	[0172.506] WriteFile (in: hFile=0x318, lpBuffer=0x346d4e8*, nNumberOfBytesToWrite=0x24010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x346d4e8*, lpNumberOfBytesWritten=0x99f040*=0x24010, lpOverlapped=0x0) returned 1
	[0172.509] CloseHandle (hObject=0x318) returned 1
	[0172.510] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFilePart=0x0) returned 0x89
	[0172.510] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb8
	[0172.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0172.510] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xa127d6d3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x24010)) returned 1
	[0172.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0172.510] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0172.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFilePart=0x0) returned 0x7a
	[0172.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0172.511] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x2605e44 | out: lpFileInformation=0x2605e44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abe5b00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x8abe5b00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x8abe5b00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x554520)) returned 1
	[0172.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0172.512] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFilePart=0x0) returned 0x7a
	[0172.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0172.512] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0172.512] GetFileType (hFile=0x318) returned 0x1
	[0172.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0172.512] GetFileType (hFile=0x318) returned 0x1
	[0172.512] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x554520
	[0172.530] ReadFile (in: hFile=0x318, lpBuffer=0x3491518, nNumberOfBytesToRead=0x554520, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x3491518*, lpNumberOfBytesRead=0x99f04c*=0x554520, lpOverlapped=0x0) returned 1
	[0172.738] CloseHandle (hObject=0x318) returned 1
	[0172.738] CryptDestroyKey (hKey=0x82b300) returned 1
	[0172.738] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0172.738] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26061f4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0172.738] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0172.738] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0172.738] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0172.738] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0172.738] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26062ac*=0x1, dwFlags=0x0) returned 1
	[0172.738] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2606278, dwFlags=0x0) returned 1
	[0173.057] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39e5a58*, pdwDataLen=0x99f054*=0x554530, dwBufLen=0x554530 | out: pbData=0x39e5a58*, pdwDataLen=0x99f054*=0x554530) returned 1
	[0173.061] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2604ba0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2604ba0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0173.061] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0173.061] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0173.061] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0173.061] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFilePart=0x0) returned 0x7a
	[0173.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0173.062] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0173.066] GetFileType (hFile=0x318) returned 0x1
	[0173.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0173.066] GetFileType (hFile=0x318) returned 0x1
	[0173.066] WriteFile (in: hFile=0x318, lpBuffer=0x39e5a58*, nNumberOfBytesToWrite=0x554530, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x39e5a58*, lpNumberOfBytesWritten=0x99f040*=0x554530, lpOverlapped=0x0) returned 1
	[0173.231] CloseHandle (hObject=0x318) returned 1
	[0173.231] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFilePart=0x0) returned 0x7a
	[0173.231] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa9
	[0173.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0173.231] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abe5b00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x8abe5b00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0xa196691e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x554530)) returned 1
	[0173.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0173.231] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0173.234] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFilePart=0x0) returned 0x8e
	[0173.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0173.234] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x2605228 | out: lpFileInformation=0x2605228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000)) returned 1
	[0173.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0173.235] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFilePart=0x0) returned 0x8e
	[0173.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0173.235] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0173.235] GetFileType (hFile=0x318) returned 0x1
	[0173.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0173.235] GetFileType (hFile=0x318) returned 0x1
	[0173.235] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x23000
	[0173.236] ReadFile (in: hFile=0x318, lpBuffer=0x34494c8, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesRead=0x99f04c*=0x23000, lpOverlapped=0x0) returned 1
	[0173.295] CloseHandle (hObject=0x318) returned 1
	[0173.295] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0173.295] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0173.295] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2605678, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0173.295] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0173.295] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0173.295] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b480) returned 1
	[0173.295] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0173.295] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2605730*=0x1, dwFlags=0x0) returned 1
	[0173.295] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26056fc, dwFlags=0x0) returned 1
	[0173.296] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x346c4e8*, pdwDataLen=0x99f054*=0x23010, dwBufLen=0x23010 | out: pbData=0x346c4e8*, pdwDataLen=0x99f054*=0x23010) returned 1
	[0173.296] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2605740*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2605740*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0173.296] CryptDestroyKey (hKey=0x82b480) returned 1
	[0173.296] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0173.296] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0173.296] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFilePart=0x0) returned 0x8e
	[0173.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0173.296] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0173.298] GetFileType (hFile=0x318) returned 0x1
	[0173.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0173.298] GetFileType (hFile=0x318) returned 0x1
	[0173.298] WriteFile (in: hFile=0x318, lpBuffer=0x346c4e8*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x346c4e8*, lpNumberOfBytesWritten=0x99f040*=0x23010, lpOverlapped=0x0) returned 1
	[0173.301] CloseHandle (hObject=0x318) returned 1
	[0173.301] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFilePart=0x0) returned 0x8e
	[0173.301] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbd
	[0173.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0173.301] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0xa19ff260, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x23010)) returned 1
	[0173.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0173.302] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0173.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFilePart=0x0) returned 0x77
	[0173.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0173.303] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x2605ff4 | out: lpFileInformation=0x2605ff4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d2e00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x898d2e00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x898d2e00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a)) returned 1
	[0173.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0173.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFilePart=0x0) returned 0x77
	[0173.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0173.304] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0173.304] GetFileType (hFile=0x318) returned 0x1
	[0173.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0173.304] GetFileType (hFile=0x318) returned 0x1
	[0173.304] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xfc90a
	[0173.306] ReadFile (in: hFile=0x318, lpBuffer=0x3f39fa8, nNumberOfBytesToRead=0xfc90a, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x3f39fa8*, lpNumberOfBytesRead=0x99f04c*=0xfc90a, lpOverlapped=0x0) returned 1
	[0173.360] CloseHandle (hObject=0x318) returned 1
	[0173.360] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0173.360] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0173.361] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2617788, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0173.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0173.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0173.361] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0173.361] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0173.361] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2617840*=0x1, dwFlags=0x0) returned 1
	[0173.361] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x261780c, dwFlags=0x0) returned 1
	[0173.375] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40368d0*, pdwDataLen=0x99f054*=0xfc910, dwBufLen=0xfc910 | out: pbData=0x40368d0*, pdwDataLen=0x99f054*=0xfc910) returned 1
	[0173.376] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2617850*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2617850*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0173.376] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0173.376] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0173.376] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0173.376] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFilePart=0x0) returned 0x77
	[0173.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0173.376] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0173.385] GetFileType (hFile=0x318) returned 0x1
	[0173.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0173.385] GetFileType (hFile=0x318) returned 0x1
	[0173.386] WriteFile (in: hFile=0x318, lpBuffer=0x40368d0*, nNumberOfBytesToWrite=0xfc910, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x40368d0*, lpNumberOfBytesWritten=0x99f040*=0xfc910, lpOverlapped=0x0) returned 1
	[0173.461] CloseHandle (hObject=0x318) returned 1
	[0173.461] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFilePart=0x0) returned 0x77
	[0173.461] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa6
	[0173.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0173.461] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d2e00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x898d2e00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0xa1b7c9f2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xfc910)) returned 1
	[0173.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0173.461] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0173.464] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFilePart=0x0) returned 0x88
	[0173.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0173.464] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x2617ebc | out: lpFileInformation=0x2617ebc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000)) returned 1
	[0173.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0173.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFilePart=0x0) returned 0x88
	[0173.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0173.466] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0173.466] GetFileType (hFile=0x318) returned 0x1
	[0173.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0173.466] GetFileType (hFile=0x318) returned 0x1
	[0173.466] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x23000
	[0173.466] ReadFile (in: hFile=0x318, lpBuffer=0x4133200, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x4133200*, lpNumberOfBytesRead=0x99f04c*=0x23000, lpOverlapped=0x0) returned 1
	[0173.497] CloseHandle (hObject=0x318) returned 1
	[0173.497] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0173.497] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0173.497] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26182e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0173.497] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0173.497] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0173.497] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b480) returned 1
	[0173.497] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0173.497] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x261839c*=0x1, dwFlags=0x0) returned 1
	[0173.497] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2618368, dwFlags=0x0) returned 1
	[0173.499] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4156220*, pdwDataLen=0x99f054*=0x23010, dwBufLen=0x23010 | out: pbData=0x4156220*, pdwDataLen=0x99f054*=0x23010) returned 1
	[0173.500] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26183ac*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26183ac*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0173.500] CryptDestroyKey (hKey=0x82b480) returned 1
	[0173.500] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0173.500] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0173.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFilePart=0x0) returned 0x88
	[0173.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0173.500] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0173.502] GetFileType (hFile=0x318) returned 0x1
	[0173.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0173.502] GetFileType (hFile=0x318) returned 0x1
	[0173.502] WriteFile (in: hFile=0x318, lpBuffer=0x4156220*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x4156220*, lpNumberOfBytesWritten=0x99f040*=0x23010, lpOverlapped=0x0) returned 1
	[0173.505] CloseHandle (hObject=0x318) returned 1
	[0173.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFilePart=0x0) returned 0x88
	[0173.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb7
	[0173.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0173.505] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0xa1bef048, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x23010)) returned 1
	[0173.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0173.506] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0173.506] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFilePart=0x0) returned 0x78
	[0173.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0173.506] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x2618ae0 | out: lpFileInformation=0x2618ae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1a600, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x98d1a600, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x98d1a600, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418)) returned 1
	[0173.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0173.507] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFilePart=0x0) returned 0x78
	[0173.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0173.507] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0173.507] GetFileType (hFile=0x318) returned 0x1
	[0173.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0173.508] GetFileType (hFile=0x318) returned 0x1
	[0173.508] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x4ea418
	[0173.520] ReadFile (in: hFile=0x318, lpBuffer=0x6901018, nNumberOfBytesToRead=0x4ea418, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x6901018*, lpNumberOfBytesRead=0x99f04c*=0x4ea418, lpOverlapped=0x0) returned 1
	[0173.746] CloseHandle (hObject=0x318) returned 1
	[0173.746] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0173.746] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0173.746] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2618e88, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0173.746] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0173.746] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0173.746] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b080) returned 1
	[0173.746] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0173.746] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2618f40*=0x1, dwFlags=0x0) returned 1
	[0173.746] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2618f0c, dwFlags=0x0) returned 1
	[0174.096] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x34494c8*, pdwDataLen=0x99f054*=0x4ea420, dwBufLen=0x4ea420 | out: pbData=0x34494c8*, pdwDataLen=0x99f054*=0x4ea420) returned 1
	[0174.100] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2604ba0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2604ba0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0174.100] CryptDestroyKey (hKey=0x82b080) returned 1
	[0174.100] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.100] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.100] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFilePart=0x0) returned 0x78
	[0174.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0174.100] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0174.194] GetFileType (hFile=0x318) returned 0x1
	[0174.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0174.194] GetFileType (hFile=0x318) returned 0x1
	[0174.194] WriteFile (in: hFile=0x318, lpBuffer=0x34494c8*, nNumberOfBytesToWrite=0x4ea420, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesWritten=0x99f040*=0x4ea420, lpOverlapped=0x0) returned 1
	[0174.347] CloseHandle (hObject=0x318) returned 1
	[0174.347] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFilePart=0x0) returned 0x78
	[0174.347] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa7
	[0174.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0174.347] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1a600, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x98d1a600, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa23fafdf, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4ea420)) returned 1
	[0174.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0174.348] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0174.359] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFilePart=0x0) returned 0x8c
	[0174.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0174.359] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x2605214 | out: lpFileInformation=0x2605214*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000)) returned 1
	[0174.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0174.361] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFilePart=0x0) returned 0x8c
	[0174.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0174.361] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0174.361] GetFileType (hFile=0x318) returned 0x1
	[0174.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0174.361] GetFileType (hFile=0x318) returned 0x1
	[0174.361] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x25000
	[0174.362] ReadFile (in: hFile=0x318, lpBuffer=0x3933908, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x3933908*, lpNumberOfBytesRead=0x99f04c*=0x25000, lpOverlapped=0x0) returned 1
	[0174.393] CloseHandle (hObject=0x318) returned 1
	[0174.393] CryptDestroyKey (hKey=0x82b540) returned 1
	[0174.393] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.393] CryptImportKey (in: hProv=0x7f93c0, pbData=0x260565c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b300) returned 1
	[0174.393] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.393] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.393] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0174.393] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.393] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2605714*=0x1, dwFlags=0x0) returned 1
	[0174.393] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26056e0, dwFlags=0x0) returned 1
	[0174.395] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3958928*, pdwDataLen=0x99f054*=0x25010, dwBufLen=0x25010 | out: pbData=0x3958928*, pdwDataLen=0x99f054*=0x25010) returned 1
	[0174.395] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2605724*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2605724*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0174.395] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0174.395] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.395] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.395] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFilePart=0x0) returned 0x8c
	[0174.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0174.395] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0174.397] GetFileType (hFile=0x318) returned 0x1
	[0174.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0174.397] GetFileType (hFile=0x318) returned 0x1
	[0174.397] WriteFile (in: hFile=0x318, lpBuffer=0x3958928*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x3958928*, lpNumberOfBytesWritten=0x99f040*=0x25010, lpOverlapped=0x0) returned 1
	[0174.400] CloseHandle (hObject=0x318) returned 1
	[0174.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFilePart=0x0) returned 0x8c
	[0174.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbb
	[0174.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0174.400] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0xa246d700, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x25010)) returned 1
	[0174.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0174.400] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0174.401] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFilePart=0x0) returned 0x75
	[0174.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0174.401] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x2605e88 | out: lpFileInformation=0x2605e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966f4c00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x966f4c00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x966f4c00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1)) returned 1
	[0174.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0174.401] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFilePart=0x0) returned 0x75
	[0174.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0174.402] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0174.402] GetFileType (hFile=0x318) returned 0x1
	[0174.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0174.402] GetFileType (hFile=0x318) returned 0x1
	[0174.402] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xc89b1
	[0174.404] ReadFile (in: hFile=0x318, lpBuffer=0x397d958, nNumberOfBytesToRead=0xc89b1, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x397d958*, lpNumberOfBytesRead=0x99f04c*=0xc89b1, lpOverlapped=0x0) returned 1
	[0174.466] CloseHandle (hObject=0x318) returned 1
	[0174.467] CryptDestroyKey (hKey=0x82b300) returned 1
	[0174.467] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.467] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2606220, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b5c0) returned 1
	[0174.467] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.467] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.467] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b0c0) returned 1
	[0174.467] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.467] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x26062d8*=0x1, dwFlags=0x0) returned 1
	[0174.467] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x26062a4, dwFlags=0x0) returned 1
	[0174.476] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a46328*, pdwDataLen=0x99f054*=0xc89c0, dwBufLen=0xc89c0 | out: pbData=0x3a46328*, pdwDataLen=0x99f054*=0xc89c0) returned 1
	[0174.477] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26062e8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26062e8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0174.477] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0174.477] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.477] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.477] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFilePart=0x0) returned 0x75
	[0174.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0174.477] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0174.484] GetFileType (hFile=0x318) returned 0x1
	[0174.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0174.484] GetFileType (hFile=0x318) returned 0x1
	[0174.484] WriteFile (in: hFile=0x318, lpBuffer=0x3a46328*, nNumberOfBytesToWrite=0xc89c0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x3a46328*, lpNumberOfBytesWritten=0x99f040*=0xc89c0, lpOverlapped=0x0) returned 1
	[0174.508] CloseHandle (hObject=0x318) returned 1
	[0174.509] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFilePart=0x0) returned 0x75
	[0174.509] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa4
	[0174.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0174.509] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966f4c00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x966f4c00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa257875f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xc89c0)) returned 1
	[0174.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0174.509] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0174.512] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFilePart=0x0) returned 0x86
	[0174.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0174.512] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x2606940 | out: lpFileInformation=0x2606940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000)) returned 1
	[0174.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0174.512] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFilePart=0x0) returned 0x86
	[0174.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0174.512] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0174.513] GetFileType (hFile=0x318) returned 0x1
	[0174.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0174.513] GetFileType (hFile=0x318) returned 0x1
	[0174.513] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x25000
	[0174.513] ReadFile (in: hFile=0x318, lpBuffer=0x3b0ed08, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x3b0ed08*, lpNumberOfBytesRead=0x99f04c*=0x25000, lpOverlapped=0x0) returned 1
	[0174.549] CloseHandle (hObject=0x318) returned 1
	[0174.549] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0174.549] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.549] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2606d60, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0174.549] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.549] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.549] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b400) returned 1
	[0174.549] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.549] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2606e18*=0x1, dwFlags=0x0) returned 1
	[0174.549] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2606de4, dwFlags=0x0) returned 1
	[0174.551] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b33d28*, pdwDataLen=0x99f054*=0x25010, dwBufLen=0x25010 | out: pbData=0x3b33d28*, pdwDataLen=0x99f054*=0x25010) returned 1
	[0174.552] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2606e28*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2606e28*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0174.552] CryptDestroyKey (hKey=0x82b400) returned 1
	[0174.552] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.552] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.552] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFilePart=0x0) returned 0x86
	[0174.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0174.552] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0174.554] GetFileType (hFile=0x318) returned 0x1
	[0174.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0174.554] GetFileType (hFile=0x318) returned 0x1
	[0174.554] WriteFile (in: hFile=0x318, lpBuffer=0x3b33d28*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x3b33d28*, lpNumberOfBytesWritten=0x99f040*=0x25010, lpOverlapped=0x0) returned 1
	[0174.557] CloseHandle (hObject=0x318) returned 1
	[0174.557] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFilePart=0x0) returned 0x86
	[0174.557] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb5
	[0174.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0174.557] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0xa25eaea7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x25010)) returned 1
	[0174.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0174.557] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0174.558] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFilePart=0x0) returned 0x77
	[0174.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0174.558] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x2607548 | out: lpFileInformation=0x2607548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bd6800, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xa4bd6800, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa4bd6800, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25)) returned 1
	[0174.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0174.559] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFilePart=0x0) returned 0x77
	[0174.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0174.559] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0174.559] GetFileType (hFile=0x318) returned 0x1
	[0174.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0174.559] GetFileType (hFile=0x318) returned 0x1
	[0174.559] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xc5b25
	[0174.561] ReadFile (in: hFile=0x318, lpBuffer=0x3b58d58, nNumberOfBytesToRead=0xc5b25, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x3b58d58*, lpNumberOfBytesRead=0x99f04c*=0xc5b25, lpOverlapped=0x0) returned 1
	[0174.605] CloseHandle (hObject=0x318) returned 1
	[0174.605] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0174.605] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.605] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26078e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b340) returned 1
	[0174.605] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.605] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.605] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b100) returned 1
	[0174.606] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.606] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26079a0*=0x1, dwFlags=0x0) returned 1
	[0174.606] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x260796c, dwFlags=0x0) returned 1
	[0174.615] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c1e8a0*, pdwDataLen=0x99f054*=0xc5b30, dwBufLen=0xc5b30 | out: pbData=0x3c1e8a0*, pdwDataLen=0x99f054*=0xc5b30) returned 1
	[0174.616] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26079b0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26079b0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0174.616] CryptDestroyKey (hKey=0x82b100) returned 1
	[0174.616] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.616] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.616] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFilePart=0x0) returned 0x77
	[0174.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0174.616] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0174.623] GetFileType (hFile=0x318) returned 0x1
	[0174.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0174.623] GetFileType (hFile=0x318) returned 0x1
	[0174.623] WriteFile (in: hFile=0x318, lpBuffer=0x3c1e8a0*, nNumberOfBytesToWrite=0xc5b30, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x3c1e8a0*, lpNumberOfBytesWritten=0x99f040*=0xc5b30, lpOverlapped=0x0) returned 1
	[0174.644] CloseHandle (hObject=0x318) returned 1
	[0174.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFilePart=0x0) returned 0x77
	[0174.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa6
	[0174.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0174.644] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bd6800, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xa4bd6800, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa26cfccb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xc5b30)) returned 1
	[0174.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0174.645] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0174.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFilePart=0x0) returned 0x88
	[0174.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0174.648] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x260801c | out: lpFileInformation=0x260801c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000)) returned 1
	[0174.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0174.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFilePart=0x0) returned 0x88
	[0174.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0174.649] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0174.649] GetFileType (hFile=0x318) returned 0x1
	[0174.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0174.649] GetFileType (hFile=0x318) returned 0x1
	[0174.649] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x25000
	[0174.899] ReadFile (in: hFile=0x318, lpBuffer=0x34494c8, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesRead=0x99f04c*=0x25000, lpOverlapped=0x0) returned 1
	[0174.915] CloseHandle (hObject=0x318) returned 1
	[0174.915] CryptDestroyKey (hKey=0x82b340) returned 1
	[0174.915] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.916] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2604c30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b040) returned 1
	[0174.916] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.916] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.916] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0174.916] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0174.916] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2604ce8*=0x1, dwFlags=0x0) returned 1
	[0174.916] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2604cb4, dwFlags=0x0) returned 1
	[0174.919] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x346e4e8*, pdwDataLen=0x99f054*=0x25010, dwBufLen=0x25010 | out: pbData=0x346e4e8*, pdwDataLen=0x99f054*=0x25010) returned 1
	[0174.919] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2604cf8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2604cf8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0174.919] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0174.919] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.919] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0174.919] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFilePart=0x0) returned 0x88
	[0174.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0174.919] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0174.921] GetFileType (hFile=0x318) returned 0x1
	[0174.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0174.921] GetFileType (hFile=0x318) returned 0x1
	[0174.921] WriteFile (in: hFile=0x318, lpBuffer=0x346e4e8*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x346e4e8*, lpNumberOfBytesWritten=0x99f040*=0x25010, lpOverlapped=0x0) returned 1
	[0174.925] CloseHandle (hObject=0x318) returned 1
	[0174.925] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFilePart=0x0) returned 0x88
	[0174.925] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xb7
	[0174.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0174.925] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0xa297e68a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x25010)) returned 1
	[0174.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0174.925] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0174.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFilePart=0x0) returned 0x7b
	[0174.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0174.927] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x260542c | out: lpFileInformation=0x260542c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe90b3300, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe90b3300, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe90b3300, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5)) returned 1
	[0174.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0174.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFilePart=0x0) returned 0x7b
	[0174.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0174.927] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0174.928] GetFileType (hFile=0x318) returned 0x1
	[0174.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0174.928] GetFileType (hFile=0x318) returned 0x1
	[0174.928] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x59bde5
	[0174.943] ReadFile (in: hFile=0x318, lpBuffer=0x3493518, nNumberOfBytesToRead=0x59bde5, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x3493518*, lpNumberOfBytesRead=0x99f04c*=0x59bde5, lpOverlapped=0x0) returned 1
	[0175.218] CloseHandle (hObject=0x318) returned 1
	[0175.218] CryptDestroyKey (hKey=0x82b040) returned 1
	[0175.218] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0175.218] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26057dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0175.218] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0175.219] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0175.219] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0175.219] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0175.219] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2605894*=0x1, dwFlags=0x0) returned 1
	[0175.219] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2605860, dwFlags=0x0) returned 1
	[0175.525] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a2f320*, pdwDataLen=0x99f054*=0x59bdf0, dwBufLen=0x59bdf0 | out: pbData=0x3a2f320*, pdwDataLen=0x99f054*=0x59bdf0) returned 1
	[0175.551] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2604ba0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2604ba0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0175.551] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0175.551] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0175.551] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0175.551] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFilePart=0x0) returned 0x7b
	[0175.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0175.551] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0175.552] GetFileType (hFile=0x318) returned 0x1
	[0175.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0175.552] GetFileType (hFile=0x318) returned 0x1
	[0175.552] WriteFile (in: hFile=0x318, lpBuffer=0x3a2f320*, nNumberOfBytesToWrite=0x59bdf0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x3a2f320*, lpNumberOfBytesWritten=0x99f040*=0x59bdf0, lpOverlapped=0x0) returned 1
	[0175.747] CloseHandle (hObject=0x318) returned 1
	[0175.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFilePart=0x0) returned 0x7b
	[0175.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xaa
	[0175.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0175.748] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe90b3300, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe90b3300, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xa3164464, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x59bdf0)) returned 1
	[0175.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0175.748] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0175.775] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFilePart=0x0) returned 0x8f
	[0175.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0175.776] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x2605234 | out: lpFileInformation=0x2605234*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000)) returned 1
	[0175.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0175.776] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFilePart=0x0) returned 0x8f
	[0175.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0175.776] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0175.777] GetFileType (hFile=0x318) returned 0x1
	[0175.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0175.777] GetFileType (hFile=0x318) returned 0x1
	[0175.777] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x23000
	[0175.778] ReadFile (in: hFile=0x318, lpBuffer=0x34494c8, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x34494c8*, lpNumberOfBytesRead=0x99f04c*=0x23000, lpOverlapped=0x0) returned 1
	[0175.791] CloseHandle (hObject=0x318) returned 1
	[0175.791] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0175.791] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0175.792] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2618f50, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0175.792] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0175.792] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0175.792] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0175.792] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0175.792] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2619008*=0x1, dwFlags=0x0) returned 1
	[0175.792] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2618fd4, dwFlags=0x0) returned 1
	[0175.792] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x346c4e8*, pdwDataLen=0x99f054*=0x23010, dwBufLen=0x23010 | out: pbData=0x346c4e8*, pdwDataLen=0x99f054*=0x23010) returned 1
	[0175.793] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2619018*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2619018*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0175.793] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0175.793] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0175.793] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0175.793] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFilePart=0x0) returned 0x8f
	[0175.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0175.793] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0175.795] GetFileType (hFile=0x318) returned 0x1
	[0175.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0175.795] GetFileType (hFile=0x318) returned 0x1
	[0175.795] WriteFile (in: hFile=0x318, lpBuffer=0x346c4e8*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x346c4e8*, lpNumberOfBytesWritten=0x99f040*=0x23010, lpOverlapped=0x0) returned 1
	[0175.799] CloseHandle (hObject=0x318) returned 1
	[0175.799] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFilePart=0x0) returned 0x8f
	[0175.799] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0175.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0175.799] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xa31d6ad0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x23010)) returned 1
	[0175.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0175.799] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0175.800] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFilePart=0x0) returned 0x78
	[0175.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0175.800] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x261979c | out: lpFileInformation=0x261979c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6151ff00, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x6151ff00, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x6151ff00, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520)) returned 1
	[0175.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0175.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFilePart=0x0) returned 0x78
	[0175.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0175.801] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0175.801] GetFileType (hFile=0x318) returned 0x1
	[0175.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0175.801] GetFileType (hFile=0x318) returned 0x1
	[0175.801] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x4b4520
	[0175.874] ReadFile (in: hFile=0x318, lpBuffer=0x5941018, nNumberOfBytesToRead=0x4b4520, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x5941018*, lpNumberOfBytesRead=0x99f04c*=0x4b4520, lpOverlapped=0x0) returned 1
	[0176.073] CloseHandle (hObject=0x318) returned 1
	[0176.073] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0176.073] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.073] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2619b44, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b5c0) returned 1
	[0176.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.073] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0176.073] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.073] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2619bfc*=0x1, dwFlags=0x0) returned 1
	[0176.073] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2619bc8, dwFlags=0x0) returned 1
	[0176.174] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df5558*, pdwDataLen=0x99f054*=0x4b4530, dwBufLen=0x4b4530 | out: pbData=0x5df5558*, pdwDataLen=0x99f054*=0x4b4530) returned 1
	[0176.178] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2619c0c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2619c0c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0176.178] CryptDestroyKey (hKey=0x82b280) returned 1
	[0176.178] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.178] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFilePart=0x0) returned 0x78
	[0176.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0176.178] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.186] GetFileType (hFile=0x318) returned 0x1
	[0176.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0176.186] GetFileType (hFile=0x318) returned 0x1
	[0176.186] WriteFile (in: hFile=0x318, lpBuffer=0x5df5558*, nNumberOfBytesToWrite=0x4b4530, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x5df5558*, lpNumberOfBytesWritten=0x99f040*=0x4b4530, lpOverlapped=0x0) returned 1
	[0176.368] CloseHandle (hObject=0x318) returned 1
	[0176.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFilePart=0x0) returned 0x78
	[0176.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa7
	[0176.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0176.369] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6151ff00, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x6151ff00, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0xa373431e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4b4530)) returned 1
	[0176.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0176.369] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0176.371] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFilePart=0x0) returned 0x8c
	[0176.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.372] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x261a280 | out: lpFileInformation=0x261a280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000)) returned 1
	[0176.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFilePart=0x0) returned 0x8c
	[0176.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.373] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.373] GetFileType (hFile=0x318) returned 0x1
	[0176.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0176.373] GetFileType (hFile=0x318) returned 0x1
	[0176.373] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x23000
	[0176.374] ReadFile (in: hFile=0x318, lpBuffer=0x3fcb130, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x3fcb130*, lpNumberOfBytesRead=0x99f04c*=0x23000, lpOverlapped=0x0) returned 1
	[0176.394] CloseHandle (hObject=0x318) returned 1
	[0176.394] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0176.394] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.394] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261a6c8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0176.394] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.394] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.394] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b100) returned 1
	[0176.394] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.394] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x261a780*=0x1, dwFlags=0x0) returned 1
	[0176.394] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x261a74c, dwFlags=0x0) returned 1
	[0176.396] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3fee150*, pdwDataLen=0x99f054*=0x23010, dwBufLen=0x23010 | out: pbData=0x3fee150*, pdwDataLen=0x99f054*=0x23010) returned 1
	[0176.397] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261a790*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x261a790*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0176.397] CryptDestroyKey (hKey=0x82b100) returned 1
	[0176.397] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.397] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.397] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFilePart=0x0) returned 0x8c
	[0176.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0176.397] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.399] GetFileType (hFile=0x318) returned 0x1
	[0176.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0176.399] GetFileType (hFile=0x318) returned 0x1
	[0176.399] WriteFile (in: hFile=0x318, lpBuffer=0x3fee150*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x3fee150*, lpNumberOfBytesWritten=0x99f040*=0x23010, lpOverlapped=0x0) returned 1
	[0176.402] CloseHandle (hObject=0x318) returned 1
	[0176.402] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFilePart=0x0) returned 0x8c
	[0176.402] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbb
	[0176.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0176.403] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0xa37a6654, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x23010)) returned 1
	[0176.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0176.403] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0176.404] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1", lpFilePart=0x0) returned 0x3c
	[0176.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\users\\all users\\microsoft\\appv\\setup\\officeintegrator.ps1"), fInfoLevelId=0x0, lpFileInformation=0x261aef4 | out: lpFileInformation=0x261aef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368)) returned 1
	[0176.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.404] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1", lpFilePart=0x0) returned 0x3c
	[0176.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.405] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\users\\all users\\microsoft\\appv\\setup\\officeintegrator.ps1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.405] GetFileType (hFile=0x318) returned 0x1
	[0176.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0176.405] GetFileType (hFile=0x318) returned 0x1
	[0176.405] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1368
	[0176.405] ReadFile (in: hFile=0x318, lpBuffer=0x261b14c, nNumberOfBytesToRead=0x1368, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x261b14c*, lpNumberOfBytesRead=0x99f04c*=0x1368, lpOverlapped=0x0) returned 1
	[0176.406] CloseHandle (hObject=0x318) returned 1
	[0176.406] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0176.406] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.406] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261c550, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0176.406] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.406] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.406] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b100) returned 1
	[0176.406] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.406] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x261c608*=0x1, dwFlags=0x0) returned 1
	[0176.406] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x261c5d4, dwFlags=0x0) returned 1
	[0176.406] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261c618*, pdwDataLen=0x99f054*=0x1370, dwBufLen=0x1370 | out: pbData=0x261c618*, pdwDataLen=0x99f054*=0x1370) returned 1
	[0176.406] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x261d994*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x261d994*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0176.407] CryptDestroyKey (hKey=0x82b100) returned 1
	[0176.407] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.407] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.407] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1", lpFilePart=0x0) returned 0x3c
	[0176.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0176.407] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\users\\all users\\microsoft\\appv\\setup\\officeintegrator.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0176.409] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", lpFilePart=0x0) returned 0x5f
	[0176.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.409] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), fInfoLevelId=0x0, lpFileInformation=0x261df50 | out: lpFileInformation=0x261df50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.410] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81
	[0176.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.410] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x261e354 | out: lpFileInformation=0x261e354*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.412] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75
	[0176.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.412] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x261e824 | out: lpFileInformation=0x261e824*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.413] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78
	[0176.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.413] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x261ecac | out: lpFileInformation=0x261ecac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.415] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0176.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.415] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x261f144 | out: lpFileInformation=0x261f144*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.416] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0176.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.416] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x261f5f0 | out: lpFileInformation=0x261f5f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.417] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0176.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.433] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x261fa64 | out: lpFileInformation=0x261fa64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.435] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0176.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.435] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x261ff28 | out: lpFileInformation=0x261ff28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.436] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81
	[0176.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.437] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x26203a8 | out: lpFileInformation=0x26203a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.438] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75
	[0176.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.438] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2620878 | out: lpFileInformation=0x2620878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.439] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0176.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.439] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2620d00 | out: lpFileInformation=0x2620d00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.440] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73
	[0176.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.440] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x26211b8 | out: lpFileInformation=0x26211b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.441] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x77
	[0176.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.441] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2621634 | out: lpFileInformation=0x2621634*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.442] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77
	[0176.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.442] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2621ac8 | out: lpFileInformation=0x2621ac8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.443] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75
	[0176.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.444] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2621f5c | out: lpFileInformation=0x2621f5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.445] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78
	[0176.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.445] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x26223e4 | out: lpFileInformation=0x26223e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.446] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83
	[0176.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.446] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x262287c | out: lpFileInformation=0x262287c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.447] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76
	[0176.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.447] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2622d58 | out: lpFileInformation=0x2622d58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.448] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b
	[0176.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.448] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x26231e4 | out: lpFileInformation=0x26231e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.450] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72
	[0176.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.450] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2623690 | out: lpFileInformation=0x2623690*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.452] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0176.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.452] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2623b04 | out: lpFileInformation=0x2623b04*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.453] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0176.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.453] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2623fc8 | out: lpFileInformation=0x2623fc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.454] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83
	[0176.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.454] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2624448 | out: lpFileInformation=0x2624448*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.455] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76
	[0176.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.455] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2624924 | out: lpFileInformation=0x2624924*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.457] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x89
	[0176.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.457] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2624db0 | out: lpFileInformation=0x2624db0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.458] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x89
	[0176.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x26252b0 | out: lpFileInformation=0x26252b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.459] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x79
	[0176.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.459] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x26257b0 | out: lpFileInformation=0x26257b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.460] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83
	[0176.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.460] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2625c50 | out: lpFileInformation=0x2625c50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.461] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76
	[0176.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.461] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x262612c | out: lpFileInformation=0x262612c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.462] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", lpFilePart=0x0) returned 0x79
	[0176.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.463] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x26265b8 | out: lpFileInformation=0x26265b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.464] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", lpFilePart=0x0) returned 0x79
	[0176.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.464] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), fInfoLevelId=0x0, lpFileInformation=0x2626a58 | out: lpFileInformation=0x2626a58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.465] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpFilePart=0x0) returned 0x79
	[0176.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.466] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), fInfoLevelId=0x0, lpFileInformation=0x2626ef8 | out: lpFileInformation=0x2626ef8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.467] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0176.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.467] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2627398 | out: lpFileInformation=0x2627398*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.468] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x87
	[0176.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.469] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2627818 | out: lpFileInformation=0x2627818*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.470] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78
	[0176.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.470] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2627d0c | out: lpFileInformation=0x2627d0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.471] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81
	[0176.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.472] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x26281a4 | out: lpFileInformation=0x26281a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.473] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f
	[0176.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.473] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2628674 | out: lpFileInformation=0x2628674*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.474] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74
	[0176.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.475] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2628b38 | out: lpFileInformation=0x2628b38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.476] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d
	[0176.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.476] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), fInfoLevelId=0x0, lpFileInformation=0x2628fb8 | out: lpFileInformation=0x2628fb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.477] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73
	[0176.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.477] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), fInfoLevelId=0x0, lpFileInformation=0x2629470 | out: lpFileInformation=0x2629470*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.479] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe", lpFilePart=0x0) returned 0x5d
	[0176.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.479] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe"), fInfoLevelId=0x0, lpFileInformation=0x26298ec | out: lpFileInformation=0x26298ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.494] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpFilePart=0x0) returned 0x84
	[0176.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.494] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), fInfoLevelId=0x0, lpFileInformation=0x2629ce4 | out: lpFileInformation=0x2629ce4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.495] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFilePart=0x0) returned 0x81
	[0176.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.495] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), fInfoLevelId=0x0, lpFileInformation=0x262a1c4 | out: lpFileInformation=0x262a1c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.497] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", lpFilePart=0x0) returned 0x62
	[0176.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.497] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), fInfoLevelId=0x0, lpFileInformation=0x262a694 | out: lpFileInformation=0x262a694*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.498] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", lpFilePart=0x0) returned 0x5a
	[0176.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.499] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), fInfoLevelId=0x0, lpFileInformation=0x262aaa8 | out: lpFileInformation=0x262aaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.500] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFilePart=0x0) returned 0x74
	[0176.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.500] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), fInfoLevelId=0x0, lpFileInformation=0x262ae8c | out: lpFileInformation=0x262ae8c*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d)) returned 1
	[0176.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.501] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFilePart=0x0) returned 0x74
	[0176.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.501] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.501] GetFileType (hFile=0x318) returned 0x1
	[0176.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0176.501] GetFileType (hFile=0x318) returned 0x1
	[0176.501] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x61d
	[0176.502] ReadFile (in: hFile=0x318, lpBuffer=0x262b8b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x262b8b0*, lpNumberOfBytesRead=0x99f04c*=0x61d, lpOverlapped=0x0) returned 1
	[0176.502] CloseHandle (hObject=0x318) returned 1
	[0176.502] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0176.502] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.503] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262c94c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0176.503] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.503] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.503] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0176.503] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.503] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x262ca04*=0x1, dwFlags=0x0) returned 1
	[0176.503] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x262c9d0, dwFlags=0x0) returned 1
	[0176.503] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262ca14*, pdwDataLen=0x99f054*=0x620, dwBufLen=0x620 | out: pbData=0x262ca14*, pdwDataLen=0x99f054*=0x620) returned 1
	[0176.503] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262d040*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x262d040*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0176.503] CryptDestroyKey (hKey=0x82b280) returned 1
	[0176.503] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.503] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.503] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFilePart=0x0) returned 0x74
	[0176.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0176.503] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0176.505] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFilePart=0x0) returned 0x74
	[0176.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), fInfoLevelId=0x0, lpFileInformation=0x262d81c | out: lpFileInformation=0x262d81c*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d)) returned 1
	[0176.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.505] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFilePart=0x0) returned 0x74
	[0176.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.506] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.506] GetFileType (hFile=0x318) returned 0x1
	[0176.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0176.506] GetFileType (hFile=0x318) returned 0x1
	[0176.506] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x61d
	[0176.506] ReadFile (in: hFile=0x318, lpBuffer=0x262e240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x262e240*, lpNumberOfBytesRead=0x99f04c*=0x61d, lpOverlapped=0x0) returned 1
	[0176.507] CloseHandle (hObject=0x318) returned 1
	[0176.507] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0176.507] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.507] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262f2dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0176.507] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.507] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.507] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0176.507] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.507] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x262f394*=0x1, dwFlags=0x0) returned 1
	[0176.508] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x262f360, dwFlags=0x0) returned 1
	[0176.508] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262f3a4*, pdwDataLen=0x99f054*=0x620, dwBufLen=0x620 | out: pbData=0x262f3a4*, pdwDataLen=0x99f054*=0x620) returned 1
	[0176.508] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262f9d0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x262f9d0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0176.508] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0176.508] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.508] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.508] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFilePart=0x0) returned 0x74
	[0176.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0176.508] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0176.511] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", lpFilePart=0x0) returned 0x59
	[0176.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.511] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox"), fInfoLevelId=0x0, lpFileInformation=0x26301ac | out: lpFileInformation=0x26301ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.513] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json", lpFilePart=0x0) returned 0x5b
	[0176.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.513] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), fInfoLevelId=0x0, lpFileInformation=0x26305b4 | out: lpFileInformation=0x26305b4*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x69d9f6fd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x69d9f6fd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69e5dfd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x623b)) returned 1
	[0176.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.513] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json", lpFilePart=0x0) returned 0x5b
	[0176.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.513] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.515] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", lpFilePart=0x0) returned 0x5e
	[0176.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.515] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk"), fInfoLevelId=0x0, lpFileInformation=0x2630df0 | out: lpFileInformation=0x2630df0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.516] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json", lpFilePart=0x0) returned 0x56
	[0176.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json"), fInfoLevelId=0x0, lpFileInformation=0x2631218 | out: lpFileInformation=0x2631218*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb0c71bce, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0xb0c71bce, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb0fb9083, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x4c)) returned 1
	[0176.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.518] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json", lpFilePart=0x0) returned 0x56
	[0176.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.518] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.522] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpFilePart=0x0) returned 0x9a
	[0176.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.523] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json"), fInfoLevelId=0x0, lpFileInformation=0x2631a18 | out: lpFileInformation=0x2631a18*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x2d95e660, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x2d95e660, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2e6edc8f, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1
	[0176.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.523] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpFilePart=0x0) returned 0x9a
	[0176.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.523] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.524] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpFilePart=0x0) returned 0x9a
	[0176.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json"), fInfoLevelId=0x0, lpFileInformation=0x26325d0 | out: lpFileInformation=0x26325d0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7ea85252, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7ea85252, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f139471, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1
	[0176.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.525] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpFilePart=0x0) returned 0x9a
	[0176.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.525] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.526] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpFilePart=0x0) returned 0x9a
	[0176.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.526] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json"), fInfoLevelId=0x0, lpFileInformation=0x2633188 | out: lpFileInformation=0x2633188*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7f139471, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7f139471, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f4f45ae, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1
	[0176.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.527] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpFilePart=0x0) returned 0x9a
	[0176.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.527] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.538] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json", lpFilePart=0x0) returned 0x46
	[0176.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.538] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), fInfoLevelId=0x0, lpFileInformation=0x2633d40 | out: lpFileInformation=0x2633d40*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x698688ac, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x698688ac, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69d06e63, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xba4e)) returned 1
	[0176.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.539] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json", lpFilePart=0x0) returned 0x46
	[0176.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.539] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.540] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", lpFilePart=0x0) returned 0x49
	[0176.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.540] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk"), fInfoLevelId=0x0, lpFileInformation=0x2634460 | out: lpFileInformation=0x2634460*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.541] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json", lpFilePart=0x0) returned 0x47
	[0176.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.541] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json"), fInfoLevelId=0x0, lpFileInformation=0x2634808 | out: lpFileInformation=0x2634808*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9)) returned 1
	[0176.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.542] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json", lpFilePart=0x0) returned 0x47
	[0176.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.542] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.543] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpFilePart=0x0) returned 0x60
	[0176.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.543] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x2634f2c | out: lpFileInformation=0x2634f2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bfa790, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4de62c84, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c2)) returned 1
	[0176.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.543] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpFilePart=0x0) returned 0x60
	[0176.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.544] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.545] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.545] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x26357d0 | out: lpFileInformation=0x26357d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c20a14, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4defb5dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x441b)) returned 1
	[0176.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.545] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.545] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.547] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpFilePart=0x0) returned 0x60
	[0176.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.547] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x26360ac | out: lpFileInformation=0x26360ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4df6de00, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8128f6c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4180)) returned 1
	[0176.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.547] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpFilePart=0x0) returned 0x60
	[0176.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.547] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.548] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.548] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x2636950 | out: lpFileInformation=0x2636950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e006640, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb5c02e23, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187)) returned 1
	[0176.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.549] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.549] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.550] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpFilePart=0x0) returned 0x60
	[0176.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.551] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x263722c | out: lpFileInformation=0x263722c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e09efaa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8625bd94, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4360)) returned 1
	[0176.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.551] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpFilePart=0x0) returned 0x60
	[0176.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.551] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.552] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.553] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x2637ad0 | out: lpFileInformation=0x2637ad0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e0c51fa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x86556ca1, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4473)) returned 1
	[0176.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.553] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.554] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpFilePart=0x0) returned 0x60
	[0176.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x26383ac | out: lpFileInformation=0x26383ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e15dbbf, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418e)) returned 1
	[0176.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.555] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpFilePart=0x0) returned 0x60
	[0176.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.555] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.556] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.556] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x2638c50 | out: lpFileInformation=0x2638c50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e1f64ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbb6d045, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418c)) returned 1
	[0176.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.556] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.557] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpFilePart=0x0) returned 0x60
	[0176.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.558] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x263952c | out: lpFileInformation=0x263952c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e24298b, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x433c)) returned 1
	[0176.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpFilePart=0x0) returned 0x60
	[0176.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.558] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.560] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.560] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x2639dd0 | out: lpFileInformation=0x2639dd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e28ee3c, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xba09c6cc, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x443f)) returned 1
	[0176.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.560] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.560] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.562] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpFilePart=0x0) returned 0x60
	[0176.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x263a6ac | out: lpFileInformation=0x263a6ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2b5071, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8d3a091, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x442d)) returned 1
	[0176.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.562] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpFilePart=0x0) returned 0x60
	[0176.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.562] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.563] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.563] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x263af50 | out: lpFileInformation=0x263af50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2db2dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8c553ea, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187)) returned 1
	[0176.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.564] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.564] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.565] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpFilePart=0x0) returned 0x60
	[0176.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x263b82c | out: lpFileInformation=0x263b82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e301522, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418b)) returned 1
	[0176.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.565] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpFilePart=0x0) returned 0x60
	[0176.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.566] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.567] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.567] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x263c0d0 | out: lpFileInformation=0x263c0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e89d5, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e34d9d0, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbaf35d10, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4172)) returned 1
	[0176.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.567] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.567] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.568] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpFilePart=0x0) returned 0x60
	[0176.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x263c9ac | out: lpFileInformation=0x263c9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e399e7e, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8507a310, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c3a)) returned 1
	[0176.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpFilePart=0x0) returned 0x60
	[0176.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.569] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.570] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.570] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x263d250 | out: lpFileInformation=0x263d250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e458a8d, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x85007c03, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x424c)) returned 1
	[0176.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.571] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.571] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.572] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpFilePart=0x0) returned 0x60
	[0176.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), fInfoLevelId=0x0, lpFileInformation=0x263db2c | out: lpFileInformation=0x263db2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4a4f18, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb806a476, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x43ad)) returned 1
	[0176.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.572] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpFilePart=0x0) returned 0x60
	[0176.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.572] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.574] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), fInfoLevelId=0x0, lpFileInformation=0x263e3d0 | out: lpFileInformation=0x263e3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443)) returned 1
	[0176.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.588] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpFilePart=0x0) returned 0x64
	[0176.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.589] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.590] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll", lpFilePart=0x0) returned 0x3f
	[0176.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.590] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll"), fInfoLevelId=0x0, lpFileInformation=0x263ecac | out: lpFileInformation=0x263ecac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.591] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll", lpFilePart=0x0) returned 0x46
	[0176.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.591] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll"), fInfoLevelId=0x0, lpFileInformation=0x263f034 | out: lpFileInformation=0x263f034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.592] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk", lpFilePart=0x0) returned 0x37
	[0176.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.592] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.chk"), fInfoLevelId=0x0, lpFileInformation=0x263f3d8 | out: lpFileInformation=0x263f3d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.594] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log", lpFilePart=0x0) returned 0x37
	[0176.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.594] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log"), fInfoLevelId=0x0, lpFileInformation=0x263f728 | out: lpFileInformation=0x263f728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e26fff, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x576f6993, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x140000)) returned 1
	[0176.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.594] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log", lpFilePart=0x0) returned 0x37
	[0176.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.594] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.595] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs", lpFilePart=0x0) returned 0x3f
	[0176.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.595] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbres00001.jrs"), fInfoLevelId=0x0, lpFileInformation=0x263fdfc | out: lpFileInformation=0x263fdfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.596] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs", lpFilePart=0x0) returned 0x3f
	[0176.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.596] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbres00002.jrs"), fInfoLevelId=0x0, lpFileInformation=0x264017c | out: lpFileInformation=0x264017c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.597] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log", lpFilePart=0x0) returned 0x3a
	[0176.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.598] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbtmp.log"), fInfoLevelId=0x0, lpFileInformation=0x26404fc | out: lpFileInformation=0x26404fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.599] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db", lpFilePart=0x0) returned 0x37
	[0176.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.599] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db"), fInfoLevelId=0x0, lpFileInformation=0x2640860 | out: lpFileInformation=0x2640860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc5e99732, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e99732, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4c7b8ba2, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x140000)) returned 1
	[0176.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.599] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db", lpFilePart=0x0) returned 0x37
	[0176.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.599] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.600] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm", lpFilePart=0x0) returned 0x38
	[0176.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.600] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.jfm"), fInfoLevelId=0x0, lpFileInformation=0x2640f34 | out: lpFileInformation=0x2640f34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x576d0867, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
	[0176.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.600] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm", lpFilePart=0x0) returned 0x38
	[0176.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.601] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.jfm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d980) returned 1
	[0176.602] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x2641620 | out: lpFileInformation=0x2641620*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.603] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.603] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2641a38 | out: lpFileInformation=0x2641a38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.604] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x2641e54 | out: lpFileInformation=0x2641e54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.606] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.606] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x264226c | out: lpFileInformation=0x264226c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.607] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.607] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x2642688 | out: lpFileInformation=0x2642688*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.608] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2642aa0 | out: lpFileInformation=0x2642aa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.609] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.609] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x2642ebc | out: lpFileInformation=0x2642ebc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.610] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.610] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26432d4 | out: lpFileInformation=0x26432d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.611] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.611] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26436f0 | out: lpFileInformation=0x26436f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.612] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.613] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2643b08 | out: lpFileInformation=0x2643b08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.614] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.614] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x2643f24 | out: lpFileInformation=0x2643f24*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.615] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.615] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x264433c | out: lpFileInformation=0x264433c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.616] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.617] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x2644758 | out: lpFileInformation=0x2644758*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.618] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.618] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2644b70 | out: lpFileInformation=0x2644b70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.619] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.619] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x2644f8c | out: lpFileInformation=0x2644f8c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.621] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.621] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26453a4 | out: lpFileInformation=0x26453a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.632] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.632] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26457c0 | out: lpFileInformation=0x26457c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.633] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.633] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2645bd8 | out: lpFileInformation=0x2645bd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.635] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.635] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x2645ff4 | out: lpFileInformation=0x2645ff4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.636] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.636] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x264640c | out: lpFileInformation=0x264640c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.637] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.637] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x2646828 | out: lpFileInformation=0x2646828*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.638] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.639] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2646c40 | out: lpFileInformation=0x2646c40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.640] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.640] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x264705c | out: lpFileInformation=0x264705c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.641] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.641] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2647474 | out: lpFileInformation=0x2647474*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.643] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.643] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x2647890 | out: lpFileInformation=0x2647890*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.644] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.644] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2647ca8 | out: lpFileInformation=0x2647ca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.645] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.645] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26480c4 | out: lpFileInformation=0x26480c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.647] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.647] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x26484dc | out: lpFileInformation=0x26484dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.648] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.648] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x26488f8 | out: lpFileInformation=0x26488f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.650] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2648d10 | out: lpFileInformation=0x2648d10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.651] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.651] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x264912c | out: lpFileInformation=0x264912c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.653] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.653] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2649544 | out: lpFileInformation=0x2649544*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.654] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.654] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x2649960 | out: lpFileInformation=0x2649960*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.655] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.655] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2649d78 | out: lpFileInformation=0x2649d78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.656] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", lpFilePart=0x0) returned 0x63
	[0176.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.657] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), fInfoLevelId=0x0, lpFileInformation=0x264a194 | out: lpFileInformation=0x264a194*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.658] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", lpFilePart=0x0) returned 0x64
	[0176.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.658] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), fInfoLevelId=0x0, lpFileInformation=0x264a5ac | out: lpFileInformation=0x264a5ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.659] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", lpFilePart=0x0) returned 0x3b
	[0176.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.659] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.chk"), fInfoLevelId=0x0, lpFileInformation=0x264a9c8 | out: lpFileInformation=0x264a9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd4ae8d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b93f8ea, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0176.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.659] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", lpFilePart=0x0) returned 0x3b
	[0176.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.660] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.660] GetFileType (hFile=0x318) returned 0x1
	[0176.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0176.660] GetFileType (hFile=0x318) returned 0x1
	[0176.660] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2000
	[0176.660] ReadFile (in: hFile=0x318, lpBuffer=0x264abe0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x264abe0*, lpNumberOfBytesRead=0x99f04c*=0x2000, lpOverlapped=0x0) returned 1
	[0176.661] CloseHandle (hObject=0x318) returned 1
	[0176.661] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0176.661] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.661] CryptImportKey (in: hProv=0x7f93c0, pbData=0x264cc7c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0176.661] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.661] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.661] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b380) returned 1
	[0176.661] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.661] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x264cd34*=0x1, dwFlags=0x0) returned 1
	[0176.661] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x264cd00, dwFlags=0x0) returned 1
	[0176.661] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264cd44*, pdwDataLen=0x99f054*=0x2010, dwBufLen=0x2010 | out: pbData=0x264cd44*, pdwDataLen=0x99f054*=0x2010) returned 1
	[0176.661] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264ed60*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x264ed60*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0176.661] CryptDestroyKey (hKey=0x82b380) returned 1
	[0176.661] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.661] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.661] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", lpFilePart=0x0) returned 0x3b
	[0176.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0176.662] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.chk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0176.663] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log", lpFilePart=0x0) returned 0x3b
	[0176.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.663] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log"), fInfoLevelId=0x0, lpFileInformation=0x264f2f4 | out: lpFileInformation=0x264f2f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd24c5a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dec862e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b93f8ea, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0176.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.664] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log", lpFilePart=0x0) returned 0x3b
	[0176.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.664] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.664] GetFileType (hFile=0x318) returned 0x1
	[0176.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0176.664] GetFileType (hFile=0x318) returned 0x1
	[0176.664] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x10000
	[0176.664] ReadFile (in: hFile=0x318, lpBuffer=0x264f50c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x264f50c*, lpNumberOfBytesRead=0x99f04c*=0x10000, lpOverlapped=0x0) returned 1
	[0176.665] CloseHandle (hObject=0x318) returned 1
	[0176.665] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0176.665] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.665] CryptImportKey (in: hProv=0x7f93c0, pbData=0x265f5a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b280) returned 1
	[0176.665] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.665] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.665] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0176.665] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.665] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x265f660*=0x1, dwFlags=0x0) returned 1
	[0176.665] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x265f62c, dwFlags=0x0) returned 1
	[0176.665] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x265f670*, pdwDataLen=0x99f054*=0x10010, dwBufLen=0x10010 | out: pbData=0x265f670*, pdwDataLen=0x99f054*=0x10010) returned 1
	[0176.666] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266f68c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x266f68c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0176.666] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0176.666] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.666] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.666] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log", lpFilePart=0x0) returned 0x3b
	[0176.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0176.666] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0176.667] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", lpFilePart=0x0) returned 0x40
	[0176.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.667] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log"), fInfoLevelId=0x0, lpFileInformation=0x266fc20 | out: lpFileInformation=0x266fc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd24c5a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b42ee8a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0176.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.688] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", lpFilePart=0x0) returned 0x40
	[0176.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.688] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.688] GetFileType (hFile=0x318) returned 0x1
	[0176.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0176.688] GetFileType (hFile=0x318) returned 0x1
	[0176.688] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x10000
	[0176.689] ReadFile (in: hFile=0x318, lpBuffer=0x266fe68, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x266fe68*, lpNumberOfBytesRead=0x99f04c*=0x10000, lpOverlapped=0x0) returned 1
	[0176.689] CloseHandle (hObject=0x318) returned 1
	[0176.689] CryptDestroyKey (hKey=0x82b280) returned 1
	[0176.689] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.690] CryptImportKey (in: hProv=0x7f93c0, pbData=0x267ff04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b5c0) returned 1
	[0176.690] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.690] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.690] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b0c0) returned 1
	[0176.690] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.690] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x4, pbData=0x267ffbc*=0x1, dwFlags=0x0) returned 1
	[0176.690] CryptSetKeyParam (hKey=0x82b0c0, dwParam=0x1, pbData=0x267ff88, dwFlags=0x0) returned 1
	[0176.690] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267ffcc*, pdwDataLen=0x99f054*=0x10010, dwBufLen=0x10010 | out: pbData=0x267ffcc*, pdwDataLen=0x99f054*=0x10010) returned 1
	[0176.690] CryptEncrypt (in: hKey=0x82b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x268ffe8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x268ffe8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0176.690] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0176.690] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.690] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.690] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", lpFilePart=0x0) returned 0x40
	[0176.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0176.690] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0176.692] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", lpFilePart=0x0) returned 0x43
	[0176.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.692] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs"), fInfoLevelId=0x0, lpFileInformation=0x26905b4 | out: lpFileInformation=0x26905b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd4ae8d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dd4ae8d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0176.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.692] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", lpFilePart=0x0) returned 0x43
	[0176.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.692] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.692] GetFileType (hFile=0x318) returned 0x1
	[0176.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0176.692] GetFileType (hFile=0x318) returned 0x1
	[0176.692] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x10000
	[0176.692] ReadFile (in: hFile=0x318, lpBuffer=0x269080c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x269080c*, lpNumberOfBytesRead=0x99f04c*=0x10000, lpOverlapped=0x0) returned 1
	[0176.693] CloseHandle (hObject=0x318) returned 1
	[0176.693] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0176.693] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.693] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a08a8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0176.693] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.693] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.694] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0176.694] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.694] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26a0960*=0x1, dwFlags=0x0) returned 1
	[0176.694] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26a092c, dwFlags=0x0) returned 1
	[0176.694] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a0970*, pdwDataLen=0x99f054*=0x10010, dwBufLen=0x10010 | out: pbData=0x26a0970*, pdwDataLen=0x99f054*=0x10010) returned 1
	[0176.694] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b098c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26b098c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0176.694] CryptDestroyKey (hKey=0x82b300) returned 1
	[0176.694] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.694] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.694] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", lpFilePart=0x0) returned 0x43
	[0176.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0176.694] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0176.695] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", lpFilePart=0x0) returned 0x43
	[0176.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs"), fInfoLevelId=0x0, lpFileInformation=0x26b0f70 | out: lpFileInformation=0x26b0f70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd4ae8d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dd4ae8d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0176.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0176.696] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", lpFilePart=0x0) returned 0x43
	[0176.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0176.696] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0176.696] GetFileType (hFile=0x318) returned 0x1
	[0176.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0176.696] GetFileType (hFile=0x318) returned 0x1
	[0176.696] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x10000
	[0176.696] ReadFile (in: hFile=0x318, lpBuffer=0x26b11c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26b11c8*, lpNumberOfBytesRead=0x99f04c*=0x10000, lpOverlapped=0x0) returned 1
	[0176.697] CloseHandle (hObject=0x318) returned 1
	[0176.697] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0176.697] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.697] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c1264, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b4c0) returned 1
	[0176.697] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.697] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.697] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b380) returned 1
	[0176.697] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0176.697] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26c131c*=0x1, dwFlags=0x0) returned 1
	[0176.697] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x26c12e8, dwFlags=0x0) returned 1
	[0176.697] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c132c*, pdwDataLen=0x99f054*=0x10010, dwBufLen=0x10010 | out: pbData=0x26c132c*, pdwDataLen=0x99f054*=0x10010) returned 1
	[0176.698] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d1348*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26d1348*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0176.698] CryptDestroyKey (hKey=0x82b380) returned 1
	[0176.698] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.698] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0176.698] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", lpFilePart=0x0) returned 0x43
	[0176.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0176.698] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0176.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0176.700] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", lpFilePart=0x0) returned 0x3e
	[0176.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0176.700] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), fInfoLevelId=0x0, lpFileInformation=0x26d192c | out: lpFileInformation=0x26d192c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd24c5a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd24c5a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1deee89a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0176.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt", lpFilePart=0x0) returned 0x33
	[0177.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.213] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ju0_u7czicb9.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.213] GetFileType (hFile=0x318) returned 0x1
	[0177.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.213] GetFileType (hFile=0x318) returned 0x1
	[0177.213] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1437a
	[0177.213] ReadFile (in: hFile=0x318, lpBuffer=0x270fe68, nNumberOfBytesToRead=0x1437a, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x270fe68*, lpNumberOfBytesRead=0x99f04c*=0x1437a, lpOverlapped=0x0) returned 1
	[0177.214] CloseHandle (hObject=0x318) returned 1
	[0177.214] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.214] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.214] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2724280, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b100) returned 1
	[0177.215] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.215] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.215] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0177.215] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.215] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2724338*=0x1, dwFlags=0x0) returned 1
	[0177.215] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2724304, dwFlags=0x0) returned 1
	[0177.215] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2724348*, pdwDataLen=0x99f054*=0x14380, dwBufLen=0x14380 | out: pbData=0x2724348*, pdwDataLen=0x99f054*=0x14380) returned 1
	[0177.215] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27386d4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27386d4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.215] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.215] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.215] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.215] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt", lpFilePart=0x0) returned 0x33
	[0177.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.215] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ju0_u7czicb9.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.217] GetFileType (hFile=0x318) returned 0x1
	[0177.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.217] GetFileType (hFile=0x318) returned 0x1
	[0177.217] WriteFile (in: hFile=0x318, lpBuffer=0x2724348*, nNumberOfBytesToWrite=0x14380, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x2724348*, lpNumberOfBytesWritten=0x99f040*=0x14380, lpOverlapped=0x0) returned 1
	[0177.219] CloseHandle (hObject=0x318) returned 1
	[0177.219] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt", lpFilePart=0x0) returned 0x33
	[0177.219] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x62
	[0177.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.219] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ju0_u7czicb9.ppt"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bc54c90, ftCreationTime.dwHighDateTime=0x1d4d325, ftLastAccessTime.dwLowDateTime=0xf6b840d0, ftLastAccessTime.dwHighDateTime=0x1d4cee5, ftLastWriteTime.dwLowDateTime=0xa3f57e7a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x14380)) returned 1
	[0177.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.219] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ju0_u7czicb9.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ju0_u7CZicb9.ppt id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ju0_u7czicb9.ppt id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.220] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a", lpFilePart=0x0) returned 0x32
	[0177.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.220] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\kbqyqqztxp-.m4a"), fInfoLevelId=0x0, lpFileInformation=0x2738aa8 | out: lpFileInformation=0x2738aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa330f50, ftCreationTime.dwHighDateTime=0x1d4d10c, ftLastAccessTime.dwLowDateTime=0x5e272860, ftLastAccessTime.dwHighDateTime=0x1d4ce7f, ftLastWriteTime.dwLowDateTime=0x5e272860, ftLastWriteTime.dwHighDateTime=0x1d4ce7f, nFileSizeHigh=0x0, nFileSizeLow=0x6499)) returned 1
	[0177.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.220] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a", lpFilePart=0x0) returned 0x32
	[0177.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.220] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\kbqyqqztxp-.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.221] GetFileType (hFile=0x318) returned 0x1
	[0177.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.221] GetFileType (hFile=0x318) returned 0x1
	[0177.221] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x6499
	[0177.221] ReadFile (in: hFile=0x318, lpBuffer=0x2738cc0, nNumberOfBytesToRead=0x6499, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2738cc0*, lpNumberOfBytesRead=0x99f04c*=0x6499, lpOverlapped=0x0) returned 1
	[0177.222] CloseHandle (hObject=0x318) returned 1
	[0177.222] CryptDestroyKey (hKey=0x82b100) returned 1
	[0177.222] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.222] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273f1f8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b5c0) returned 1
	[0177.222] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.222] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.222] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0177.222] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.222] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x273f2b0*=0x1, dwFlags=0x0) returned 1
	[0177.222] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x273f27c, dwFlags=0x0) returned 1
	[0177.222] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273f2c0*, pdwDataLen=0x99f054*=0x64a0, dwBufLen=0x64a0 | out: pbData=0x273f2c0*, pdwDataLen=0x99f054*=0x64a0) returned 1
	[0177.222] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274576c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x274576c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.222] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.222] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.223] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.223] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a", lpFilePart=0x0) returned 0x32
	[0177.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.223] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\kbqyqqztxp-.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.224] GetFileType (hFile=0x318) returned 0x1
	[0177.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.224] GetFileType (hFile=0x318) returned 0x1
	[0177.224] WriteFile (in: hFile=0x318, lpBuffer=0x273f2c0*, nNumberOfBytesToWrite=0x64a0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x273f2c0*, lpNumberOfBytesWritten=0x99f040*=0x64a0, lpOverlapped=0x0) returned 1
	[0177.226] CloseHandle (hObject=0x318) returned 1
	[0177.226] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a", lpFilePart=0x0) returned 0x32
	[0177.226] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x61
	[0177.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.226] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\kbqyqqztxp-.m4a"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa330f50, ftCreationTime.dwHighDateTime=0x1d4d10c, ftLastAccessTime.dwLowDateTime=0x5e272860, ftLastAccessTime.dwHighDateTime=0x1d4ce7f, ftLastWriteTime.dwLowDateTime=0xa3f7e4ea, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x64a0)) returned 1
	[0177.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.226] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\kbqyqqztxp-.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KBqYQqZtXP-.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\kbqyqqztxp-.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.227] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf", lpFilePart=0x0) returned 0x36
	[0177.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.227] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ktpap6obsgurpjn.swf"), fInfoLevelId=0x0, lpFileInformation=0x2745b30 | out: lpFileInformation=0x2745b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a31e5e0, ftCreationTime.dwHighDateTime=0x1d4c8ed, ftLastAccessTime.dwLowDateTime=0x915e9c0, ftLastAccessTime.dwHighDateTime=0x1d4d509, ftLastWriteTime.dwLowDateTime=0x915e9c0, ftLastWriteTime.dwHighDateTime=0x1d4d509, nFileSizeHigh=0x0, nFileSizeLow=0x16b80)) returned 1
	[0177.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.227] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf", lpFilePart=0x0) returned 0x36
	[0177.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.227] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ktpap6obsgurpjn.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.227] GetFileType (hFile=0x318) returned 0x1
	[0177.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.228] GetFileType (hFile=0x318) returned 0x1
	[0177.228] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x16b80
	[0177.228] ReadFile (in: hFile=0x318, lpBuffer=0x40711d0, nNumberOfBytesToRead=0x16b80, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x40711d0*, lpNumberOfBytesRead=0x99f04c*=0x16b80, lpOverlapped=0x0) returned 1
	[0177.230] CloseHandle (hObject=0x318) returned 1
	[0177.230] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0177.230] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.230] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2745df8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b000) returned 1
	[0177.230] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.230] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.230] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b440) returned 1
	[0177.230] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.230] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2745eb0*=0x1, dwFlags=0x0) returned 1
	[0177.230] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2745e7c, dwFlags=0x0) returned 1
	[0177.231] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4087d70*, pdwDataLen=0x99f054*=0x16b90, dwBufLen=0x16b90 | out: pbData=0x4087d70*, pdwDataLen=0x99f054*=0x16b90) returned 1
	[0177.231] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2745ec0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2745ec0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.231] CryptDestroyKey (hKey=0x82b440) returned 1
	[0177.231] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.231] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.231] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf", lpFilePart=0x0) returned 0x36
	[0177.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.232] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ktpap6obsgurpjn.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.233] GetFileType (hFile=0x318) returned 0x1
	[0177.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.233] GetFileType (hFile=0x318) returned 0x1
	[0177.233] WriteFile (in: hFile=0x318, lpBuffer=0x4087d70*, nNumberOfBytesToWrite=0x16b90, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x4087d70*, lpNumberOfBytesWritten=0x99f040*=0x16b90, lpOverlapped=0x0) returned 1
	[0177.235] CloseHandle (hObject=0x318) returned 1
	[0177.235] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf", lpFilePart=0x0) returned 0x36
	[0177.235] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0177.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.235] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ktpap6obsgurpjn.swf"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a31e5e0, ftCreationTime.dwHighDateTime=0x1d4c8ed, ftLastAccessTime.dwLowDateTime=0x915e9c0, ftLastAccessTime.dwHighDateTime=0x1d4d509, ftLastWriteTime.dwLowDateTime=0xa3f7e4ea, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x16b90)) returned 1
	[0177.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.236] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ktpap6obsgurpjn.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ktPaP6ObSGURPJN.swf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ktpap6obsgurpjn.swf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.236] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf", lpFilePart=0x0) returned 0x38
	[0177.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.236] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ky7mzbgfpadkaia78.swf"), fInfoLevelId=0x0, lpFileInformation=0x27462b4 | out: lpFileInformation=0x27462b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71909700, ftCreationTime.dwHighDateTime=0x1d4d4d9, ftLastAccessTime.dwLowDateTime=0x8cb51c90, ftLastAccessTime.dwHighDateTime=0x1d4d4ac, ftLastWriteTime.dwLowDateTime=0x8cb51c90, ftLastWriteTime.dwHighDateTime=0x1d4d4ac, nFileSizeHigh=0x0, nFileSizeLow=0x257f)) returned 1
	[0177.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.236] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf", lpFilePart=0x0) returned 0x38
	[0177.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.237] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ky7mzbgfpadkaia78.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.237] GetFileType (hFile=0x318) returned 0x1
	[0177.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.237] GetFileType (hFile=0x318) returned 0x1
	[0177.237] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x257f
	[0177.237] ReadFile (in: hFile=0x318, lpBuffer=0x27464fc, nNumberOfBytesToRead=0x257f, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27464fc*, lpNumberOfBytesRead=0x99f04c*=0x257f, lpOverlapped=0x0) returned 1
	[0177.238] CloseHandle (hObject=0x318) returned 1
	[0177.238] CryptDestroyKey (hKey=0x82b000) returned 1
	[0177.238] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.238] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2748b18, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0177.238] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.238] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.238] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0177.238] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.238] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2748bd0*=0x1, dwFlags=0x0) returned 1
	[0177.238] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2748b9c, dwFlags=0x0) returned 1
	[0177.238] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2748be0*, pdwDataLen=0x99f054*=0x2580, dwBufLen=0x2580 | out: pbData=0x2748be0*, pdwDataLen=0x99f054*=0x2580) returned 1
	[0177.238] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274b16c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x274b16c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.238] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.238] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.238] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.239] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf", lpFilePart=0x0) returned 0x38
	[0177.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.239] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ky7mzbgfpadkaia78.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.240] GetFileType (hFile=0x318) returned 0x1
	[0177.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.240] GetFileType (hFile=0x318) returned 0x1
	[0177.240] WriteFile (in: hFile=0x318, lpBuffer=0x2748be0*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x2748be0*, lpNumberOfBytesWritten=0x99f040*=0x2580, lpOverlapped=0x0) returned 1
	[0177.241] CloseHandle (hObject=0x318) returned 1
	[0177.241] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf", lpFilePart=0x0) returned 0x38
	[0177.241] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0177.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ky7mzbgfpadkaia78.swf"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71909700, ftCreationTime.dwHighDateTime=0x1d4d4d9, ftLastAccessTime.dwLowDateTime=0x8cb51c90, ftLastAccessTime.dwHighDateTime=0x1d4d4ac, ftLastWriteTime.dwLowDateTime=0xa3fa42a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2580)) returned 1
	[0177.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.242] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ky7mzbgfpadkaia78.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\KY7mZbgfpADKAia78.swf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ky7mzbgfpadkaia78.swf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4", lpFilePart=0x0) returned 0x38
	[0177.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\m5k jvfgc56ocdrkk.mp4"), fInfoLevelId=0x0, lpFileInformation=0x274b578 | out: lpFileInformation=0x274b578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaecc2bc0, ftCreationTime.dwHighDateTime=0x1d4d5b5, ftLastAccessTime.dwLowDateTime=0x6a53ece0, ftLastAccessTime.dwHighDateTime=0x1d4cb0f, ftLastWriteTime.dwLowDateTime=0x6a53ece0, ftLastWriteTime.dwHighDateTime=0x1d4cb0f, nFileSizeHigh=0x0, nFileSizeLow=0xa8f5)) returned 1
	[0177.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.243] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4", lpFilePart=0x0) returned 0x38
	[0177.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.243] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\m5k jvfgc56ocdrkk.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.243] GetFileType (hFile=0x318) returned 0x1
	[0177.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.243] GetFileType (hFile=0x318) returned 0x1
	[0177.243] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xa8f5
	[0177.243] ReadFile (in: hFile=0x318, lpBuffer=0x274b7c0, nNumberOfBytesToRead=0xa8f5, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x274b7c0*, lpNumberOfBytesRead=0x99f04c*=0xa8f5, lpOverlapped=0x0) returned 1
	[0177.244] CloseHandle (hObject=0x318) returned 1
	[0177.244] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.244] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.244] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2756154, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0177.245] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.245] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.245] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0177.245] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.245] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x275620c*=0x1, dwFlags=0x0) returned 1
	[0177.245] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27561d8, dwFlags=0x0) returned 1
	[0177.245] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275621c*, pdwDataLen=0x99f054*=0xa900, dwBufLen=0xa900 | out: pbData=0x275621c*, pdwDataLen=0x99f054*=0xa900) returned 1
	[0177.245] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2760b28*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2760b28*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.245] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.245] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.245] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.245] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4", lpFilePart=0x0) returned 0x38
	[0177.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.245] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\m5k jvfgc56ocdrkk.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.247] GetFileType (hFile=0x318) returned 0x1
	[0177.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.247] GetFileType (hFile=0x318) returned 0x1
	[0177.247] WriteFile (in: hFile=0x318, lpBuffer=0x275621c*, nNumberOfBytesToWrite=0xa900, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x275621c*, lpNumberOfBytesWritten=0x99f040*=0xa900, lpOverlapped=0x0) returned 1
	[0177.248] CloseHandle (hObject=0x318) returned 1
	[0177.248] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4", lpFilePart=0x0) returned 0x38
	[0177.248] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0177.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.249] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\m5k jvfgc56ocdrkk.mp4"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaecc2bc0, ftCreationTime.dwHighDateTime=0x1d4d5b5, ftLastAccessTime.dwLowDateTime=0x6a53ece0, ftLastAccessTime.dwHighDateTime=0x1d4cb0f, ftLastWriteTime.dwLowDateTime=0xa3fa42a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xa900)) returned 1
	[0177.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.249] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\m5k jvfgc56ocdrkk.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\m5K jvfgc56OcdrKk.mp4 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\m5k jvfgc56ocdrkk.mp4 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.249] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx", lpFilePart=0x0) returned 0x3a
	[0177.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.249] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\nuw0_vrspuzfknpssr.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2760f34 | out: lpFileInformation=0x2760f34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1de9990, ftCreationTime.dwHighDateTime=0x1d4cb95, ftLastAccessTime.dwLowDateTime=0xe0e73200, ftLastAccessTime.dwHighDateTime=0x1d4d194, ftLastWriteTime.dwLowDateTime=0xe0e73200, ftLastWriteTime.dwHighDateTime=0x1d4d194, nFileSizeHigh=0x0, nFileSizeLow=0x13db)) returned 1
	[0177.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.250] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx", lpFilePart=0x0) returned 0x3a
	[0177.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.250] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\nuw0_vrspuzfknpssr.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.250] GetFileType (hFile=0x318) returned 0x1
	[0177.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.250] GetFileType (hFile=0x318) returned 0x1
	[0177.250] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x13db
	[0177.250] ReadFile (in: hFile=0x318, lpBuffer=0x276118c, nNumberOfBytesToRead=0x13db, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x276118c*, lpNumberOfBytesRead=0x99f04c*=0x13db, lpOverlapped=0x0) returned 1
	[0177.251] CloseHandle (hObject=0x318) returned 1
	[0177.251] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.251] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.251] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2762604, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b480) returned 1
	[0177.251] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.251] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.251] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0177.251] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.251] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27626bc*=0x1, dwFlags=0x0) returned 1
	[0177.251] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2762688, dwFlags=0x0) returned 1
	[0177.252] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27626cc*, pdwDataLen=0x99f054*=0x13e0, dwBufLen=0x13e0 | out: pbData=0x27626cc*, pdwDataLen=0x99f054*=0x13e0) returned 1
	[0177.252] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2763ab8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2763ab8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.252] CryptDestroyKey (hKey=0x82b280) returned 1
	[0177.252] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.252] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx", lpFilePart=0x0) returned 0x3a
	[0177.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.252] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\nuw0_vrspuzfknpssr.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.253] GetFileType (hFile=0x318) returned 0x1
	[0177.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.253] GetFileType (hFile=0x318) returned 0x1
	[0177.253] WriteFile (in: hFile=0x318, lpBuffer=0x27626cc*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x27626cc*, lpNumberOfBytesWritten=0x99f040*=0x13e0, lpOverlapped=0x0) returned 1
	[0177.254] CloseHandle (hObject=0x318) returned 1
	[0177.254] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx", lpFilePart=0x0) returned 0x3a
	[0177.254] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0177.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.254] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\nuw0_vrspuzfknpssr.pptx"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1de9990, ftCreationTime.dwHighDateTime=0x1d4cb95, ftLastAccessTime.dwLowDateTime=0xe0e73200, ftLastAccessTime.dwHighDateTime=0x1d4d194, ftLastWriteTime.dwLowDateTime=0xa3fa42a6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13e0)) returned 1
	[0177.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.255] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\nuw0_vrspuzfknpssr.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Nuw0_VRSpuZfKNPSSr.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\nuw0_vrspuzfknpssr.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt", lpFilePart=0x0) returned 0x33
	[0177.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.255] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\oekygwbsrf3u.odt"), fInfoLevelId=0x0, lpFileInformation=0x2763edc | out: lpFileInformation=0x2763edc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbc8160, ftCreationTime.dwHighDateTime=0x1d4c608, ftLastAccessTime.dwLowDateTime=0x69b54320, ftLastAccessTime.dwHighDateTime=0x1d4cc94, ftLastWriteTime.dwLowDateTime=0x69b54320, ftLastWriteTime.dwHighDateTime=0x1d4cc94, nFileSizeHigh=0x0, nFileSizeLow=0xd417)) returned 1
	[0177.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.272] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt", lpFilePart=0x0) returned 0x33
	[0177.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.272] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\oekygwbsrf3u.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.272] GetFileType (hFile=0x318) returned 0x1
	[0177.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.272] GetFileType (hFile=0x318) returned 0x1
	[0177.272] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xd417
	[0177.272] ReadFile (in: hFile=0x318, lpBuffer=0x27640fc, nNumberOfBytesToRead=0xd417, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27640fc*, lpNumberOfBytesRead=0x99f04c*=0xd417, lpOverlapped=0x0) returned 1
	[0177.273] CloseHandle (hObject=0x318) returned 1
	[0177.273] CryptDestroyKey (hKey=0x82b480) returned 1
	[0177.273] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.273] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27715b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b000) returned 1
	[0177.273] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.273] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.273] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0177.274] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.274] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2771668*=0x1, dwFlags=0x0) returned 1
	[0177.274] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2771634, dwFlags=0x0) returned 1
	[0177.274] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2771678*, pdwDataLen=0x99f054*=0xd420, dwBufLen=0xd420 | out: pbData=0x2771678*, pdwDataLen=0x99f054*=0xd420) returned 1
	[0177.274] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277eaa4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x277eaa4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.274] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.274] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.274] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.274] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt", lpFilePart=0x0) returned 0x33
	[0177.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.274] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\oekygwbsrf3u.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.276] GetFileType (hFile=0x318) returned 0x1
	[0177.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.276] GetFileType (hFile=0x318) returned 0x1
	[0177.276] WriteFile (in: hFile=0x318, lpBuffer=0x2771678*, nNumberOfBytesToWrite=0xd420, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x2771678*, lpNumberOfBytesWritten=0x99f040*=0xd420, lpOverlapped=0x0) returned 1
	[0177.277] CloseHandle (hObject=0x318) returned 1
	[0177.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt", lpFilePart=0x0) returned 0x33
	[0177.278] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x62
	[0177.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.278] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\oekygwbsrf3u.odt"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbc8160, ftCreationTime.dwHighDateTime=0x1d4c608, ftLastAccessTime.dwLowDateTime=0x69b54320, ftLastAccessTime.dwHighDateTime=0x1d4cc94, ftLastWriteTime.dwLowDateTime=0xa3ff0776, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xd420)) returned 1
	[0177.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.278] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\oekygwbsrf3u.odt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\oEkygWBSrF3u.odt id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\oekygwbsrf3u.odt id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.279] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg", lpFilePart=0x0) returned 0x31
	[0177.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.279] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ptjmu1pgs-.jpg"), fInfoLevelId=0x0, lpFileInformation=0x277ee78 | out: lpFileInformation=0x277ee78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b8950, ftCreationTime.dwHighDateTime=0x1d4d3b3, ftLastAccessTime.dwLowDateTime=0xdfd97980, ftLastAccessTime.dwHighDateTime=0x1d4d36b, ftLastWriteTime.dwLowDateTime=0xdfd97980, ftLastWriteTime.dwHighDateTime=0x1d4d36b, nFileSizeHigh=0x0, nFileSizeLow=0x13108)) returned 1
	[0177.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.279] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg", lpFilePart=0x0) returned 0x31
	[0177.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.279] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ptjmu1pgs-.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.279] GetFileType (hFile=0x318) returned 0x1
	[0177.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.279] GetFileType (hFile=0x318) returned 0x1
	[0177.279] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x13108
	[0177.279] ReadFile (in: hFile=0x318, lpBuffer=0x277f088, nNumberOfBytesToRead=0x13108, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x277f088*, lpNumberOfBytesRead=0x99f04c*=0x13108, lpOverlapped=0x0) returned 1
	[0177.280] CloseHandle (hObject=0x318) returned 1
	[0177.280] CryptDestroyKey (hKey=0x82b000) returned 1
	[0177.280] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.280] CryptImportKey (in: hProv=0x7f93c0, pbData=0x279222c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0177.281] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.281] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.281] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b000) returned 1
	[0177.281] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.281] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x27922e4*=0x1, dwFlags=0x0) returned 1
	[0177.281] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x27922b0, dwFlags=0x0) returned 1
	[0177.281] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27922f4*, pdwDataLen=0x99f054*=0x13110, dwBufLen=0x13110 | out: pbData=0x27922f4*, pdwDataLen=0x99f054*=0x13110) returned 1
	[0177.281] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a5410*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27a5410*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.281] CryptDestroyKey (hKey=0x82b000) returned 1
	[0177.281] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.281] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.281] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg", lpFilePart=0x0) returned 0x31
	[0177.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.281] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ptjmu1pgs-.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.283] GetFileType (hFile=0x318) returned 0x1
	[0177.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.283] GetFileType (hFile=0x318) returned 0x1
	[0177.283] WriteFile (in: hFile=0x318, lpBuffer=0x27922f4*, nNumberOfBytesToWrite=0x13110, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x27922f4*, lpNumberOfBytesWritten=0x99f040*=0x13110, lpOverlapped=0x0) returned 1
	[0177.285] CloseHandle (hObject=0x318) returned 1
	[0177.285] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg", lpFilePart=0x0) returned 0x31
	[0177.285] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x60
	[0177.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.285] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ptjmu1pgs-.jpg"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b8950, ftCreationTime.dwHighDateTime=0x1d4d3b3, ftLastAccessTime.dwLowDateTime=0xdfd97980, ftLastAccessTime.dwHighDateTime=0x1d4d36b, ftLastWriteTime.dwLowDateTime=0xa3ff0776, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13110)) returned 1
	[0177.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.285] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ptjmu1pgs-.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\pTJmU1PgS-.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ptjmu1pgs-.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.286] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp", lpFilePart=0x0) returned 0x35
	[0177.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.286] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\tmnvrf_cqs3fmu.bmp"), fInfoLevelId=0x0, lpFileInformation=0x27a57cc | out: lpFileInformation=0x27a57cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fe9b050, ftCreationTime.dwHighDateTime=0x1d4d175, ftLastAccessTime.dwLowDateTime=0x36ac8880, ftLastAccessTime.dwHighDateTime=0x1d4d2d9, ftLastWriteTime.dwLowDateTime=0x36ac8880, ftLastWriteTime.dwHighDateTime=0x1d4d2d9, nFileSizeHigh=0x0, nFileSizeLow=0x93b9)) returned 1
	[0177.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.286] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp", lpFilePart=0x0) returned 0x35
	[0177.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.287] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\tmnvrf_cqs3fmu.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.287] GetFileType (hFile=0x318) returned 0x1
	[0177.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.287] GetFileType (hFile=0x318) returned 0x1
	[0177.288] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x93b9
	[0177.288] ReadFile (in: hFile=0x318, lpBuffer=0x27a59fc, nNumberOfBytesToRead=0x93b9, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27a59fc*, lpNumberOfBytesRead=0x99f04c*=0x93b9, lpOverlapped=0x0) returned 1
	[0177.289] CloseHandle (hObject=0x318) returned 1
	[0177.289] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.289] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.289] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27aee54, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b4c0) returned 1
	[0177.289] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.289] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.289] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0177.289] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.289] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x27aef0c*=0x1, dwFlags=0x0) returned 1
	[0177.289] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x27aeed8, dwFlags=0x0) returned 1
	[0177.289] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27aef1c*, pdwDataLen=0x99f054*=0x93c0, dwBufLen=0x93c0 | out: pbData=0x27aef1c*, pdwDataLen=0x99f054*=0x93c0) returned 1
	[0177.289] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27b82e8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27b82e8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.289] CryptDestroyKey (hKey=0x82b540) returned 1
	[0177.289] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.289] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.289] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp", lpFilePart=0x0) returned 0x35
	[0177.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\tmnvrf_cqs3fmu.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.291] GetFileType (hFile=0x318) returned 0x1
	[0177.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.291] GetFileType (hFile=0x318) returned 0x1
	[0177.291] WriteFile (in: hFile=0x318, lpBuffer=0x27aef1c*, nNumberOfBytesToWrite=0x93c0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x27aef1c*, lpNumberOfBytesWritten=0x99f040*=0x93c0, lpOverlapped=0x0) returned 1
	[0177.292] CloseHandle (hObject=0x318) returned 1
	[0177.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp", lpFilePart=0x0) returned 0x35
	[0177.293] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0177.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.293] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\tmnvrf_cqs3fmu.bmp"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fe9b050, ftCreationTime.dwHighDateTime=0x1d4d175, ftLastAccessTime.dwLowDateTime=0x36ac8880, ftLastAccessTime.dwHighDateTime=0x1d4d2d9, ftLastWriteTime.dwLowDateTime=0xa4016a9f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x93c0)) returned 1
	[0177.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.293] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\tmnvrf_cqs3fmu.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\TMnVrf_cQS3Fmu.bmp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\tmnvrf_cqs3fmu.bmp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif", lpFilePart=0x0) returned 0x2b
	[0177.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.294] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\upqi.gif"), fInfoLevelId=0x0, lpFileInformation=0x27b86d4 | out: lpFileInformation=0x27b86d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bbea900, ftCreationTime.dwHighDateTime=0x1d4cdbe, ftLastAccessTime.dwLowDateTime=0x71371700, ftLastAccessTime.dwHighDateTime=0x1d4d305, ftLastWriteTime.dwLowDateTime=0x71371700, ftLastWriteTime.dwHighDateTime=0x1d4d305, nFileSizeHigh=0x0, nFileSizeLow=0x136ff)) returned 1
	[0177.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif", lpFilePart=0x0) returned 0x2b
	[0177.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.294] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\upqi.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.294] GetFileType (hFile=0x318) returned 0x1
	[0177.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.294] GetFileType (hFile=0x318) returned 0x1
	[0177.294] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x136ff
	[0177.295] ReadFile (in: hFile=0x318, lpBuffer=0x27b88b4, nNumberOfBytesToRead=0x136ff, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27b88b4*, lpNumberOfBytesRead=0x99f04c*=0x136ff, lpOverlapped=0x0) returned 1
	[0177.295] CloseHandle (hObject=0x318) returned 1
	[0177.296] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0177.296] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.296] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27cc050, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0177.296] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.296] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.296] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0177.296] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.296] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x27cc108*=0x1, dwFlags=0x0) returned 1
	[0177.296] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x27cc0d4, dwFlags=0x0) returned 1
	[0177.296] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27cc118*, pdwDataLen=0x99f054*=0x13700, dwBufLen=0x13700 | out: pbData=0x27cc118*, pdwDataLen=0x99f054*=0x13700) returned 1
	[0177.296] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27df824*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27df824*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.296] CryptDestroyKey (hKey=0x82b280) returned 1
	[0177.296] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.296] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.296] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif", lpFilePart=0x0) returned 0x2b
	[0177.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.297] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\upqi.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.298] GetFileType (hFile=0x318) returned 0x1
	[0177.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.298] GetFileType (hFile=0x318) returned 0x1
	[0177.298] WriteFile (in: hFile=0x318, lpBuffer=0x27cc118*, nNumberOfBytesToWrite=0x13700, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x27cc118*, lpNumberOfBytesWritten=0x99f040*=0x13700, lpOverlapped=0x0) returned 1
	[0177.300] CloseHandle (hObject=0x318) returned 1
	[0177.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif", lpFilePart=0x0) returned 0x2b
	[0177.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5a
	[0177.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.300] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\upqi.gif"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bbea900, ftCreationTime.dwHighDateTime=0x1d4cdbe, ftLastAccessTime.dwLowDateTime=0x71371700, ftLastAccessTime.dwHighDateTime=0x1d4d305, ftLastWriteTime.dwLowDateTime=0xa4016a9f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13700)) returned 1
	[0177.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.301] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\upqi.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\UpQI.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\upqi.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.301] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav", lpFilePart=0x0) returned 0x35
	[0177.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.301] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\veoorcptvfgsju.wav"), fInfoLevelId=0x0, lpFileInformation=0x27dfb98 | out: lpFileInformation=0x27dfb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb56ae860, ftCreationTime.dwHighDateTime=0x1d4d36f, ftLastAccessTime.dwLowDateTime=0x143f3430, ftLastAccessTime.dwHighDateTime=0x1d4cdb8, ftLastWriteTime.dwLowDateTime=0x143f3430, ftLastWriteTime.dwHighDateTime=0x1d4cdb8, nFileSizeHigh=0x0, nFileSizeLow=0x128d9)) returned 1
	[0177.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.302] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav", lpFilePart=0x0) returned 0x35
	[0177.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.302] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\veoorcptvfgsju.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.302] GetFileType (hFile=0x318) returned 0x1
	[0177.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.302] GetFileType (hFile=0x318) returned 0x1
	[0177.302] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x128d9
	[0177.302] ReadFile (in: hFile=0x318, lpBuffer=0x27dfdc8, nNumberOfBytesToRead=0x128d9, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27dfdc8*, lpNumberOfBytesRead=0x99f04c*=0x128d9, lpOverlapped=0x0) returned 1
	[0177.303] CloseHandle (hObject=0x318) returned 1
	[0177.303] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.303] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.303] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27f2740, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b280) returned 1
	[0177.303] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.304] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.304] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0177.304] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.304] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x27f27f8*=0x1, dwFlags=0x0) returned 1
	[0177.304] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x27f27c4, dwFlags=0x0) returned 1
	[0177.304] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27f2808*, pdwDataLen=0x99f054*=0x128e0, dwBufLen=0x128e0 | out: pbData=0x27f2808*, pdwDataLen=0x99f054*=0x128e0) returned 1
	[0177.304] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28050f4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x28050f4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.304] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.304] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.304] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.304] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav", lpFilePart=0x0) returned 0x35
	[0177.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.304] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\veoorcptvfgsju.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.306] GetFileType (hFile=0x318) returned 0x1
	[0177.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.306] GetFileType (hFile=0x318) returned 0x1
	[0177.306] WriteFile (in: hFile=0x318, lpBuffer=0x27f2808*, nNumberOfBytesToWrite=0x128e0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x27f2808*, lpNumberOfBytesWritten=0x99f040*=0x128e0, lpOverlapped=0x0) returned 1
	[0177.308] CloseHandle (hObject=0x318) returned 1
	[0177.308] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav", lpFilePart=0x0) returned 0x35
	[0177.308] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0177.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\veoorcptvfgsju.wav"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb56ae860, ftCreationTime.dwHighDateTime=0x1d4d36f, ftLastAccessTime.dwLowDateTime=0x143f3430, ftLastAccessTime.dwHighDateTime=0x1d4cdb8, ftLastWriteTime.dwLowDateTime=0xa403cc8b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x128e0)) returned 1
	[0177.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.308] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\veoorcptvfgsju.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VeOorcptvfGsju.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\veoorcptvfgsju.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.309] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav", lpFilePart=0x0) returned 0x33
	[0177.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.309] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vv0u0cpxhvmh.wav"), fInfoLevelId=0x0, lpFileInformation=0x28054e0 | out: lpFileInformation=0x28054e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x443d0ff0, ftCreationTime.dwHighDateTime=0x1d4c90c, ftLastAccessTime.dwLowDateTime=0xf2353320, ftLastAccessTime.dwHighDateTime=0x1d4c926, ftLastWriteTime.dwLowDateTime=0xf2353320, ftLastWriteTime.dwHighDateTime=0x1d4c926, nFileSizeHigh=0x0, nFileSizeLow=0x1048)) returned 1
	[0177.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.310] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav", lpFilePart=0x0) returned 0x33
	[0177.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vv0u0cpxhvmh.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.310] GetFileType (hFile=0x318) returned 0x1
	[0177.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.310] GetFileType (hFile=0x318) returned 0x1
	[0177.310] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1048
	[0177.310] ReadFile (in: hFile=0x318, lpBuffer=0x2805700, nNumberOfBytesToRead=0x1048, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2805700*, lpNumberOfBytesRead=0x99f04c*=0x1048, lpOverlapped=0x0) returned 1
	[0177.311] CloseHandle (hObject=0x318) returned 1
	[0177.311] CryptDestroyKey (hKey=0x82b280) returned 1
	[0177.311] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.311] CryptImportKey (in: hProv=0x7f93c0, pbData=0x28067e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0177.311] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.311] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.311] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0177.311] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.311] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x280689c*=0x1, dwFlags=0x0) returned 1
	[0177.311] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x2806868, dwFlags=0x0) returned 1
	[0177.312] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28068ac*, pdwDataLen=0x99f054*=0x1050, dwBufLen=0x1050 | out: pbData=0x28068ac*, pdwDataLen=0x99f054*=0x1050) returned 1
	[0177.312] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2807908*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2807908*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.312] CryptDestroyKey (hKey=0x82b300) returned 1
	[0177.312] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.312] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.312] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav", lpFilePart=0x0) returned 0x33
	[0177.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.312] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vv0u0cpxhvmh.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.313] GetFileType (hFile=0x318) returned 0x1
	[0177.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.313] GetFileType (hFile=0x318) returned 0x1
	[0177.313] WriteFile (in: hFile=0x318, lpBuffer=0x28068ac*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x28068ac*, lpNumberOfBytesWritten=0x99f040*=0x1050, lpOverlapped=0x0) returned 1
	[0177.314] CloseHandle (hObject=0x318) returned 1
	[0177.314] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav", lpFilePart=0x0) returned 0x33
	[0177.314] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x62
	[0177.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.314] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vv0u0cpxhvmh.wav"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x443d0ff0, ftCreationTime.dwHighDateTime=0x1d4c90c, ftLastAccessTime.dwLowDateTime=0xf2353320, ftLastAccessTime.dwHighDateTime=0x1d4c926, ftLastWriteTime.dwLowDateTime=0xa403cc8b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1050)) returned 1
	[0177.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.314] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vv0u0cpxhvmh.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vv0u0CpXhvMh.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vv0u0cpxhvmh.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.315] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg", lpFilePart=0x0) returned 0x3b
	[0177.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.315] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vvldkwuxa1klqujvjzhq.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2807cdc | out: lpFileInformation=0x2807cdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd02ce070, ftCreationTime.dwHighDateTime=0x1d4cfb1, ftLastAccessTime.dwLowDateTime=0x10bb2e90, ftLastAccessTime.dwHighDateTime=0x1d4c97b, ftLastWriteTime.dwLowDateTime=0x10bb2e90, ftLastWriteTime.dwHighDateTime=0x1d4c97b, nFileSizeHigh=0x0, nFileSizeLow=0x988a)) returned 1
	[0177.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.315] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg", lpFilePart=0x0) returned 0x3b
	[0177.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.316] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vvldkwuxa1klqujvjzhq.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.316] GetFileType (hFile=0x318) returned 0x1
	[0177.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.316] GetFileType (hFile=0x318) returned 0x1
	[0177.316] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x988a
	[0177.316] ReadFile (in: hFile=0x318, lpBuffer=0x2807f3c, nNumberOfBytesToRead=0x988a, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2807f3c*, lpNumberOfBytesRead=0x99f04c*=0x988a, lpOverlapped=0x0) returned 1
	[0177.317] CloseHandle (hObject=0x318) returned 1
	[0177.317] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0177.317] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.317] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2811864, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0177.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.317] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b480) returned 1
	[0177.317] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.317] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x281191c*=0x1, dwFlags=0x0) returned 1
	[0177.317] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x28118e8, dwFlags=0x0) returned 1
	[0177.317] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x281192c*, pdwDataLen=0x99f054*=0x9890, dwBufLen=0x9890 | out: pbData=0x281192c*, pdwDataLen=0x99f054*=0x9890) returned 1
	[0177.318] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x281b1c8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x281b1c8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.318] CryptDestroyKey (hKey=0x82b480) returned 1
	[0177.318] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.318] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.318] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg", lpFilePart=0x0) returned 0x3b
	[0177.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.318] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vvldkwuxa1klqujvjzhq.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.344] GetFileType (hFile=0x318) returned 0x1
	[0177.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.344] GetFileType (hFile=0x318) returned 0x1
	[0177.344] WriteFile (in: hFile=0x318, lpBuffer=0x281192c*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x281192c*, lpNumberOfBytesWritten=0x99f040*=0x9890, lpOverlapped=0x0) returned 1
	[0177.346] CloseHandle (hObject=0x318) returned 1
	[0177.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg", lpFilePart=0x0) returned 0x3b
	[0177.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6a
	[0177.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.346] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vvldkwuxa1klqujvjzhq.jpg"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd02ce070, ftCreationTime.dwHighDateTime=0x1d4cfb1, ftLastAccessTime.dwLowDateTime=0x10bb2e90, ftLastAccessTime.dwHighDateTime=0x1d4c97b, ftLastWriteTime.dwLowDateTime=0xa4089116, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x9890)) returned 1
	[0177.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.346] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vvldkwuxa1klqujvjzhq.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VvLdKwUxa1kLqUJvJzhQ.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vvldkwuxa1klqujvjzhq.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.347] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg", lpFilePart=0x0) returned 0x30
	[0177.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.350] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vvv3vzx_z.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2614f34 | out: lpFileInformation=0x2614f34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304634d0, ftCreationTime.dwHighDateTime=0x1d4c6d8, ftLastAccessTime.dwLowDateTime=0x992a63c0, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0x992a63c0, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x6799)) returned 1
	[0177.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg", lpFilePart=0x0) returned 0x30
	[0177.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vvv3vzx_z.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.351] GetFileType (hFile=0x318) returned 0x1
	[0177.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.351] GetFileType (hFile=0x318) returned 0x1
	[0177.351] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x6799
	[0177.351] ReadFile (in: hFile=0x318, lpBuffer=0x2615148, nNumberOfBytesToRead=0x6799, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2615148*, lpNumberOfBytesRead=0x99f04c*=0x6799, lpOverlapped=0x0) returned 1
	[0177.352] CloseHandle (hObject=0x318) returned 1
	[0177.352] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0177.352] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.352] CryptImportKey (in: hProv=0x7f93c0, pbData=0x261b980, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b080) returned 1
	[0177.352] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.352] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.352] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0177.352] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.352] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x261ba38*=0x1, dwFlags=0x0) returned 1
	[0177.352] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x261ba04, dwFlags=0x0) returned 1
	[0177.352] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x261ba48*, pdwDataLen=0x99f054*=0x67a0, dwBufLen=0x67a0 | out: pbData=0x261ba48*, pdwDataLen=0x99f054*=0x67a0) returned 1
	[0177.352] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26221f4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26221f4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.353] CryptDestroyKey (hKey=0x82b300) returned 1
	[0177.353] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.353] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg", lpFilePart=0x0) returned 0x30
	[0177.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.353] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vvv3vzx_z.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.354] GetFileType (hFile=0x318) returned 0x1
	[0177.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.354] GetFileType (hFile=0x318) returned 0x1
	[0177.354] WriteFile (in: hFile=0x318, lpBuffer=0x261ba48*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x261ba48*, lpNumberOfBytesWritten=0x99f040*=0x67a0, lpOverlapped=0x0) returned 1
	[0177.355] CloseHandle (hObject=0x318) returned 1
	[0177.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg", lpFilePart=0x0) returned 0x30
	[0177.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0177.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.355] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vvv3vzx_z.jpg"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304634d0, ftCreationTime.dwHighDateTime=0x1d4c6d8, ftLastAccessTime.dwLowDateTime=0x992a63c0, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xa40af3b4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x67a0)) returned 1
	[0177.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.356] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vvv3vzx_z.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\vvV3Vzx_z.jpg id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vvv3vzx_z.jpg id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls", lpFilePart=0x0) returned 0x39
	[0177.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.356] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\v_fdvk0kely75ccblx.xls"), fInfoLevelId=0x0, lpFileInformation=0x26225a0 | out: lpFileInformation=0x26225a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f0f960, ftCreationTime.dwHighDateTime=0x1d4cfc4, ftLastAccessTime.dwLowDateTime=0xe39a65f0, ftLastAccessTime.dwHighDateTime=0x1d4d1a6, ftLastWriteTime.dwLowDateTime=0xe39a65f0, ftLastWriteTime.dwHighDateTime=0x1d4d1a6, nFileSizeHigh=0x0, nFileSizeLow=0xb013)) returned 1
	[0177.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls", lpFilePart=0x0) returned 0x39
	[0177.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.356] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\v_fdvk0kely75ccblx.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.357] GetFileType (hFile=0x318) returned 0x1
	[0177.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.357] GetFileType (hFile=0x318) returned 0x1
	[0177.357] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xb013
	[0177.357] ReadFile (in: hFile=0x318, lpBuffer=0x26227f0, nNumberOfBytesToRead=0xb013, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26227f0*, lpNumberOfBytesRead=0x99f04c*=0xb013, lpOverlapped=0x0) returned 1
	[0177.358] CloseHandle (hObject=0x318) returned 1
	[0177.358] CryptDestroyKey (hKey=0x82b080) returned 1
	[0177.358] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.358] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262d8a0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b280) returned 1
	[0177.358] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.358] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.358] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0177.358] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.358] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x262d958*=0x1, dwFlags=0x0) returned 1
	[0177.358] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x262d924, dwFlags=0x0) returned 1
	[0177.358] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262d968*, pdwDataLen=0x99f054*=0xb020, dwBufLen=0xb020 | out: pbData=0x262d968*, pdwDataLen=0x99f054*=0xb020) returned 1
	[0177.358] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2638994*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2638994*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.358] CryptDestroyKey (hKey=0x82b540) returned 1
	[0177.358] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.358] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.358] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls", lpFilePart=0x0) returned 0x39
	[0177.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.358] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\v_fdvk0kely75ccblx.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.359] GetFileType (hFile=0x318) returned 0x1
	[0177.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.360] GetFileType (hFile=0x318) returned 0x1
	[0177.360] WriteFile (in: hFile=0x318, lpBuffer=0x262d968*, nNumberOfBytesToWrite=0xb020, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x262d968*, lpNumberOfBytesWritten=0x99f040*=0xb020, lpOverlapped=0x0) returned 1
	[0177.361] CloseHandle (hObject=0x318) returned 1
	[0177.361] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls", lpFilePart=0x0) returned 0x39
	[0177.361] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x68
	[0177.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.361] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\v_fdvk0kely75ccblx.xls"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f0f960, ftCreationTime.dwHighDateTime=0x1d4cfc4, ftLastAccessTime.dwLowDateTime=0xe39a65f0, ftLastAccessTime.dwHighDateTime=0x1d4d1a6, ftLastWriteTime.dwLowDateTime=0xa40af3b4, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xb020)) returned 1
	[0177.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.361] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\v_fdvk0kely75ccblx.xls"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\V_fDvk0kelY75CCBlx.xls id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\v_fdvk0kely75ccblx.xls id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.362] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a", lpFilePart=0x0) returned 0x2c
	[0177.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.362] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wajct.m4a"), fInfoLevelId=0x0, lpFileInformation=0x2638db0 | out: lpFileInformation=0x2638db0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79f17740, ftCreationTime.dwHighDateTime=0x1d4d1e9, ftLastAccessTime.dwLowDateTime=0x6197a940, ftLastAccessTime.dwHighDateTime=0x1d4d1fc, ftLastWriteTime.dwLowDateTime=0x6197a940, ftLastWriteTime.dwHighDateTime=0x1d4d1fc, nFileSizeHigh=0x0, nFileSizeLow=0xeddf)) returned 1
	[0177.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.362] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a", lpFilePart=0x0) returned 0x2c
	[0177.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.362] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wajct.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.362] GetFileType (hFile=0x318) returned 0x1
	[0177.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.362] GetFileType (hFile=0x318) returned 0x1
	[0177.362] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xeddf
	[0177.363] ReadFile (in: hFile=0x318, lpBuffer=0x2638f98, nNumberOfBytesToRead=0xeddf, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2638f98*, lpNumberOfBytesRead=0x99f04c*=0xeddf, lpOverlapped=0x0) returned 1
	[0177.363] CloseHandle (hObject=0x318) returned 1
	[0177.363] CryptDestroyKey (hKey=0x82b280) returned 1
	[0177.363] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.364] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2647e14, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0177.364] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.364] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.364] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b400) returned 1
	[0177.364] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.364] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2647ecc*=0x1, dwFlags=0x0) returned 1
	[0177.364] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2647e98, dwFlags=0x0) returned 1
	[0177.364] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2647edc*, pdwDataLen=0x99f054*=0xede0, dwBufLen=0xede0 | out: pbData=0x2647edc*, pdwDataLen=0x99f054*=0xede0) returned 1
	[0177.364] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2656cc8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2656cc8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.364] CryptDestroyKey (hKey=0x82b400) returned 1
	[0177.364] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.364] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a", lpFilePart=0x0) returned 0x2c
	[0177.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wajct.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.365] GetFileType (hFile=0x318) returned 0x1
	[0177.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.365] GetFileType (hFile=0x318) returned 0x1
	[0177.366] WriteFile (in: hFile=0x318, lpBuffer=0x2647edc*, nNumberOfBytesToWrite=0xede0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x2647edc*, lpNumberOfBytesWritten=0x99f040*=0xede0, lpOverlapped=0x0) returned 1
	[0177.367] CloseHandle (hObject=0x318) returned 1
	[0177.367] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a", lpFilePart=0x0) returned 0x2c
	[0177.367] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0177.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.367] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wajct.m4a"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79f17740, ftCreationTime.dwHighDateTime=0x1d4d1e9, ftLastAccessTime.dwLowDateTime=0x6197a940, ftLastAccessTime.dwHighDateTime=0x1d4d1fc, ftLastWriteTime.dwLowDateTime=0xa40d55eb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xede0)) returned 1
	[0177.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.367] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wajct.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wAjCT.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wajct.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.368] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav", lpFilePart=0x0) returned 0x35
	[0177.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.368] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wwgfibve6yru_s.wav"), fInfoLevelId=0x0, lpFileInformation=0x2657044 | out: lpFileInformation=0x2657044*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f449060, ftCreationTime.dwHighDateTime=0x1d4d3b6, ftLastAccessTime.dwLowDateTime=0x34679ce0, ftLastAccessTime.dwHighDateTime=0x1d4d41e, ftLastWriteTime.dwLowDateTime=0x34679ce0, ftLastWriteTime.dwHighDateTime=0x1d4d41e, nFileSizeHigh=0x0, nFileSizeLow=0x1235c)) returned 1
	[0177.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.368] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav", lpFilePart=0x0) returned 0x35
	[0177.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.368] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wwgfibve6yru_s.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.368] GetFileType (hFile=0x318) returned 0x1
	[0177.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.368] GetFileType (hFile=0x318) returned 0x1
	[0177.368] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1235c
	[0177.368] ReadFile (in: hFile=0x318, lpBuffer=0x2657274, nNumberOfBytesToRead=0x1235c, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2657274*, lpNumberOfBytesRead=0x99f04c*=0x1235c, lpOverlapped=0x0) returned 1
	[0177.369] CloseHandle (hObject=0x318) returned 1
	[0177.369] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0177.369] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.369] CryptImportKey (in: hProv=0x7f93c0, pbData=0x266966c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0177.369] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.370] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.370] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b340) returned 1
	[0177.370] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.370] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x2669724*=0x1, dwFlags=0x0) returned 1
	[0177.370] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26696f0, dwFlags=0x0) returned 1
	[0177.370] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2669734*, pdwDataLen=0x99f054*=0x12360, dwBufLen=0x12360 | out: pbData=0x2669734*, pdwDataLen=0x99f054*=0x12360) returned 1
	[0177.370] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267baa0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x267baa0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.370] CryptDestroyKey (hKey=0x82b340) returned 1
	[0177.370] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.370] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.370] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav", lpFilePart=0x0) returned 0x35
	[0177.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.370] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wwgfibve6yru_s.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.371] GetFileType (hFile=0x318) returned 0x1
	[0177.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.372] GetFileType (hFile=0x318) returned 0x1
	[0177.372] WriteFile (in: hFile=0x318, lpBuffer=0x2669734*, nNumberOfBytesToWrite=0x12360, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x2669734*, lpNumberOfBytesWritten=0x99f040*=0x12360, lpOverlapped=0x0) returned 1
	[0177.373] CloseHandle (hObject=0x318) returned 1
	[0177.373] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav", lpFilePart=0x0) returned 0x35
	[0177.373] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0177.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.374] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wwgfibve6yru_s.wav"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f449060, ftCreationTime.dwHighDateTime=0x1d4d3b6, ftLastAccessTime.dwLowDateTime=0x34679ce0, ftLastAccessTime.dwHighDateTime=0x1d4d41e, ftLastWriteTime.dwLowDateTime=0xa40d55eb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x12360)) returned 1
	[0177.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.374] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wwgfibve6yru_s.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\wwgFIBVe6YRU_S.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wwgfibve6yru_s.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.374] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3", lpFilePart=0x0) returned 0x2e
	[0177.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.374] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\y8ortzs.mp3"), fInfoLevelId=0x0, lpFileInformation=0x267be8c | out: lpFileInformation=0x267be8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36f99b20, ftCreationTime.dwHighDateTime=0x1d4c825, ftLastAccessTime.dwLowDateTime=0x38fc3c30, ftLastAccessTime.dwHighDateTime=0x1d4ca86, ftLastWriteTime.dwLowDateTime=0x38fc3c30, ftLastWriteTime.dwHighDateTime=0x1d4ca86, nFileSizeHigh=0x0, nFileSizeLow=0x13e24)) returned 1
	[0177.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.375] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3", lpFilePart=0x0) returned 0x2e
	[0177.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.375] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\y8ortzs.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.375] GetFileType (hFile=0x318) returned 0x1
	[0177.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.375] GetFileType (hFile=0x318) returned 0x1
	[0177.375] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x13e24
	[0177.375] ReadFile (in: hFile=0x318, lpBuffer=0x267c084, nNumberOfBytesToRead=0x13e24, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x267c084*, lpNumberOfBytesRead=0x99f04c*=0x13e24, lpOverlapped=0x0) returned 1
	[0177.376] CloseHandle (hObject=0x318) returned 1
	[0177.376] CryptDestroyKey (hKey=0x82b540) returned 1
	[0177.376] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.376] CryptImportKey (in: hProv=0x7f93c0, pbData=0x268ff44, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0177.376] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.376] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.376] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b200) returned 1
	[0177.376] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.376] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x268fffc*=0x1, dwFlags=0x0) returned 1
	[0177.376] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x268ffc8, dwFlags=0x0) returned 1
	[0177.376] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x269000c*, pdwDataLen=0x99f054*=0x13e30, dwBufLen=0x13e30 | out: pbData=0x269000c*, pdwDataLen=0x99f054*=0x13e30) returned 1
	[0177.377] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a3e48*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26a3e48*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.377] CryptDestroyKey (hKey=0x82b200) returned 1
	[0177.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.377] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.377] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3", lpFilePart=0x0) returned 0x2e
	[0177.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.377] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\y8ortzs.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.378] GetFileType (hFile=0x318) returned 0x1
	[0177.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.378] GetFileType (hFile=0x318) returned 0x1
	[0177.378] WriteFile (in: hFile=0x318, lpBuffer=0x269000c*, nNumberOfBytesToWrite=0x13e30, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x269000c*, lpNumberOfBytesWritten=0x99f040*=0x13e30, lpOverlapped=0x0) returned 1
	[0177.380] CloseHandle (hObject=0x318) returned 1
	[0177.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3", lpFilePart=0x0) returned 0x2e
	[0177.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0177.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\y8ortzs.mp3"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36f99b20, ftCreationTime.dwHighDateTime=0x1d4c825, ftLastAccessTime.dwLowDateTime=0x38fc3c30, ftLastAccessTime.dwHighDateTime=0x1d4ca86, ftLastWriteTime.dwLowDateTime=0xa40d55eb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13e30)) returned 1
	[0177.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.396] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\y8ortzs.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Y8OrtZS.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\y8ortzs.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.397] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif", lpFilePart=0x0) returned 0x3b
	[0177.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\yyjqknbiemtfvonawaio.gif"), fInfoLevelId=0x0, lpFileInformation=0x26a41dc | out: lpFileInformation=0x26a41dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ac1f0, ftCreationTime.dwHighDateTime=0x1d4c828, ftLastAccessTime.dwLowDateTime=0x261f7700, ftLastAccessTime.dwHighDateTime=0x1d4c92b, ftLastWriteTime.dwLowDateTime=0x261f7700, ftLastWriteTime.dwHighDateTime=0x1d4c92b, nFileSizeHigh=0x0, nFileSizeLow=0x16c2d)) returned 1
	[0177.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.398] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif", lpFilePart=0x0) returned 0x3b
	[0177.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.398] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\yyjqknbiemtfvonawaio.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.398] GetFileType (hFile=0x318) returned 0x1
	[0177.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.398] GetFileType (hFile=0x318) returned 0x1
	[0177.398] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x16c2d
	[0177.399] ReadFile (in: hFile=0x318, lpBuffer=0x409e920, nNumberOfBytesToRead=0x16c2d, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x409e920*, lpNumberOfBytesRead=0x99f04c*=0x16c2d, lpOverlapped=0x0) returned 1
	[0177.401] CloseHandle (hObject=0x318) returned 1
	[0177.401] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.401] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.401] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a44cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b4c0) returned 1
	[0177.401] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.401] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.401] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0177.401] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.401] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26a4584*=0x1, dwFlags=0x0) returned 1
	[0177.401] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26a4550, dwFlags=0x0) returned 1
	[0177.403] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40b5570*, pdwDataLen=0x99f054*=0x16c30, dwBufLen=0x16c30 | out: pbData=0x40b5570*, pdwDataLen=0x99f054*=0x16c30) returned 1
	[0177.403] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a4594*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26a4594*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.403] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.403] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif", lpFilePart=0x0) returned 0x3b
	[0177.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.403] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\yyjqknbiemtfvonawaio.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.405] GetFileType (hFile=0x318) returned 0x1
	[0177.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.405] GetFileType (hFile=0x318) returned 0x1
	[0177.405] WriteFile (in: hFile=0x318, lpBuffer=0x40b5570*, nNumberOfBytesToWrite=0x16c30, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x40b5570*, lpNumberOfBytesWritten=0x99f040*=0x16c30, lpOverlapped=0x0) returned 1
	[0177.407] CloseHandle (hObject=0x318) returned 1
	[0177.407] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif", lpFilePart=0x0) returned 0x3b
	[0177.407] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6a
	[0177.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.407] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\yyjqknbiemtfvonawaio.gif"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ac1f0, ftCreationTime.dwHighDateTime=0x1d4c828, ftLastAccessTime.dwLowDateTime=0x261f7700, ftLastAccessTime.dwHighDateTime=0x1d4c92b, ftLastWriteTime.dwLowDateTime=0xa4121ab7, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x16c30)) returned 1
	[0177.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.408] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\yyjqknbiemtfvonawaio.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yyjQknBIeMTFvOnAWaiO.gif id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\yyjqknbiemtfvonawaio.gif id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.408] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx", lpFilePart=0x0) returned 0x3c
	[0177.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.409] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zvmdxfiqzy5b1stsfwxy.pptx"), fInfoLevelId=0x0, lpFileInformation=0x26a49c8 | out: lpFileInformation=0x26a49c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d0bf00, ftCreationTime.dwHighDateTime=0x1d4d163, ftLastAccessTime.dwLowDateTime=0xa18f6fd0, ftLastAccessTime.dwHighDateTime=0x1d4d0bf, ftLastWriteTime.dwLowDateTime=0xa18f6fd0, ftLastWriteTime.dwHighDateTime=0x1d4d0bf, nFileSizeHigh=0x0, nFileSizeLow=0xb0a)) returned 1
	[0177.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx", lpFilePart=0x0) returned 0x3c
	[0177.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.409] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zvmdxfiqzy5b1stsfwxy.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.409] GetFileType (hFile=0x318) returned 0x1
	[0177.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.409] GetFileType (hFile=0x318) returned 0x1
	[0177.409] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xb0a
	[0177.409] ReadFile (in: hFile=0x318, lpBuffer=0x26a5748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26a5748*, lpNumberOfBytesRead=0x99f04c*=0xb0a, lpOverlapped=0x0) returned 1
	[0177.410] CloseHandle (hObject=0x318) returned 1
	[0177.410] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0177.410] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.410] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a67e4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b440) returned 1
	[0177.410] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.410] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.410] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0177.411] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.411] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26a689c*=0x1, dwFlags=0x0) returned 1
	[0177.411] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26a6868, dwFlags=0x0) returned 1
	[0177.411] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a68ac*, pdwDataLen=0x99f054*=0xb10, dwBufLen=0xb10 | out: pbData=0x26a68ac*, pdwDataLen=0x99f054*=0xb10) returned 1
	[0177.411] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a73c8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26a73c8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.411] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.411] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.411] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx", lpFilePart=0x0) returned 0x3c
	[0177.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zvmdxfiqzy5b1stsfwxy.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.412] GetFileType (hFile=0x318) returned 0x1
	[0177.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.413] GetFileType (hFile=0x318) returned 0x1
	[0177.413] WriteFile (in: hFile=0x318, lpBuffer=0x26a7508*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26a7508*, lpNumberOfBytesWritten=0x99f014*=0xb10, lpOverlapped=0x0) returned 1
	[0177.413] CloseHandle (hObject=0x318) returned 1
	[0177.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx", lpFilePart=0x0) returned 0x3c
	[0177.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6b
	[0177.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.414] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zvmdxfiqzy5b1stsfwxy.pptx"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d0bf00, ftCreationTime.dwHighDateTime=0x1d4d163, ftLastAccessTime.dwLowDateTime=0xa18f6fd0, ftLastAccessTime.dwHighDateTime=0x1d4d0bf, ftLastWriteTime.dwLowDateTime=0xa4147cae, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xb10)) returned 1
	[0177.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.414] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zvmdxfiqzy5b1stsfwxy.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZvmDXfiQzY5B1sTSFWxY.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zvmdxfiqzy5b1stsfwxy.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.414] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", lpFilePart=0x0) returned 0x50
	[0177.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.414] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\unp\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock"), fInfoLevelId=0x0, lpFileInformation=0x26a8810 | out: lpFileInformation=0x26a8810*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xf56c97e4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0177.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", lpFilePart=0x0) returned 0x50
	[0177.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.416] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\unp\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.416] GetFileType (hFile=0x318) returned 0x1
	[0177.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.416] GetFileType (hFile=0x318) returned 0x1
	[0177.416] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x0
	[0177.416] CloseHandle (hObject=0x318) returned 1
	[0177.416] CryptDestroyKey (hKey=0x82b440) returned 1
	[0177.416] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.417] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a8bbc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b4c0) returned 1
	[0177.417] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.417] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.417] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0177.417] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.417] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26a8c74*=0x1, dwFlags=0x0) returned 1
	[0177.417] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26a8c40, dwFlags=0x0) returned 1
	[0177.417] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a8c84*, pdwDataLen=0x99f054*=0x10, dwBufLen=0x10 | out: pbData=0x26a8c84*, pdwDataLen=0x99f054*=0x10) returned 1
	[0177.417] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a8ca0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26a8ca0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.417] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.417] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.417] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.417] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", lpFilePart=0x0) returned 0x50
	[0177.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.417] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\unp\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0177.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37
	[0177.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.419] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), fInfoLevelId=0x0, lpFileInformation=0x26a9330 | out: lpFileInformation=0x26a9330*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6)) returned 1
	[0177.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37
	[0177.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.420] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.420] GetFileType (hFile=0x318) returned 0x1
	[0177.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.420] GetFileType (hFile=0x318) returned 0x1
	[0177.420] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x74e6
	[0177.420] ReadFile (in: hFile=0x318, lpBuffer=0x26a9548, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26a9548*, lpNumberOfBytesRead=0x99f04c*=0x74e6, lpOverlapped=0x0) returned 1
	[0177.448] CloseHandle (hObject=0x318) returned 1
	[0177.449] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0177.449] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.449] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b0acc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b100) returned 1
	[0177.449] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.449] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.449] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b440) returned 1
	[0177.449] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.449] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26b0b84*=0x1, dwFlags=0x0) returned 1
	[0177.449] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26b0b50, dwFlags=0x0) returned 1
	[0177.449] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b0b94*, pdwDataLen=0x99f054*=0x74f0, dwBufLen=0x74f0 | out: pbData=0x26b0b94*, pdwDataLen=0x99f054*=0x74f0) returned 1
	[0177.449] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b8090*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26b8090*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.449] CryptDestroyKey (hKey=0x82b440) returned 1
	[0177.449] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.449] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.449] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37
	[0177.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.450] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0177.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99d970) returned 1
	[0177.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx", lpFilePart=0x0) returned 0x3c
	[0177.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.451] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ktreasm\\c1oe16iym5thg.pptx"), fInfoLevelId=0x0, lpFileInformation=0x26b860c | out: lpFileInformation=0x26b860c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbfa7b50, ftCreationTime.dwHighDateTime=0x1d4d599, ftLastAccessTime.dwLowDateTime=0xd9afaf10, ftLastAccessTime.dwHighDateTime=0x1d4d12d, ftLastWriteTime.dwLowDateTime=0xd9afaf10, ftLastWriteTime.dwHighDateTime=0x1d4d12d, nFileSizeHigh=0x0, nFileSizeLow=0xb23c)) returned 1
	[0177.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx", lpFilePart=0x0) returned 0x3c
	[0177.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.452] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ktreasm\\c1oe16iym5thg.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.452] GetFileType (hFile=0x318) returned 0x1
	[0177.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.452] GetFileType (hFile=0x318) returned 0x1
	[0177.452] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xb23c
	[0177.452] ReadFile (in: hFile=0x318, lpBuffer=0x26b885c, nNumberOfBytesToRead=0xb23c, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26b885c*, lpNumberOfBytesRead=0x99f04c*=0xb23c, lpOverlapped=0x0) returned 1
	[0177.453] CloseHandle (hObject=0x318) returned 1
	[0177.453] CryptDestroyKey (hKey=0x82b100) returned 1
	[0177.453] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.453] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c3b34, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0177.454] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.454] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.454] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b4c0) returned 1
	[0177.454] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.454] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x26c3bec*=0x1, dwFlags=0x0) returned 1
	[0177.454] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x26c3bb8, dwFlags=0x0) returned 1
	[0177.454] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c3bfc*, pdwDataLen=0x99f054*=0xb240, dwBufLen=0xb240 | out: pbData=0x26c3bfc*, pdwDataLen=0x99f054*=0xb240) returned 1
	[0177.454] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26cee48*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26cee48*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.454] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0177.454] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.454] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.454] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx", lpFilePart=0x0) returned 0x3c
	[0177.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.454] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ktreasm\\c1oe16iym5thg.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.456] GetFileType (hFile=0x318) returned 0x1
	[0177.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.456] GetFileType (hFile=0x318) returned 0x1
	[0177.456] WriteFile (in: hFile=0x318, lpBuffer=0x26c3bfc*, nNumberOfBytesToWrite=0xb240, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x26c3bfc*, lpNumberOfBytesWritten=0x99f040*=0xb240, lpOverlapped=0x0) returned 1
	[0177.457] CloseHandle (hObject=0x318) returned 1
	[0177.458] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx", lpFilePart=0x0) returned 0x3c
	[0177.458] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6b
	[0177.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ktreasm\\c1oe16iym5thg.pptx"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbfa7b50, ftCreationTime.dwHighDateTime=0x1d4d599, ftLastAccessTime.dwLowDateTime=0xd9afaf10, ftLastAccessTime.dwHighDateTime=0x1d4d12d, ftLastWriteTime.dwLowDateTime=0xa419414f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xb240)) returned 1
	[0177.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.458] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ktreasm\\c1oe16iym5thg.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\C1oE16iym5ThG.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ktreasm\\c1oe16iym5thg.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.459] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx", lpFilePart=0x0) returned 0x3a
	[0177.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.459] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ktreasm\\vf2c8_79zfq.pptx"), fInfoLevelId=0x0, lpFileInformation=0x26cf278 | out: lpFileInformation=0x26cf278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58f0ac90, ftCreationTime.dwHighDateTime=0x1d4c8e9, ftLastAccessTime.dwLowDateTime=0xb2dea8e0, ftLastAccessTime.dwHighDateTime=0x1d4d1a6, ftLastWriteTime.dwLowDateTime=0xb2dea8e0, ftLastWriteTime.dwHighDateTime=0x1d4d1a6, nFileSizeHigh=0x0, nFileSizeLow=0x6b05)) returned 1
	[0177.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.460] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx", lpFilePart=0x0) returned 0x3a
	[0177.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ktreasm\\vf2c8_79zfq.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.460] GetFileType (hFile=0x318) returned 0x1
	[0177.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.460] GetFileType (hFile=0x318) returned 0x1
	[0177.460] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x6b05
	[0177.460] ReadFile (in: hFile=0x318, lpBuffer=0x26cf4b8, nNumberOfBytesToRead=0x6b05, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26cf4b8*, lpNumberOfBytesRead=0x99f04c*=0x6b05, lpOverlapped=0x0) returned 1
	[0177.461] CloseHandle (hObject=0x318) returned 1
	[0177.461] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.461] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.461] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d605c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b100) returned 1
	[0177.461] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.461] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.461] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b340) returned 1
	[0177.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.462] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26d6114*=0x1, dwFlags=0x0) returned 1
	[0177.462] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26d60e0, dwFlags=0x0) returned 1
	[0177.462] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d6124*, pdwDataLen=0x99f054*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x26d6124*, pdwDataLen=0x99f054*=0x6b10) returned 1
	[0177.462] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dcc40*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26dcc40*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.462] CryptDestroyKey (hKey=0x82b340) returned 1
	[0177.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.462] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx", lpFilePart=0x0) returned 0x3a
	[0177.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.462] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ktreasm\\vf2c8_79zfq.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.463] GetFileType (hFile=0x318) returned 0x1
	[0177.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.463] GetFileType (hFile=0x318) returned 0x1
	[0177.463] WriteFile (in: hFile=0x318, lpBuffer=0x26d6124*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x26d6124*, lpNumberOfBytesWritten=0x99f040*=0x6b10, lpOverlapped=0x0) returned 1
	[0177.465] CloseHandle (hObject=0x318) returned 1
	[0177.465] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx", lpFilePart=0x0) returned 0x3a
	[0177.465] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x69
	[0177.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ktreasm\\vf2c8_79zfq.pptx"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58f0ac90, ftCreationTime.dwHighDateTime=0x1d4c8e9, ftLastAccessTime.dwLowDateTime=0xb2dea8e0, ftLastAccessTime.dwHighDateTime=0x1d4d1a6, ftLastWriteTime.dwLowDateTime=0xa41ba467, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x6b10)) returned 1
	[0177.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.465] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ktreasm\\vf2c8_79zfq.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\ktreASm\\VF2c8_79ZFq.pptx id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ktreasm\\vf2c8_79zfq.pptx id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.465] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv", lpFilePart=0x0) returned 0x3f
	[0177.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.466] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\bck-gdriv48.csv"), fInfoLevelId=0x0, lpFileInformation=0x26dd058 | out: lpFileInformation=0x26dd058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca89b50, ftCreationTime.dwHighDateTime=0x1d4cc33, ftLastAccessTime.dwLowDateTime=0x89b69620, ftLastAccessTime.dwHighDateTime=0x1d4cf68, ftLastWriteTime.dwLowDateTime=0x89b69620, ftLastWriteTime.dwHighDateTime=0x1d4cf68, nFileSizeHigh=0x0, nFileSizeLow=0x179b1)) returned 1
	[0177.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.466] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv", lpFilePart=0x0) returned 0x3f
	[0177.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.466] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\bck-gdriv48.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.466] GetFileType (hFile=0x318) returned 0x1
	[0177.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.466] GetFileType (hFile=0x318) returned 0x1
	[0177.466] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x179b1
	[0177.467] ReadFile (in: hFile=0x318, lpBuffer=0x40cc1c0, nNumberOfBytesToRead=0x179b1, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x40cc1c0*, lpNumberOfBytesRead=0x99f04c*=0x179b1, lpOverlapped=0x0) returned 1
	[0177.469] CloseHandle (hObject=0x318) returned 1
	[0177.469] CryptDestroyKey (hKey=0x82b100) returned 1
	[0177.469] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.469] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26dd330, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b400) returned 1
	[0177.469] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.469] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.469] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0177.469] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.470] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x26dd3e8*=0x1, dwFlags=0x0) returned 1
	[0177.470] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x26dd3b4, dwFlags=0x0) returned 1
	[0177.471] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x40e3b90*, pdwDataLen=0x99f054*=0x179c0, dwBufLen=0x179c0 | out: pbData=0x40e3b90*, pdwDataLen=0x99f054*=0x179c0) returned 1
	[0177.471] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dd3f8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26dd3f8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.471] CryptDestroyKey (hKey=0x82b280) returned 1
	[0177.471] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.471] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.471] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv", lpFilePart=0x0) returned 0x3f
	[0177.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.471] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\bck-gdriv48.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.473] GetFileType (hFile=0x318) returned 0x1
	[0177.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.473] GetFileType (hFile=0x318) returned 0x1
	[0177.473] WriteFile (in: hFile=0x318, lpBuffer=0x40e3b90*, nNumberOfBytesToWrite=0x179c0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x40e3b90*, lpNumberOfBytesWritten=0x99f040*=0x179c0, lpOverlapped=0x0) returned 1
	[0177.476] CloseHandle (hObject=0x318) returned 1
	[0177.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv", lpFilePart=0x0) returned 0x3f
	[0177.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6e
	[0177.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.476] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\bck-gdriv48.csv"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca89b50, ftCreationTime.dwHighDateTime=0x1d4cc33, ftLastAccessTime.dwLowDateTime=0x89b69620, ftLastAccessTime.dwHighDateTime=0x1d4cf68, ftLastWriteTime.dwLowDateTime=0xa41e072a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x179c0)) returned 1
	[0177.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.476] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\bck-gdriv48.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\BCk-GDrIV48.csv id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\bck-gdriv48.csv id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.477] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp", lpFilePart=0x0) returned 0x3f
	[0177.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.477] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\hbeabo94o3u.odp"), fInfoLevelId=0x0, lpFileInformation=0x26dd840 | out: lpFileInformation=0x26dd840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab65d140, ftCreationTime.dwHighDateTime=0x1d4cbdb, ftLastAccessTime.dwLowDateTime=0x90bc10, ftLastAccessTime.dwHighDateTime=0x1d4d00b, ftLastWriteTime.dwLowDateTime=0x90bc10, ftLastWriteTime.dwHighDateTime=0x1d4d00b, nFileSizeHigh=0x0, nFileSizeLow=0x4c33)) returned 1
	[0177.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp", lpFilePart=0x0) returned 0x3f
	[0177.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.478] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\hbeabo94o3u.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.478] GetFileType (hFile=0x318) returned 0x1
	[0177.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.478] GetFileType (hFile=0x318) returned 0x1
	[0177.478] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x4c33
	[0177.478] ReadFile (in: hFile=0x318, lpBuffer=0x26dda88, nNumberOfBytesToRead=0x4c33, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26dda88*, lpNumberOfBytesRead=0x99f04c*=0x4c33, lpOverlapped=0x0) returned 1
	[0177.479] CloseHandle (hObject=0x318) returned 1
	[0177.479] CryptDestroyKey (hKey=0x82b400) returned 1
	[0177.479] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.479] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e2758, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b280) returned 1
	[0177.479] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.479] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.479] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0177.479] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.479] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26e2810*=0x1, dwFlags=0x0) returned 1
	[0177.479] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26e27dc, dwFlags=0x0) returned 1
	[0177.480] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e2820*, pdwDataLen=0x99f054*=0x4c40, dwBufLen=0x4c40 | out: pbData=0x26e2820*, pdwDataLen=0x99f054*=0x4c40) returned 1
	[0177.480] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e746c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26e746c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.480] CryptDestroyKey (hKey=0x82b540) returned 1
	[0177.480] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.480] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.480] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp", lpFilePart=0x0) returned 0x3f
	[0177.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.480] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\hbeabo94o3u.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.481] GetFileType (hFile=0x318) returned 0x1
	[0177.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.481] GetFileType (hFile=0x318) returned 0x1
	[0177.481] WriteFile (in: hFile=0x318, lpBuffer=0x26e2820*, nNumberOfBytesToWrite=0x4c40, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x26e2820*, lpNumberOfBytesWritten=0x99f040*=0x4c40, lpOverlapped=0x0) returned 1
	[0177.482] CloseHandle (hObject=0x318) returned 1
	[0177.482] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp", lpFilePart=0x0) returned 0x3f
	[0177.482] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6e
	[0177.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.482] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\hbeabo94o3u.odp"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab65d140, ftCreationTime.dwHighDateTime=0x1d4cbdb, ftLastAccessTime.dwLowDateTime=0x90bc10, ftLastAccessTime.dwHighDateTime=0x1d4d00b, ftLastWriteTime.dwLowDateTime=0xa41e072a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4c40)) returned 1
	[0177.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.482] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\hbeabo94o3u.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\HBeAbo94O3U.odp id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\hbeabo94o3u.odp id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods", lpFilePart=0x0) returned 0x48
	[0177.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\y7lrbe2fevj0e7g7qq_q.ods"), fInfoLevelId=0x0, lpFileInformation=0x26e78b4 | out: lpFileInformation=0x26e78b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ff0d70, ftCreationTime.dwHighDateTime=0x1d4d03d, ftLastAccessTime.dwLowDateTime=0xcfc53f30, ftLastAccessTime.dwHighDateTime=0x1d4c8c5, ftLastWriteTime.dwLowDateTime=0xcfc53f30, ftLastWriteTime.dwHighDateTime=0x1d4c8c5, nFileSizeHigh=0x0, nFileSizeLow=0x14563)) returned 1
	[0177.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods", lpFilePart=0x0) returned 0x48
	[0177.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.483] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\y7lrbe2fevj0e7g7qq_q.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.483] GetFileType (hFile=0x318) returned 0x1
	[0177.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.483] GetFileType (hFile=0x318) returned 0x1
	[0177.484] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x14563
	[0177.484] ReadFile (in: hFile=0x318, lpBuffer=0x26e7b4c, nNumberOfBytesToRead=0x14563, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26e7b4c*, lpNumberOfBytesRead=0x99f04c*=0x14563, lpOverlapped=0x0) returned 1
	[0177.484] CloseHandle (hObject=0x318) returned 1
	[0177.485] CryptDestroyKey (hKey=0x82b280) returned 1
	[0177.485] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.485] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fc14c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b280) returned 1
	[0177.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.485] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0177.485] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.485] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26fc204*=0x1, dwFlags=0x0) returned 1
	[0177.485] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26fc1d0, dwFlags=0x0) returned 1
	[0177.485] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fc214*, pdwDataLen=0x99f054*=0x14570, dwBufLen=0x14570 | out: pbData=0x26fc214*, pdwDataLen=0x99f054*=0x14570) returned 1
	[0177.485] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2710790*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2710790*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.485] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.485] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.485] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods", lpFilePart=0x0) returned 0x48
	[0177.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.485] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\y7lrbe2fevj0e7g7qq_q.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.487] GetFileType (hFile=0x318) returned 0x1
	[0177.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.487] GetFileType (hFile=0x318) returned 0x1
	[0177.487] WriteFile (in: hFile=0x318, lpBuffer=0x26fc214*, nNumberOfBytesToWrite=0x14570, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x26fc214*, lpNumberOfBytesWritten=0x99f040*=0x14570, lpOverlapped=0x0) returned 1
	[0177.489] CloseHandle (hObject=0x318) returned 1
	[0177.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods", lpFilePart=0x0) returned 0x48
	[0177.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x77
	[0177.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\y7lrbe2fevj0e7g7qq_q.ods"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ff0d70, ftCreationTime.dwHighDateTime=0x1d4d03d, ftLastAccessTime.dwLowDateTime=0xcfc53f30, ftLastAccessTime.dwHighDateTime=0x1d4c8c5, ftLastWriteTime.dwLowDateTime=0xa41e072a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x14570)) returned 1
	[0177.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.490] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\y7lrbe2fevj0e7g7qq_q.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\Y7LrBE2FEvJ0E7g7Qq_Q.ods id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\y7lrbe2fevj0e7g7qq_q.ods id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.511] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf", lpFilePart=0x0) returned 0x3d
	[0177.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.511] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\_dcqcnsv8.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2710c44 | out: lpFileInformation=0x2710c44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64257bc0, ftCreationTime.dwHighDateTime=0x1d4c756, ftLastAccessTime.dwLowDateTime=0x98a08410, ftLastAccessTime.dwHighDateTime=0x1d4d275, ftLastWriteTime.dwLowDateTime=0x98a08410, ftLastWriteTime.dwHighDateTime=0x1d4d275, nFileSizeHigh=0x0, nFileSizeLow=0x178f8)) returned 1
	[0177.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.512] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf", lpFilePart=0x0) returned 0x3d
	[0177.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.512] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\_dcqcnsv8.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.512] GetFileType (hFile=0x318) returned 0x1
	[0177.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.512] GetFileType (hFile=0x318) returned 0x1
	[0177.512] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x178f8
	[0177.512] ReadFile (in: hFile=0x318, lpBuffer=0x40fb570, nNumberOfBytesToRead=0x178f8, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x40fb570*, lpNumberOfBytesRead=0x99f04c*=0x178f8, lpOverlapped=0x0) returned 1
	[0177.515] CloseHandle (hObject=0x318) returned 1
	[0177.515] CryptDestroyKey (hKey=0x82b280) returned 1
	[0177.515] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.515] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2710f0c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0177.515] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.515] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.515] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b400) returned 1
	[0177.515] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.515] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2710fc4*=0x1, dwFlags=0x0) returned 1
	[0177.515] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2710f90, dwFlags=0x0) returned 1
	[0177.517] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4112e88*, pdwDataLen=0x99f054*=0x17900, dwBufLen=0x17900 | out: pbData=0x4112e88*, pdwDataLen=0x99f054*=0x17900) returned 1
	[0177.517] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2710fd4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2710fd4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.517] CryptDestroyKey (hKey=0x82b400) returned 1
	[0177.517] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.517] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.517] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf", lpFilePart=0x0) returned 0x3d
	[0177.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.517] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\_dcqcnsv8.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.519] GetFileType (hFile=0x318) returned 0x1
	[0177.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.519] GetFileType (hFile=0x318) returned 0x1
	[0177.519] WriteFile (in: hFile=0x318, lpBuffer=0x4112e88*, nNumberOfBytesToWrite=0x17900, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x4112e88*, lpNumberOfBytesWritten=0x99f040*=0x17900, lpOverlapped=0x0) returned 1
	[0177.521] CloseHandle (hObject=0x318) returned 1
	[0177.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf", lpFilePart=0x0) returned 0x3d
	[0177.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6c
	[0177.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\_dcqcnsv8.rtf"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64257bc0, ftCreationTime.dwHighDateTime=0x1d4c756, ftLastAccessTime.dwLowDateTime=0x98a08410, ftLastAccessTime.dwHighDateTime=0x1d4d275, ftLastWriteTime.dwLowDateTime=0xa4252da3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x17900)) returned 1
	[0177.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.525] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\_dcqcnsv8.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VF xk8r\\oUItnP BO4BQH\\_DCqCnSv8.rtf id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\documents\\vf xk8r\\ouitnp bo4bqh\\_dcqcnsv8.rtf id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.526] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a", lpFilePart=0x0) returned 0x3f
	[0177.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.526] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\nazph6ycn7ncor5mro4\\fbbkrhh.m4a"), fInfoLevelId=0x0, lpFileInformation=0x2711404 | out: lpFileInformation=0x2711404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e472b50, ftCreationTime.dwHighDateTime=0x1d4cc68, ftLastAccessTime.dwLowDateTime=0x89730ce0, ftLastAccessTime.dwHighDateTime=0x1d4ce49, ftLastWriteTime.dwLowDateTime=0x89730ce0, ftLastWriteTime.dwHighDateTime=0x1d4ce49, nFileSizeHigh=0x0, nFileSizeLow=0x153c6)) returned 1
	[0177.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.527] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a", lpFilePart=0x0) returned 0x3f
	[0177.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.527] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\nazph6ycn7ncor5mro4\\fbbkrhh.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.527] GetFileType (hFile=0x318) returned 0x1
	[0177.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.527] GetFileType (hFile=0x318) returned 0x1
	[0177.527] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x153c6
	[0177.527] ReadFile (in: hFile=0x318, lpBuffer=0x412a7a8, nNumberOfBytesToRead=0x153c6, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x412a7a8*, lpNumberOfBytesRead=0x99f04c*=0x153c6, lpOverlapped=0x0) returned 1
	[0177.529] CloseHandle (hObject=0x318) returned 1
	[0177.529] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.529] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.529] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27116cc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b280) returned 1
	[0177.529] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.529] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.530] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b040) returned 1
	[0177.530] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.530] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x2711784*=0x1, dwFlags=0x0) returned 1
	[0177.530] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x2711750, dwFlags=0x0) returned 1
	[0177.531] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x413fb90*, pdwDataLen=0x99f054*=0x153d0, dwBufLen=0x153d0 | out: pbData=0x413fb90*, pdwDataLen=0x99f054*=0x153d0) returned 1
	[0177.531] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2711794*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2711794*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.531] CryptDestroyKey (hKey=0x82b040) returned 1
	[0177.531] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.531] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.531] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a", lpFilePart=0x0) returned 0x3f
	[0177.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.531] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\nazph6ycn7ncor5mro4\\fbbkrhh.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.533] GetFileType (hFile=0x318) returned 0x1
	[0177.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.533] GetFileType (hFile=0x318) returned 0x1
	[0177.533] WriteFile (in: hFile=0x318, lpBuffer=0x413fb90*, nNumberOfBytesToWrite=0x153d0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x413fb90*, lpNumberOfBytesWritten=0x99f040*=0x153d0, lpOverlapped=0x0) returned 1
	[0177.535] CloseHandle (hObject=0x318) returned 1
	[0177.535] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a", lpFilePart=0x0) returned 0x3f
	[0177.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6e
	[0177.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.536] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\nazph6ycn7ncor5mro4\\fbbkrhh.m4a"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e472b50, ftCreationTime.dwHighDateTime=0x1d4cc68, ftLastAccessTime.dwLowDateTime=0x89730ce0, ftLastAccessTime.dwHighDateTime=0x1d4ce49, ftLastWriteTime.dwLowDateTime=0xa4252da3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x153d0)) returned 1
	[0177.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.536] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\nazph6ycn7ncor5mro4\\fbbkrhh.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\FbBKRHH.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\nazph6ycn7ncor5mro4\\fbbkrhh.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.537] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3", lpFilePart=0x0) returned 0x43
	[0177.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.537] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\nazph6ycn7ncor5mro4\\pyoyj_xnjeq.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2711bd4 | out: lpFileInformation=0x2711bd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4594a90, ftCreationTime.dwHighDateTime=0x1d4d0d3, ftLastAccessTime.dwLowDateTime=0x448ed2c0, ftLastAccessTime.dwHighDateTime=0x1d4ccd8, ftLastWriteTime.dwLowDateTime=0x448ed2c0, ftLastWriteTime.dwHighDateTime=0x1d4ccd8, nFileSizeHigh=0x0, nFileSizeLow=0xf7aa)) returned 1
	[0177.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.537] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3", lpFilePart=0x0) returned 0x43
	[0177.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.537] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\nazph6ycn7ncor5mro4\\pyoyj_xnjeq.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.537] GetFileType (hFile=0x318) returned 0x1
	[0177.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.538] GetFileType (hFile=0x318) returned 0x1
	[0177.538] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xf7aa
	[0177.538] ReadFile (in: hFile=0x318, lpBuffer=0x2711e2c, nNumberOfBytesToRead=0xf7aa, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2711e2c*, lpNumberOfBytesRead=0x99f04c*=0xf7aa, lpOverlapped=0x0) returned 1
	[0177.539] CloseHandle (hObject=0x318) returned 1
	[0177.539] CryptDestroyKey (hKey=0x82b280) returned 1
	[0177.539] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.539] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2721674, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0177.539] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.539] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.539] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b480) returned 1
	[0177.539] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.539] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x272172c*=0x1, dwFlags=0x0) returned 1
	[0177.539] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27216f8, dwFlags=0x0) returned 1
	[0177.539] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272173c*, pdwDataLen=0x99f054*=0xf7b0, dwBufLen=0xf7b0 | out: pbData=0x272173c*, pdwDataLen=0x99f054*=0xf7b0) returned 1
	[0177.539] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2730ef8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2730ef8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.539] CryptDestroyKey (hKey=0x82b480) returned 1
	[0177.539] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.539] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.539] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3", lpFilePart=0x0) returned 0x43
	[0177.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.540] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\nazph6ycn7ncor5mro4\\pyoyj_xnjeq.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.541] GetFileType (hFile=0x318) returned 0x1
	[0177.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.541] GetFileType (hFile=0x318) returned 0x1
	[0177.541] WriteFile (in: hFile=0x318, lpBuffer=0x272173c*, nNumberOfBytesToWrite=0xf7b0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x272173c*, lpNumberOfBytesWritten=0x99f040*=0xf7b0, lpOverlapped=0x0) returned 1
	[0177.543] CloseHandle (hObject=0x318) returned 1
	[0177.543] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3", lpFilePart=0x0) returned 0x43
	[0177.543] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x72
	[0177.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.543] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\nazph6ycn7ncor5mro4\\pyoyj_xnjeq.mp3"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4594a90, ftCreationTime.dwHighDateTime=0x1d4d0d3, ftLastAccessTime.dwLowDateTime=0x448ed2c0, ftLastAccessTime.dwHighDateTime=0x1d4ccd8, ftLastWriteTime.dwLowDateTime=0xa4278f7c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xf7b0)) returned 1
	[0177.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.543] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\nazph6ycn7ncor5mro4\\pyoyj_xnjeq.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\naZPH6YCn7NCOR5mRo4\\pyOYJ_xnjeq.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\nazph6ycn7ncor5mro4\\pyoyj_xnjeq.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.544] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav", lpFilePart=0x0) returned 0x35
	[0177.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.544] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\31z4t.wav"), fInfoLevelId=0x0, lpFileInformation=0x2731368 | out: lpFileInformation=0x2731368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x823ce7f0, ftCreationTime.dwHighDateTime=0x1d4cd7e, ftLastAccessTime.dwLowDateTime=0x98162d70, ftLastAccessTime.dwHighDateTime=0x1d4d37d, ftLastWriteTime.dwLowDateTime=0x98162d70, ftLastWriteTime.dwHighDateTime=0x1d4d37d, nFileSizeHigh=0x0, nFileSizeLow=0x4a40)) returned 1
	[0177.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.544] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav", lpFilePart=0x0) returned 0x35
	[0177.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.545] ReadFile (in: hFile=0x318, lpBuffer=0x2731570, nNumberOfBytesToRead=0x4a40, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2731570*, lpNumberOfBytesRead=0x99f04c*=0x4a40, lpOverlapped=0x0) returned 1
	[0177.546] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0177.546] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.546] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273604c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b080) returned 1
	[0177.546] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.546] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.546] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0177.546] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.546] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2736104*=0x1, dwFlags=0x0) returned 1
	[0177.546] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x27360d0, dwFlags=0x0) returned 1
	[0177.546] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2736114*, pdwDataLen=0x99f054*=0x4a50, dwBufLen=0x4a50 | out: pbData=0x2736114*, pdwDataLen=0x99f054*=0x4a50) returned 1
	[0177.546] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273ab70*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x273ab70*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.546] CryptDestroyKey (hKey=0x82b300) returned 1
	[0177.546] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.546] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.546] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav", lpFilePart=0x0) returned 0x35
	[0177.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.546] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\31z4t.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.547] GetFileType (hFile=0x318) returned 0x1
	[0177.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.547] GetFileType (hFile=0x318) returned 0x1
	[0177.547] WriteFile (in: hFile=0x318, lpBuffer=0x2736114*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x2736114*, lpNumberOfBytesWritten=0x99f040*=0x4a50, lpOverlapped=0x0) returned 1
	[0177.548] CloseHandle (hObject=0x318) returned 1
	[0177.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav", lpFilePart=0x0) returned 0x35
	[0177.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0177.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\31z4t.wav"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x823ce7f0, ftCreationTime.dwHighDateTime=0x1d4cd7e, ftLastAccessTime.dwLowDateTime=0x98162d70, ftLastAccessTime.dwHighDateTime=0x1d4d37d, ftLastWriteTime.dwLowDateTime=0xa4278f7c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x4a50)) returned 1
	[0177.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.549] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\31z4t.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\31Z4t.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\31z4t.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a", lpFilePart=0x0) returned 0x34
	[0177.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.550] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\b_ka.m4a"), fInfoLevelId=0x0, lpFileInformation=0x273af48 | out: lpFileInformation=0x273af48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd90a0d00, ftCreationTime.dwHighDateTime=0x1d4cb4a, ftLastAccessTime.dwLowDateTime=0xc30b8290, ftLastAccessTime.dwHighDateTime=0x1d4d56d, ftLastWriteTime.dwLowDateTime=0xc30b8290, ftLastWriteTime.dwHighDateTime=0x1d4d56d, nFileSizeHigh=0x0, nFileSizeLow=0xfacb)) returned 1
	[0177.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.550] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a", lpFilePart=0x0) returned 0x34
	[0177.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.550] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\b_ka.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.550] GetFileType (hFile=0x318) returned 0x1
	[0177.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.550] GetFileType (hFile=0x318) returned 0x1
	[0177.550] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xfacb
	[0177.550] ReadFile (in: hFile=0x318, lpBuffer=0x273b150, nNumberOfBytesToRead=0xfacb, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x273b150*, lpNumberOfBytesRead=0x99f04c*=0xfacb, lpOverlapped=0x0) returned 1
	[0177.551] CloseHandle (hObject=0x318) returned 1
	[0177.551] CryptDestroyKey (hKey=0x82b080) returned 1
	[0177.551] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.551] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274acb8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b280) returned 1
	[0177.551] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.551] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.552] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0177.552] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.552] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x274ad70*=0x1, dwFlags=0x0) returned 1
	[0177.552] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x274ad3c, dwFlags=0x0) returned 1
	[0177.552] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274ad80*, pdwDataLen=0x99f054*=0xfad0, dwBufLen=0xfad0 | out: pbData=0x274ad80*, pdwDataLen=0x99f054*=0xfad0) returned 1
	[0177.552] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275a85c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x275a85c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.552] CryptDestroyKey (hKey=0x82b540) returned 1
	[0177.552] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.552] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.552] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a", lpFilePart=0x0) returned 0x34
	[0177.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.552] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\b_ka.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.570] GetFileType (hFile=0x318) returned 0x1
	[0177.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.570] GetFileType (hFile=0x318) returned 0x1
	[0177.570] WriteFile (in: hFile=0x318, lpBuffer=0x274ad80*, nNumberOfBytesToWrite=0xfad0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x274ad80*, lpNumberOfBytesWritten=0x99f040*=0xfad0, lpOverlapped=0x0) returned 1
	[0177.571] CloseHandle (hObject=0x318) returned 1
	[0177.572] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a", lpFilePart=0x0) returned 0x34
	[0177.572] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x63
	[0177.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\b_ka.m4a"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd90a0d00, ftCreationTime.dwHighDateTime=0x1d4cb4a, ftLastAccessTime.dwLowDateTime=0xc30b8290, ftLastAccessTime.dwHighDateTime=0x1d4d56d, ftLastWriteTime.dwLowDateTime=0xa42c53f9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xfad0)) returned 1
	[0177.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.572] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\b_ka.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\b_ka.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\b_ka.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3", lpFilePart=0x0) returned 0x3b
	[0177.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.573] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\ewrex1d f-5.mp3"), fInfoLevelId=0x0, lpFileInformation=0x275ac28 | out: lpFileInformation=0x275ac28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6d74b0, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0x301427b0, ftLastAccessTime.dwHighDateTime=0x1d4c72d, ftLastWriteTime.dwLowDateTime=0x301427b0, ftLastWriteTime.dwHighDateTime=0x1d4c72d, nFileSizeHigh=0x0, nFileSizeLow=0x136fe)) returned 1
	[0177.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3", lpFilePart=0x0) returned 0x3b
	[0177.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.573] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\ewrex1d f-5.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.573] GetFileType (hFile=0x318) returned 0x1
	[0177.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.573] GetFileType (hFile=0x318) returned 0x1
	[0177.574] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x136fe
	[0177.574] ReadFile (in: hFile=0x318, lpBuffer=0x275ae60, nNumberOfBytesToRead=0x136fe, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x275ae60*, lpNumberOfBytesRead=0x99f04c*=0x136fe, lpOverlapped=0x0) returned 1
	[0177.575] CloseHandle (hObject=0x318) returned 1
	[0177.575] CryptDestroyKey (hKey=0x82b280) returned 1
	[0177.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.575] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276e5fc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b280) returned 1
	[0177.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.575] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0177.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.575] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x276e6b4*=0x1, dwFlags=0x0) returned 1
	[0177.575] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x276e680, dwFlags=0x0) returned 1
	[0177.575] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276e6c4*, pdwDataLen=0x99f054*=0x13700, dwBufLen=0x13700 | out: pbData=0x276e6c4*, pdwDataLen=0x99f054*=0x13700) returned 1
	[0177.575] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2781dd0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2781dd0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.575] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3", lpFilePart=0x0) returned 0x3b
	[0177.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.576] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\ewrex1d f-5.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.577] GetFileType (hFile=0x318) returned 0x1
	[0177.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.577] GetFileType (hFile=0x318) returned 0x1
	[0177.577] WriteFile (in: hFile=0x318, lpBuffer=0x276e6c4*, nNumberOfBytesToWrite=0x13700, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x276e6c4*, lpNumberOfBytesWritten=0x99f040*=0x13700, lpOverlapped=0x0) returned 1
	[0177.579] CloseHandle (hObject=0x318) returned 1
	[0177.580] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3", lpFilePart=0x0) returned 0x3b
	[0177.580] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6a
	[0177.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\ewrex1d f-5.mp3"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6d74b0, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0x301427b0, ftLastAccessTime.dwHighDateTime=0x1d4c72d, ftLastWriteTime.dwLowDateTime=0xa42c53f9, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13700)) returned 1
	[0177.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.580] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\ewrex1d f-5.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\eWREx1d f-5.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\ewrex1d f-5.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.581] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav", lpFilePart=0x0) returned 0x35
	[0177.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\ljrlk.wav"), fInfoLevelId=0x0, lpFileInformation=0x27821f0 | out: lpFileInformation=0x27821f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd862ab0, ftCreationTime.dwHighDateTime=0x1d4cd3e, ftLastAccessTime.dwLowDateTime=0xa2228420, ftLastAccessTime.dwHighDateTime=0x1d4cdb6, ftLastWriteTime.dwLowDateTime=0xa2228420, ftLastWriteTime.dwHighDateTime=0x1d4cdb6, nFileSizeHigh=0x0, nFileSizeLow=0xaa1e)) returned 1
	[0177.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.581] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav", lpFilePart=0x0) returned 0x35
	[0177.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.581] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\ljrlk.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.581] GetFileType (hFile=0x318) returned 0x1
	[0177.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.581] GetFileType (hFile=0x318) returned 0x1
	[0177.581] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0xaa1e
	[0177.581] ReadFile (in: hFile=0x318, lpBuffer=0x27823f8, nNumberOfBytesToRead=0xaa1e, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27823f8*, lpNumberOfBytesRead=0x99f04c*=0xaa1e, lpOverlapped=0x0) returned 1
	[0177.582] CloseHandle (hObject=0x318) returned 1
	[0177.582] CryptDestroyKey (hKey=0x82b280) returned 1
	[0177.582] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.583] CryptImportKey (in: hProv=0x7f93c0, pbData=0x278ceb4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0177.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.583] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0177.583] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.583] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x278cf6c*=0x1, dwFlags=0x0) returned 1
	[0177.583] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x278cf38, dwFlags=0x0) returned 1
	[0177.583] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x278cf7c*, pdwDataLen=0x99f054*=0xaa20, dwBufLen=0xaa20 | out: pbData=0x278cf7c*, pdwDataLen=0x99f054*=0xaa20) returned 1
	[0177.583] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27979a8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27979a8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.583] CryptDestroyKey (hKey=0x82b280) returned 1
	[0177.583] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.583] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav", lpFilePart=0x0) returned 0x35
	[0177.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.583] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\ljrlk.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.585] GetFileType (hFile=0x318) returned 0x1
	[0177.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.585] GetFileType (hFile=0x318) returned 0x1
	[0177.585] WriteFile (in: hFile=0x318, lpBuffer=0x278cf7c*, nNumberOfBytesToWrite=0xaa20, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x278cf7c*, lpNumberOfBytesWritten=0x99f040*=0xaa20, lpOverlapped=0x0) returned 1
	[0177.586] CloseHandle (hObject=0x318) returned 1
	[0177.587] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav", lpFilePart=0x0) returned 0x35
	[0177.587] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x64
	[0177.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\ljrlk.wav"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd862ab0, ftCreationTime.dwHighDateTime=0x1d4cd3e, ftLastAccessTime.dwLowDateTime=0xa2228420, ftLastAccessTime.dwHighDateTime=0x1d4cdb6, ftLastWriteTime.dwLowDateTime=0xa42eb6cd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0xaa20)) returned 1
	[0177.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.587] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\ljrlk.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\lJRLk.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\ljrlk.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.588] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3", lpFilePart=0x0) returned 0x3b
	[0177.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.588] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\yw1pmegurub.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2797d80 | out: lpFileInformation=0x2797d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddeee00, ftCreationTime.dwHighDateTime=0x1d4cf8c, ftLastAccessTime.dwLowDateTime=0x13f200e0, ftLastAccessTime.dwHighDateTime=0x1d4d121, ftLastWriteTime.dwLowDateTime=0x13f200e0, ftLastWriteTime.dwHighDateTime=0x1d4d121, nFileSizeHigh=0x0, nFileSizeLow=0x17d6f)) returned 1
	[0177.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.588] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3", lpFilePart=0x0) returned 0x3b
	[0177.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.588] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\yw1pmegurub.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.588] GetFileType (hFile=0x318) returned 0x1
	[0177.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.588] GetFileType (hFile=0x318) returned 0x1
	[0177.588] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x17d6f
	[0177.589] ReadFile (in: hFile=0x318, lpBuffer=0x4154f80, nNumberOfBytesToRead=0x17d6f, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x4154f80*, lpNumberOfBytesRead=0x99f04c*=0x17d6f, lpOverlapped=0x0) returned 1
	[0177.590] CloseHandle (hObject=0x318) returned 1
	[0177.590] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.591] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.591] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2798048, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b380) returned 1
	[0177.591] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.591] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.591] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0177.591] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.591] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2798100*=0x1, dwFlags=0x0) returned 1
	[0177.591] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27980cc, dwFlags=0x0) returned 1
	[0177.592] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x416cd10*, pdwDataLen=0x99f054*=0x17d70, dwBufLen=0x17d70 | out: pbData=0x416cd10*, pdwDataLen=0x99f054*=0x17d70) returned 1
	[0177.592] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2798110*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2798110*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.592] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.592] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.592] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.593] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3", lpFilePart=0x0) returned 0x3b
	[0177.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\yw1pmegurub.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.594] GetFileType (hFile=0x318) returned 0x1
	[0177.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.594] GetFileType (hFile=0x318) returned 0x1
	[0177.595] WriteFile (in: hFile=0x318, lpBuffer=0x416cd10*, nNumberOfBytesToWrite=0x17d70, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x416cd10*, lpNumberOfBytesWritten=0x99f040*=0x17d70, lpOverlapped=0x0) returned 1
	[0177.597] CloseHandle (hObject=0x318) returned 1
	[0177.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3", lpFilePart=0x0) returned 0x3b
	[0177.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x6a
	[0177.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.597] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\yw1pmegurub.mp3"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddeee00, ftCreationTime.dwHighDateTime=0x1d4cf8c, ftLastAccessTime.dwLowDateTime=0x13f200e0, ftLastAccessTime.dwHighDateTime=0x1d4d121, ftLastWriteTime.dwLowDateTime=0xa42eb6cd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x17d70)) returned 1
	[0177.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.597] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\yw1pmegurub.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q Wq-DMID\\U6h1N4h7-KU\\yW1PmeGURuB.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\q wq-dmid\\u6h1n4h7-ku\\yw1pmegurub.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav", lpFilePart=0x0) returned 0x2c
	[0177.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.598] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\89wmc3x.wav"), fInfoLevelId=0x0, lpFileInformation=0x2798530 | out: lpFileInformation=0x2798530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x320e1830, ftCreationTime.dwHighDateTime=0x1d4d33c, ftLastAccessTime.dwLowDateTime=0xc063d860, ftLastAccessTime.dwHighDateTime=0x1d4cead, ftLastWriteTime.dwLowDateTime=0xc063d860, ftLastWriteTime.dwHighDateTime=0x1d4cead, nFileSizeHigh=0x0, nFileSizeLow=0x17a7c)) returned 1
	[0177.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav", lpFilePart=0x0) returned 0x2c
	[0177.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.599] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\89wmc3x.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.599] GetFileType (hFile=0x318) returned 0x1
	[0177.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.599] GetFileType (hFile=0x318) returned 0x1
	[0177.599] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x17a7c
	[0177.600] ReadFile (in: hFile=0x318, lpBuffer=0x4184aa0, nNumberOfBytesToRead=0x17a7c, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x4184aa0*, lpNumberOfBytesRead=0x99f04c*=0x17a7c, lpOverlapped=0x0) returned 1
	[0177.602] CloseHandle (hObject=0x318) returned 1
	[0177.602] CryptDestroyKey (hKey=0x82b380) returned 1
	[0177.602] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.602] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27987b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0177.602] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.602] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.602] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0177.602] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.602] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2798868*=0x1, dwFlags=0x0) returned 1
	[0177.602] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2798834, dwFlags=0x0) returned 1
	[0177.603] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x419c538*, pdwDataLen=0x99f054*=0x17a80, dwBufLen=0x17a80 | out: pbData=0x419c538*, pdwDataLen=0x99f054*=0x17a80) returned 1
	[0177.603] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2798878*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2798878*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.604] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.604] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.604] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav", lpFilePart=0x0) returned 0x2c
	[0177.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.604] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\89wmc3x.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.605] GetFileType (hFile=0x318) returned 0x1
	[0177.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.606] GetFileType (hFile=0x318) returned 0x1
	[0177.606] WriteFile (in: hFile=0x318, lpBuffer=0x419c538*, nNumberOfBytesToWrite=0x17a80, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x419c538*, lpNumberOfBytesWritten=0x99f040*=0x17a80, lpOverlapped=0x0) returned 1
	[0177.608] CloseHandle (hObject=0x318) returned 1
	[0177.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav", lpFilePart=0x0) returned 0x2c
	[0177.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5b
	[0177.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\89wmc3x.wav"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x320e1830, ftCreationTime.dwHighDateTime=0x1d4d33c, ftLastAccessTime.dwLowDateTime=0xc063d860, ftLastAccessTime.dwHighDateTime=0x1d4cead, ftLastWriteTime.dwLowDateTime=0xa43118fb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x17a80)) returned 1
	[0177.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.608] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\89wmc3x.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\89Wmc3x.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\89wmc3x.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.609] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav", lpFilePart=0x0) returned 0x36
	[0177.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.609] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\cgwkld3exb7l54l5r.wav"), fInfoLevelId=0x0, lpFileInformation=0x2798bf8 | out: lpFileInformation=0x2798bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc732c0, ftCreationTime.dwHighDateTime=0x1d4d23e, ftLastAccessTime.dwLowDateTime=0x47bf14d0, ftLastAccessTime.dwHighDateTime=0x1d4d19e, ftLastWriteTime.dwLowDateTime=0x47bf14d0, ftLastWriteTime.dwHighDateTime=0x1d4d19e, nFileSizeHigh=0x0, nFileSizeLow=0x123ee)) returned 1
	[0177.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.609] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav", lpFilePart=0x0) returned 0x36
	[0177.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.609] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\cgwkld3exb7l54l5r.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.609] GetFileType (hFile=0x318) returned 0x1
	[0177.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.609] GetFileType (hFile=0x318) returned 0x1
	[0177.610] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x123ee
	[0177.610] ReadFile (in: hFile=0x318, lpBuffer=0x2798e38, nNumberOfBytesToRead=0x123ee, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2798e38*, lpNumberOfBytesRead=0x99f04c*=0x123ee, lpOverlapped=0x0) returned 1
	[0177.611] CloseHandle (hObject=0x318) returned 1
	[0177.611] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.611] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.611] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27ab2c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0177.611] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.611] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.611] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b480) returned 1
	[0177.611] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.611] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x27ab37c*=0x1, dwFlags=0x0) returned 1
	[0177.611] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x27ab348, dwFlags=0x0) returned 1
	[0177.611] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27ab38c*, pdwDataLen=0x99f054*=0x123f0, dwBufLen=0x123f0 | out: pbData=0x27ab38c*, pdwDataLen=0x99f054*=0x123f0) returned 1
	[0177.611] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27bd788*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27bd788*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.611] CryptDestroyKey (hKey=0x82b480) returned 1
	[0177.611] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.611] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.612] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav", lpFilePart=0x0) returned 0x36
	[0177.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.612] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\cgwkld3exb7l54l5r.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.613] GetFileType (hFile=0x318) returned 0x1
	[0177.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.613] GetFileType (hFile=0x318) returned 0x1
	[0177.613] WriteFile (in: hFile=0x318, lpBuffer=0x27ab38c*, nNumberOfBytesToWrite=0x123f0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x27ab38c*, lpNumberOfBytesWritten=0x99f040*=0x123f0, lpOverlapped=0x0) returned 1
	[0177.615] CloseHandle (hObject=0x318) returned 1
	[0177.632] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav", lpFilePart=0x0) returned 0x36
	[0177.632] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0177.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.632] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\cgwkld3exb7l54l5r.wav"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc732c0, ftCreationTime.dwHighDateTime=0x1d4d23e, ftLastAccessTime.dwLowDateTime=0x47bf14d0, ftLastAccessTime.dwHighDateTime=0x1d4d19e, ftLastWriteTime.dwLowDateTime=0xa43118fb, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x123f0)) returned 1
	[0177.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.632] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\cgwkld3exb7l54l5r.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\CgwKLd3exb7L54L5R.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\cgwkld3exb7l54l5r.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.633] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a", lpFilePart=0x0) returned 0x2e
	[0177.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.633] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\ezb18_lxm.m4a"), fInfoLevelId=0x0, lpFileInformation=0x27bdb80 | out: lpFileInformation=0x27bdb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf930c50, ftCreationTime.dwHighDateTime=0x1d4ceff, ftLastAccessTime.dwLowDateTime=0xca8638c0, ftLastAccessTime.dwHighDateTime=0x1d4c98e, ftLastWriteTime.dwLowDateTime=0xca8638c0, ftLastWriteTime.dwHighDateTime=0x1d4c98e, nFileSizeHigh=0x0, nFileSizeLow=0x308d)) returned 1
	[0177.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a", lpFilePart=0x0) returned 0x2e
	[0177.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.634] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\ezb18_lxm.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.634] GetFileType (hFile=0x318) returned 0x1
	[0177.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.634] GetFileType (hFile=0x318) returned 0x1
	[0177.634] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x308d
	[0177.634] ReadFile (in: hFile=0x318, lpBuffer=0x27bdd80, nNumberOfBytesToRead=0x308d, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27bdd80*, lpNumberOfBytesRead=0x99f04c*=0x308d, lpOverlapped=0x0) returned 1
	[0177.635] CloseHandle (hObject=0x318) returned 1
	[0177.635] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.635] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.635] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27c0eac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b4c0) returned 1
	[0177.635] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.635] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.635] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0177.635] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.635] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27c0f64*=0x1, dwFlags=0x0) returned 1
	[0177.635] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27c0f30, dwFlags=0x0) returned 1
	[0177.636] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27c0f74*, pdwDataLen=0x99f054*=0x3090, dwBufLen=0x3090 | out: pbData=0x27c0f74*, pdwDataLen=0x99f054*=0x3090) returned 1
	[0177.636] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c4010*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27c4010*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.636] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0177.636] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.636] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.636] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a", lpFilePart=0x0) returned 0x2e
	[0177.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.636] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\ezb18_lxm.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.637] GetFileType (hFile=0x318) returned 0x1
	[0177.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.637] GetFileType (hFile=0x318) returned 0x1
	[0177.637] WriteFile (in: hFile=0x318, lpBuffer=0x27c0f74*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x27c0f74*, lpNumberOfBytesWritten=0x99f040*=0x3090, lpOverlapped=0x0) returned 1
	[0177.638] CloseHandle (hObject=0x318) returned 1
	[0177.638] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a", lpFilePart=0x0) returned 0x2e
	[0177.638] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5d
	[0177.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.639] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\ezb18_lxm.m4a"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf930c50, ftCreationTime.dwHighDateTime=0x1d4ceff, ftLastAccessTime.dwLowDateTime=0xca8638c0, ftLastAccessTime.dwHighDateTime=0x1d4c98e, ftLastWriteTime.dwLowDateTime=0xa435de4c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x3090)) returned 1
	[0177.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.639] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\ezb18_lxm.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\eZb18_LXm.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\ezb18_lxm.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.639] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav", lpFilePart=0x0) returned 0x36
	[0177.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.640] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\phevbq7kz2kzjue3t.wav"), fInfoLevelId=0x0, lpFileInformation=0x27c43a8 | out: lpFileInformation=0x27c43a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a5b00d0, ftCreationTime.dwHighDateTime=0x1d4c6c0, ftLastAccessTime.dwLowDateTime=0xa2d06b60, ftLastAccessTime.dwHighDateTime=0x1d4cbc9, ftLastWriteTime.dwLowDateTime=0xa2d06b60, ftLastWriteTime.dwHighDateTime=0x1d4cbc9, nFileSizeHigh=0x0, nFileSizeLow=0x11df3)) returned 1
	[0177.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.640] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav", lpFilePart=0x0) returned 0x36
	[0177.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.640] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\phevbq7kz2kzjue3t.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.640] GetFileType (hFile=0x318) returned 0x1
	[0177.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.640] GetFileType (hFile=0x318) returned 0x1
	[0177.640] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x11df3
	[0177.640] ReadFile (in: hFile=0x318, lpBuffer=0x27c45e8, nNumberOfBytesToRead=0x11df3, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27c45e8*, lpNumberOfBytesRead=0x99f04c*=0x11df3, lpOverlapped=0x0) returned 1
	[0177.641] CloseHandle (hObject=0x318) returned 1
	[0177.641] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0177.641] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.641] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27d6478, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0177.641] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.641] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.642] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0177.642] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.642] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27d6530*=0x1, dwFlags=0x0) returned 1
	[0177.642] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x27d64fc, dwFlags=0x0) returned 1
	[0177.642] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d6540*, pdwDataLen=0x99f054*=0x11e00, dwBufLen=0x11e00 | out: pbData=0x27d6540*, pdwDataLen=0x99f054*=0x11e00) returned 1
	[0177.642] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27e834c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27e834c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.642] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.642] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.642] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.642] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav", lpFilePart=0x0) returned 0x36
	[0177.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.642] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\phevbq7kz2kzjue3t.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.643] GetFileType (hFile=0x318) returned 0x1
	[0177.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.644] GetFileType (hFile=0x318) returned 0x1
	[0177.644] WriteFile (in: hFile=0x318, lpBuffer=0x27d6540*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x27d6540*, lpNumberOfBytesWritten=0x99f040*=0x11e00, lpOverlapped=0x0) returned 1
	[0177.645] CloseHandle (hObject=0x318) returned 1
	[0177.645] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav", lpFilePart=0x0) returned 0x36
	[0177.646] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x65
	[0177.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.646] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\phevbq7kz2kzjue3t.wav"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a5b00d0, ftCreationTime.dwHighDateTime=0x1d4c6c0, ftLastAccessTime.dwLowDateTime=0xa2d06b60, ftLastAccessTime.dwHighDateTime=0x1d4cbc9, ftLastWriteTime.dwLowDateTime=0xa435de4c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x11e00)) returned 1
	[0177.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.646] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\phevbq7kz2kzjue3t.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\PHEvbq7kz2KzJUe3T.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\phevbq7kz2kzjue3t.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.647] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav", lpFilePart=0x0) returned 0x2f
	[0177.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.647] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\qjy9iwtpp1.wav"), fInfoLevelId=0x0, lpFileInformation=0x27e8744 | out: lpFileInformation=0x27e8744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28ef58b0, ftCreationTime.dwHighDateTime=0x1d4d317, ftLastAccessTime.dwLowDateTime=0x52a01310, ftLastAccessTime.dwHighDateTime=0x1d4ce68, ftLastWriteTime.dwLowDateTime=0x52a01310, ftLastWriteTime.dwHighDateTime=0x1d4ce68, nFileSizeHigh=0x0, nFileSizeLow=0x13a52)) returned 1
	[0177.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.647] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav", lpFilePart=0x0) returned 0x2f
	[0177.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.647] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\qjy9iwtpp1.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.648] GetFileType (hFile=0x318) returned 0x1
	[0177.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.648] GetFileType (hFile=0x318) returned 0x1
	[0177.648] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x13a52
	[0177.648] ReadFile (in: hFile=0x318, lpBuffer=0x27e894c, nNumberOfBytesToRead=0x13a52, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27e894c*, lpNumberOfBytesRead=0x99f04c*=0x13a52, lpOverlapped=0x0) returned 1
	[0177.649] CloseHandle (hObject=0x318) returned 1
	[0177.649] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0177.649] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.649] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27fc43c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b000) returned 1
	[0177.649] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.649] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.649] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b380) returned 1
	[0177.649] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.649] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x27fc4f4*=0x1, dwFlags=0x0) returned 1
	[0177.649] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x27fc4c0, dwFlags=0x0) returned 1
	[0177.649] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27fc504*, pdwDataLen=0x99f054*=0x13a60, dwBufLen=0x13a60 | out: pbData=0x27fc504*, pdwDataLen=0x99f054*=0x13a60) returned 1
	[0177.650] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x280ff70*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x280ff70*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.650] CryptDestroyKey (hKey=0x82b380) returned 1
	[0177.650] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.650] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav", lpFilePart=0x0) returned 0x2f
	[0177.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\qjy9iwtpp1.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.652] GetFileType (hFile=0x318) returned 0x1
	[0177.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.652] GetFileType (hFile=0x318) returned 0x1
	[0177.652] WriteFile (in: hFile=0x318, lpBuffer=0x27fc504*, nNumberOfBytesToWrite=0x13a60, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x27fc504*, lpNumberOfBytesWritten=0x99f040*=0x13a60, lpOverlapped=0x0) returned 1
	[0177.654] CloseHandle (hObject=0x318) returned 1
	[0177.654] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav", lpFilePart=0x0) returned 0x2f
	[0177.654] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5e
	[0177.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.654] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\qjy9iwtpp1.wav"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28ef58b0, ftCreationTime.dwHighDateTime=0x1d4d317, ftLastAccessTime.dwLowDateTime=0x52a01310, ftLastAccessTime.dwHighDateTime=0x1d4ce68, ftLastWriteTime.dwLowDateTime=0xa4384012, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13a60)) returned 1
	[0177.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.654] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\qjy9iwtpp1.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\qjY9iWTpP1.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\qjy9iwtpp1.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.655] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3", lpFilePart=0x0) returned 0x30
	[0177.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.655] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\seskh0gxzch.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2810318 | out: lpFileInformation=0x2810318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b73d40, ftCreationTime.dwHighDateTime=0x1d4c82b, ftLastAccessTime.dwLowDateTime=0x6d2fe300, ftLastAccessTime.dwHighDateTime=0x1d4cc28, ftLastWriteTime.dwLowDateTime=0x6d2fe300, ftLastWriteTime.dwHighDateTime=0x1d4cc28, nFileSizeHigh=0x0, nFileSizeLow=0x13eab)) returned 1
	[0177.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.655] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3", lpFilePart=0x0) returned 0x30
	[0177.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.655] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\seskh0gxzch.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.655] GetFileType (hFile=0x318) returned 0x1
	[0177.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.655] GetFileType (hFile=0x318) returned 0x1
	[0177.656] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x13eab
	[0177.656] ReadFile (in: hFile=0x318, lpBuffer=0x2810528, nNumberOfBytesToRead=0x13eab, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2810528*, lpNumberOfBytesRead=0x99f04c*=0x13eab, lpOverlapped=0x0) returned 1
	[0177.657] CloseHandle (hObject=0x318) returned 1
	[0177.657] CryptDestroyKey (hKey=0x82b000) returned 1
	[0177.657] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.657] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2824470, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b340) returned 1
	[0177.657] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.657] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.657] CryptDuplicateKey (in: hKey=0x82b340, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0177.657] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.657] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x2824528*=0x1, dwFlags=0x0) returned 1
	[0177.657] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x28244f4, dwFlags=0x0) returned 1
	[0177.659] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2629038*, pdwDataLen=0x99f054*=0x13eb0, dwBufLen=0x13eb0 | out: pbData=0x2629038*, pdwDataLen=0x99f054*=0x13eb0) returned 1
	[0177.659] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x263cef4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x263cef4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.659] CryptDestroyKey (hKey=0x82b300) returned 1
	[0177.659] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.659] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3", lpFilePart=0x0) returned 0x30
	[0177.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.660] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\seskh0gxzch.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.661] GetFileType (hFile=0x318) returned 0x1
	[0177.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.661] GetFileType (hFile=0x318) returned 0x1
	[0177.661] WriteFile (in: hFile=0x318, lpBuffer=0x2629038*, nNumberOfBytesToWrite=0x13eb0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x2629038*, lpNumberOfBytesWritten=0x99f040*=0x13eb0, lpOverlapped=0x0) returned 1
	[0177.664] CloseHandle (hObject=0x318) returned 1
	[0177.664] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3", lpFilePart=0x0) returned 0x30
	[0177.664] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x5f
	[0177.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\seskh0gxzch.mp3"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b73d40, ftCreationTime.dwHighDateTime=0x1d4c82b, ftLastAccessTime.dwLowDateTime=0x6d2fe300, ftLastAccessTime.dwHighDateTime=0x1d4cc28, ftLastWriteTime.dwLowDateTime=0xa43aa25a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13eb0)) returned 1
	[0177.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.664] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\seskh0gxzch.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\SEsKh0GxZcH.mp3 id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\seskh0gxzch.mp3 id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a", lpFilePart=0x0) returned 0x38
	[0177.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\y8-sdtuo9lmhptyv6na.m4a"), fInfoLevelId=0x0, lpFileInformation=0x263d2a4 | out: lpFileInformation=0x263d2a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67f446e0, ftCreationTime.dwHighDateTime=0x1d4cd10, ftLastAccessTime.dwLowDateTime=0x963500b0, ftLastAccessTime.dwHighDateTime=0x1d4c911, ftLastWriteTime.dwLowDateTime=0x963500b0, ftLastWriteTime.dwHighDateTime=0x1d4c911, nFileSizeHigh=0x0, nFileSizeLow=0x309e)) returned 1
	[0177.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a", lpFilePart=0x0) returned 0x38
	[0177.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.665] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\y8-sdtuo9lmhptyv6na.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.666] GetFileType (hFile=0x318) returned 0x1
	[0177.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.666] GetFileType (hFile=0x318) returned 0x1
	[0177.666] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x309e
	[0177.666] ReadFile (in: hFile=0x318, lpBuffer=0x263d4f4, nNumberOfBytesToRead=0x309e, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x263d4f4*, lpNumberOfBytesRead=0x99f04c*=0x309e, lpOverlapped=0x0) returned 1
	[0177.667] CloseHandle (hObject=0x318) returned 1
	[0177.667] CryptDestroyKey (hKey=0x82b340) returned 1
	[0177.667] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.667] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2640630, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0177.667] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.667] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.667] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0177.667] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.667] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26406e8*=0x1, dwFlags=0x0) returned 1
	[0177.667] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26406b4, dwFlags=0x0) returned 1
	[0177.667] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26406f8*, pdwDataLen=0x99f054*=0x30a0, dwBufLen=0x30a0 | out: pbData=0x26406f8*, pdwDataLen=0x99f054*=0x30a0) returned 1
	[0177.667] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26437a4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26437a4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.667] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0177.667] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.667] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.667] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a", lpFilePart=0x0) returned 0x38
	[0177.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.668] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\y8-sdtuo9lmhptyv6na.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.669] GetFileType (hFile=0x318) returned 0x1
	[0177.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.669] GetFileType (hFile=0x318) returned 0x1
	[0177.669] WriteFile (in: hFile=0x318, lpBuffer=0x26406f8*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x26406f8*, lpNumberOfBytesWritten=0x99f040*=0x30a0, lpOverlapped=0x0) returned 1
	[0177.670] CloseHandle (hObject=0x318) returned 1
	[0177.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a", lpFilePart=0x0) returned 0x38
	[0177.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x67
	[0177.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\y8-sdtuo9lmhptyv6na.m4a"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67f446e0, ftCreationTime.dwHighDateTime=0x1d4cd10, ftLastAccessTime.dwLowDateTime=0x963500b0, ftLastAccessTime.dwHighDateTime=0x1d4c911, ftLastWriteTime.dwLowDateTime=0xa43aa25a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x30a0)) returned 1
	[0177.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.670] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\y8-sdtuo9lmhptyv6na.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\Y8-sdtuo9lmHptYv6nA.m4a id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\y8-sdtuo9lmhptyv6na.m4a id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav", lpFilePart=0x0) returned 0x37
	[0177.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.671] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\yqyejl3q3bdlcp5071.wav"), fInfoLevelId=0x0, lpFileInformation=0x2643bb4 | out: lpFileInformation=0x2643bb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf057b510, ftCreationTime.dwHighDateTime=0x1d4c86c, ftLastAccessTime.dwLowDateTime=0x2346cd50, ftLastAccessTime.dwHighDateTime=0x1d4d428, ftLastWriteTime.dwLowDateTime=0x2346cd50, ftLastWriteTime.dwHighDateTime=0x1d4d428, nFileSizeHigh=0x0, nFileSizeLow=0x13217)) returned 1
	[0177.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0177.672] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav", lpFilePart=0x0) returned 0x37
	[0177.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0177.672] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\yqyejl3q3bdlcp5071.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.672] GetFileType (hFile=0x318) returned 0x1
	[0177.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0177.672] GetFileType (hFile=0x318) returned 0x1
	[0177.672] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x13217
	[0177.672] ReadFile (in: hFile=0x318, lpBuffer=0x2643dfc, nNumberOfBytesToRead=0x13217, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2643dfc*, lpNumberOfBytesRead=0x99f04c*=0x13217, lpOverlapped=0x0) returned 1
	[0177.673] CloseHandle (hObject=0x318) returned 1
	[0177.673] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0177.673] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.673] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26570b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b480) returned 1
	[0177.673] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.673] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.673] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b080) returned 1
	[0177.673] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0177.674] CryptSetKeyParam (hKey=0x82b080, dwParam=0x4, pbData=0x2657168*=0x1, dwFlags=0x0) returned 1
	[0177.674] CryptSetKeyParam (hKey=0x82b080, dwParam=0x1, pbData=0x2657134, dwFlags=0x0) returned 1
	[0177.674] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2657178*, pdwDataLen=0x99f054*=0x13220, dwBufLen=0x13220 | out: pbData=0x2657178*, pdwDataLen=0x99f054*=0x13220) returned 1
	[0177.674] CryptEncrypt (in: hKey=0x82b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x266a3a4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x266a3a4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0177.674] CryptDestroyKey (hKey=0x82b080) returned 1
	[0177.674] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.674] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0177.674] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav", lpFilePart=0x0) returned 0x37
	[0177.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0177.674] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\yqyejl3q3bdlcp5071.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0177.676] GetFileType (hFile=0x318) returned 0x1
	[0177.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0177.676] GetFileType (hFile=0x318) returned 0x1
	[0177.676] WriteFile (in: hFile=0x318, lpBuffer=0x2657178*, nNumberOfBytesToWrite=0x13220, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x2657178*, lpNumberOfBytesWritten=0x99f040*=0x13220, lpOverlapped=0x0) returned 1
	[0177.678] CloseHandle (hObject=0x318) returned 1
	[0177.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav", lpFilePart=0x0) returned 0x37
	[0177.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0x66
	[0177.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0177.678] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\yqyejl3q3bdlcp5071.wav"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf057b510, ftCreationTime.dwHighDateTime=0x1d4c86c, ftLastAccessTime.dwLowDateTime=0x2346cd50, ftLastAccessTime.dwHighDateTime=0x1d4d428, ftLastWriteTime.dwLowDateTime=0xa43aa25a, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x13220)) returned 1
	[0177.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0177.678] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\yqyejl3q3bdlcp5071.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Wi16N\\7E1l\\YQyejL3Q3BdLcp5071.wav id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\users\\fd1hvy\\music\\wi16n\\7e1l\\yqyejl3q3bdlcp5071.wav id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0177.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv", lpFilePart=0x0) returned 0x4a
	[0177.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0177.698] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\G8cFu 9vqjW8W\\vjv-EpWxcyYy7bdaz\\7ykkDpBs2v4mYOa.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\g8cfu 9vqjw8w\\vjv-epwxcyyy7bdaz\\7ykkdpbs2v4myoa.mkv"), fInfoLevelId=0x0, lpFileInformation=0x266a7ac | out: lpFileInformation=0x266a7ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d56580, ftCreationTime.dwHighDateTime=0x1d4cba5, ftLastAccessTime.dwLowDateTime=0xbb425e0, ftLastAccessTime.dwHighDateTime=0x1d4c7c4, ftLastWriteTime.dwLowDateTime=0xbb425e0, ftLastWriteTime.dwHighDateTime=0x1d4c7c4, nFileSizeHigh=0x0, nFileSizeLow=0xe505)) returned 1
	[0177.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0179.651] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash", lpFilePart=0x0) returned 0x79
	[0179.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0179.651] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0179.651] GetFileType (hFile=0x318) returned 0x1
	[0179.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0179.651] GetFileType (hFile=0x318) returned 0x1
	[0179.652] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x80
	[0179.652] ReadFile (in: hFile=0x318, lpBuffer=0x2629b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2629b10*, lpNumberOfBytesRead=0x99f04c*=0x80, lpOverlapped=0x0) returned 1
	[0179.652] CloseHandle (hObject=0x318) returned 1
	[0179.653] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0179.653] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0179.653] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262abac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b100) returned 1
	[0179.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0179.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0179.653] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0179.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0179.653] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x262ac64*=0x1, dwFlags=0x0) returned 1
	[0179.653] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x262ac30, dwFlags=0x0) returned 1
	[0179.653] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x262ac74*, pdwDataLen=0x99f054*=0x90, dwBufLen=0x90 | out: pbData=0x262ac74*, pdwDataLen=0x99f054*=0x90) returned 1
	[0179.653] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262ad10*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x262ad10*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0179.653] CryptDestroyKey (hKey=0x82b540) returned 1
	[0179.653] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0179.653] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0179.653] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash", lpFilePart=0x0) returned 0x79
	[0179.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0179.653] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0179.654] GetFileType (hFile=0x318) returned 0x1
	[0179.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0179.654] GetFileType (hFile=0x318) returned 0x1
	[0179.654] WriteFile (in: hFile=0x318, lpBuffer=0x262aec4*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x262aec4*, lpNumberOfBytesWritten=0x99f014*=0x90, lpOverlapped=0x0) returned 1
	[0179.655] CloseHandle (hObject=0x318) returned 1
	[0179.655] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash", lpFilePart=0x0) returned 0x79
	[0179.655] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa8
	[0179.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0179.655] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa5696d14, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1
	[0179.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0179.656] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0179.656] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat", lpFilePart=0x0) returned 0x7c
	[0179.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0179.656] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x262c3b8 | out: lpFileInformation=0x262c3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47)) returned 1
	[0179.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0179.657] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat", lpFilePart=0x0) returned 0x7c
	[0179.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0179.657] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0179.657] GetFileType (hFile=0x318) returned 0x1
	[0179.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0179.657] GetFileType (hFile=0x318) returned 0x1
	[0179.658] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x460b47
	[0179.667] ReadFile (in: hFile=0x318, lpBuffer=0x3c29f48, nNumberOfBytesToRead=0x460b47, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x3c29f48*, lpNumberOfBytesRead=0x99f04c*=0x460b47, lpOverlapped=0x0) returned 1
	[0180.027] CloseHandle (hObject=0x318) returned 1
	[0180.028] CryptDestroyKey (hKey=0x82b100) returned 1
	[0180.028] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0180.028] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262c7b0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0180.028] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0180.028] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0180.028] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0180.028] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0180.028] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x262c868*=0x1, dwFlags=0x0) returned 1
	[0180.028] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x262c834, dwFlags=0x0) returned 1
	[0180.098] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x622a150*, pdwDataLen=0x99f054*=0x460b50, dwBufLen=0x460b50 | out: pbData=0x622a150*, pdwDataLen=0x99f054*=0x460b50) returned 1
	[0180.112] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262c878*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x262c878*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0180.112] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0180.112] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0180.112] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0180.112] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat", lpFilePart=0x0) returned 0x7c
	[0180.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0180.112] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0180.117] GetFileType (hFile=0x318) returned 0x1
	[0180.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0180.117] GetFileType (hFile=0x318) returned 0x1
	[0180.117] WriteFile (in: hFile=0x318, lpBuffer=0x622a150*, nNumberOfBytesToWrite=0x460b50, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x622a150*, lpNumberOfBytesWritten=0x99f040*=0x460b50, lpOverlapped=0x0) returned 1
	[0180.229] CloseHandle (hObject=0x318) returned 1
	[0180.229] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat", lpFilePart=0x0) returned 0x7c
	[0180.229] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xab
	[0180.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0180.229] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa5c1eb7e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x460b50)) returned 1
	[0180.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0180.229] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0180.230] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat", lpFilePart=0x0) returned 0x7a
	[0180.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0180.230] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x262cf34 | out: lpFileInformation=0x262cf34*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693)) returned 1
	[0180.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0180.269] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat", lpFilePart=0x0) returned 0x7a
	[0180.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0180.269] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0180.269] GetFileType (hFile=0x318) returned 0x1
	[0180.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0180.270] GetFileType (hFile=0x318) returned 0x1
	[0180.270] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x108693
	[0180.273] ReadFile (in: hFile=0x318, lpBuffer=0x5941018, nNumberOfBytesToRead=0x108693, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x5941018*, lpNumberOfBytesRead=0x99f04c*=0x108693, lpOverlapped=0x0) returned 1
	[0180.320] CloseHandle (hObject=0x318) returned 1
	[0180.320] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0180.320] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0180.320] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262d324, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0180.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0180.320] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0180.321] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b400) returned 1
	[0180.321] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0180.321] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x262d3dc*=0x1, dwFlags=0x0) returned 1
	[0180.321] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x262d3a8, dwFlags=0x0) returned 1
	[0180.345] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x408aab0*, pdwDataLen=0x99f054*=0x1086a0, dwBufLen=0x1086a0 | out: pbData=0x408aab0*, pdwDataLen=0x99f054*=0x1086a0) returned 1
	[0180.346] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262d3ec*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x262d3ec*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0180.346] CryptDestroyKey (hKey=0x82b400) returned 1
	[0180.346] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0180.346] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0180.346] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat", lpFilePart=0x0) returned 0x7a
	[0180.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0180.346] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0180.348] GetFileType (hFile=0x318) returned 0x1
	[0180.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0180.348] GetFileType (hFile=0x318) returned 0x1
	[0180.348] WriteFile (in: hFile=0x318, lpBuffer=0x408aab0*, nNumberOfBytesToWrite=0x1086a0, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x408aab0*, lpNumberOfBytesWritten=0x99f040*=0x1086a0, lpOverlapped=0x0) returned 1
	[0180.383] CloseHandle (hObject=0x318) returned 1
	[0180.384] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat", lpFilePart=0x0) returned 0x7a
	[0180.384] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xa9
	[0180.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0180.384] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0xa5d97c36, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1086a0)) returned 1
	[0180.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0180.384] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0180.385] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat", lpFilePart=0x0) returned 0x7c
	[0180.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0180.385] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x262da94 | out: lpFileInformation=0x262da94*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47)) returned 1
	[0180.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0180.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat", lpFilePart=0x0) returned 0x7c
	[0180.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0180.400] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0180.400] GetFileType (hFile=0x318) returned 0x1
	[0180.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0180.400] GetFileType (hFile=0x318) returned 0x1
	[0180.400] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x460b47
	[0180.411] ReadFile (in: hFile=0x318, lpBuffer=0x6941018, nNumberOfBytesToRead=0x460b47, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x6941018*, lpNumberOfBytesRead=0x99f04c*=0x460b47, lpOverlapped=0x0) returned 1
	[0180.776] CloseHandle (hObject=0x318) returned 1
	[0180.776] CryptDestroyKey (hKey=0x82b540) returned 1
	[0180.776] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0180.776] CryptImportKey (in: hProv=0x7f93c0, pbData=0x262de8c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0180.776] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0180.776] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0180.776] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b480) returned 1
	[0180.776] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0180.776] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x262df44*=0x1, dwFlags=0x0) returned 1
	[0180.776] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x262df10, dwFlags=0x0) returned 1
	[0180.920] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6da1b80*, pdwDataLen=0x99f054*=0x460b50, dwBufLen=0x460b50 | out: pbData=0x6da1b80*, pdwDataLen=0x99f054*=0x460b50) returned 1
	[0180.923] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x262df54*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x262df54*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0180.923] CryptDestroyKey (hKey=0x82b480) returned 1
	[0180.923] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0180.924] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0180.924] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat", lpFilePart=0x0) returned 0x7c
	[0180.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0180.924] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0180.928] GetFileType (hFile=0x318) returned 0x1
	[0180.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0180.928] GetFileType (hFile=0x318) returned 0x1
	[0180.928] WriteFile (in: hFile=0x318, lpBuffer=0x6da1b80*, nNumberOfBytesToWrite=0x460b50, lpNumberOfBytesWritten=0x99f040, lpOverlapped=0x0 | out: lpBuffer=0x6da1b80*, lpNumberOfBytesWritten=0x99f040*=0x460b50, lpOverlapped=0x0) returned 1
	[0181.058] CloseHandle (hObject=0x318) returned 1
	[0181.058] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat", lpFilePart=0x0) returned 0x7c
	[0181.059] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xab
	[0181.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0181.059] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0xa64000cd, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x460b50)) returned 1
	[0181.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0181.059] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0181.059] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x64
	[0181.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0181.060] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), fInfoLevelId=0x0, lpFileInformation=0x262e610 | out: lpFileInformation=0x262e610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536)) returned 1
	[0181.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0181.062] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.105] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.162] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.178] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.179] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.183] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.184] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.189] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.198] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.207] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.208] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.357] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.385] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.389] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.390] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.395] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.396] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.401] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.421] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.422] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.429] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.430] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.434] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.435] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.446] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.447] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.451] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.452] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.456] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.457] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.461] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.615] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.629] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.641] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.642] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.646] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.647] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.660] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.661] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.674] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.675] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.680] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.681] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.685] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.699] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.704] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.705] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.709] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0181.710] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.133] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.198] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.243] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.253] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.254] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.261] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.262] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.269] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.270] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.275] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.276] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.281] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.286] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.287] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.314] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.391] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.397] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.398] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.403] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.413] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.416] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.417] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.421] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.422] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.427] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.432] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.433] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.445] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.474] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.483] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.484] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.489] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.490] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.495] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.496] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.499] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.500] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.509] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.512] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.513] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.517] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.518] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.529] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.530] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.539] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.545] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.546] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.551] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.554] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.562] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0182.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.169] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.201] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.202] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.261] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.322] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.398] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.461] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.472] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.478] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.511] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.512] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0183.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.004] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.057] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.102] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.149] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.179] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.180] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.242] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.305] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0184.956] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.012] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.070] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.130] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.182] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.238] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.260] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.283] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.518] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.529] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.530] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.543] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.549] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.554] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.555] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.586] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.587] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.597] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.598] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.603] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.604] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.608] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.609] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.614] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.618] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.626] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.627] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.631] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.632] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.637] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.641] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.642] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.647] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.647] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.652] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.653] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.656] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.666] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.681] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.697] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.775] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.781] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.783] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.885] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0185.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.009] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.072] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.134] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.476] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.686] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.744] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0186.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.178] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.279] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.401] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.462] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.521] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.864] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.922] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.946] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.975] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.976] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0187.987] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.025] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.086] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.146] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.215] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.231] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.309] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.358] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0188.413] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.413] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.414] GetFileType (hFile=0x318) returned 0x1
	[0188.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.414] GetFileType (hFile=0x318) returned 0x1
	[0188.414] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2c7
	[0188.414] ReadFile (in: hFile=0x318, lpBuffer=0x26a39c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26a39c0*, lpNumberOfBytesRead=0x99f04c*=0x2c7, lpOverlapped=0x0) returned 1
	[0188.415] CloseHandle (hObject=0x318) returned 1
	[0188.415] CryptDestroyKey (hKey=0x82b400) returned 1
	[0188.415] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.415] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a4a5c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0188.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.416] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0188.416] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.416] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26a4b14*=0x1, dwFlags=0x0) returned 1
	[0188.416] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26a4ae0, dwFlags=0x0) returned 1
	[0188.416] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a4b24*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26a4b24*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0188.416] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a4e00*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26a4e00*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.416] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.416] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.416] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.416] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.416] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.418] GetFileType (hFile=0x318) returned 0x1
	[0188.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.418] GetFileType (hFile=0x318) returned 0x1
	[0188.418] WriteFile (in: hFile=0x318, lpBuffer=0x26a504c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26a504c*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.419] CloseHandle (hObject=0x318) returned 1
	[0188.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0188.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.419] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaaa3ab62, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.420] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.421] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.421] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26a6650 | out: lpFileInformation=0x26a6650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0188.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.421] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.421] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.422] GetFileType (hFile=0x318) returned 0x1
	[0188.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.422] GetFileType (hFile=0x318) returned 0x1
	[0188.422] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2d3
	[0188.422] ReadFile (in: hFile=0x318, lpBuffer=0x26a6dd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26a6dd0*, lpNumberOfBytesRead=0x99f04c*=0x2d3, lpOverlapped=0x0) returned 1
	[0188.423] CloseHandle (hObject=0x318) returned 1
	[0188.423] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0188.423] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.424] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26a7e6c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b300) returned 1
	[0188.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.424] CryptDuplicateKey (in: hKey=0x82b300, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0188.424] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.424] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26a7f24*=0x1, dwFlags=0x0) returned 1
	[0188.424] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26a7ef0, dwFlags=0x0) returned 1
	[0188.424] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a7f34*, pdwDataLen=0x99f054*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26a7f34*, pdwDataLen=0x99f054*=0x2e0) returned 1
	[0188.424] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a8220*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26a8220*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.424] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0188.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.424] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.424] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.424] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.426] GetFileType (hFile=0x318) returned 0x1
	[0188.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.426] GetFileType (hFile=0x318) returned 0x1
	[0188.426] WriteFile (in: hFile=0x318, lpBuffer=0x26a847c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26a847c*, lpNumberOfBytesWritten=0x99f014*=0x2e0, lpOverlapped=0x0) returned 1
	[0188.427] CloseHandle (hObject=0x318) returned 1
	[0188.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0188.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.427] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaaa3ab62, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0188.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.427] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.428] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.428] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26a9a94 | out: lpFileInformation=0x26a9a94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0188.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.429] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.429] GetFileType (hFile=0x318) returned 0x1
	[0188.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.429] GetFileType (hFile=0x318) returned 0x1
	[0188.429] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2cd
	[0188.429] ReadFile (in: hFile=0x318, lpBuffer=0x26aa210, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26aa210*, lpNumberOfBytesRead=0x99f04c*=0x2cd, lpOverlapped=0x0) returned 1
	[0188.431] CloseHandle (hObject=0x318) returned 1
	[0188.431] CryptDestroyKey (hKey=0x82b300) returned 1
	[0188.431] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.431] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ab2ac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b0c0) returned 1
	[0188.431] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.431] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.431] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0188.431] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.431] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26ab364*=0x1, dwFlags=0x0) returned 1
	[0188.431] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26ab330, dwFlags=0x0) returned 1
	[0188.431] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ab374*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26ab374*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0188.431] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ab650*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26ab650*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.431] CryptDestroyKey (hKey=0x82b300) returned 1
	[0188.431] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.431] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.431] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.432] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.433] GetFileType (hFile=0x318) returned 0x1
	[0188.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.433] GetFileType (hFile=0x318) returned 0x1
	[0188.433] WriteFile (in: hFile=0x318, lpBuffer=0x26ab8ac*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26ab8ac*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.434] CloseHandle (hObject=0x318) returned 1
	[0188.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0188.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.434] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaaa60d8d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.435] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.436] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.436] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26acec4 | out: lpFileInformation=0x26acec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0188.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.437] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.437] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.437] GetFileType (hFile=0x318) returned 0x1
	[0188.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.437] GetFileType (hFile=0x318) returned 0x1
	[0188.437] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2cd
	[0188.437] ReadFile (in: hFile=0x318, lpBuffer=0x26ad640, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26ad640*, lpNumberOfBytesRead=0x99f04c*=0x2cd, lpOverlapped=0x0) returned 1
	[0188.439] CloseHandle (hObject=0x318) returned 1
	[0188.439] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0188.439] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.439] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ae6dc, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b280) returned 1
	[0188.439] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.439] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.439] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0188.439] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.439] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26ae794*=0x1, dwFlags=0x0) returned 1
	[0188.439] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26ae760, dwFlags=0x0) returned 1
	[0188.439] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ae7a4*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26ae7a4*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0188.439] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26aea80*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26aea80*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.440] CryptDestroyKey (hKey=0x82b300) returned 1
	[0188.440] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.440] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.440] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.440] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.441] GetFileType (hFile=0x318) returned 0x1
	[0188.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.441] GetFileType (hFile=0x318) returned 0x1
	[0188.441] WriteFile (in: hFile=0x318, lpBuffer=0x26aecdc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26aecdc*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.442] CloseHandle (hObject=0x318) returned 1
	[0188.442] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9e
	[0188.442] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0188.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.442] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaaa60d8d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.443] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.444] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.444] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b02f4 | out: lpFileInformation=0x26b02f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910bc9cd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0188.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.444] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.444] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.444] GetFileType (hFile=0x318) returned 0x1
	[0188.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.444] GetFileType (hFile=0x318) returned 0x1
	[0188.444] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2c0
	[0188.445] ReadFile (in: hFile=0x318, lpBuffer=0x26b0a50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26b0a50*, lpNumberOfBytesRead=0x99f04c*=0x2c0, lpOverlapped=0x0) returned 1
	[0188.446] CloseHandle (hObject=0x318) returned 1
	[0188.446] CryptDestroyKey (hKey=0x82b280) returned 1
	[0188.446] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.446] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b1aec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0188.446] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.446] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.446] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b340) returned 1
	[0188.446] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.446] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26b1ba4*=0x1, dwFlags=0x0) returned 1
	[0188.446] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26b1b70, dwFlags=0x0) returned 1
	[0188.446] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b1bb4*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26b1bb4*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0188.446] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b1e90*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26b1e90*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.447] CryptDestroyKey (hKey=0x82b340) returned 1
	[0188.447] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.447] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.447] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.447] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.465] GetFileType (hFile=0x318) returned 0x1
	[0188.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.465] GetFileType (hFile=0x318) returned 0x1
	[0188.465] WriteFile (in: hFile=0x318, lpBuffer=0x26b20e4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26b20e4*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.466] CloseHandle (hObject=0x318) returned 1
	[0188.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0188.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0188.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.467] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaaaad37e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.467] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0188.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.468] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b36f8 | out: lpFileInformation=0x26b36f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910bc9cd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x281)) returned 1
	[0188.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0188.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.469] GetFileType (hFile=0x318) returned 0x1
	[0188.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.469] GetFileType (hFile=0x318) returned 0x1
	[0188.469] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x281
	[0188.469] ReadFile (in: hFile=0x318, lpBuffer=0x26b3df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26b3df8*, lpNumberOfBytesRead=0x99f04c*=0x281, lpOverlapped=0x0) returned 1
	[0188.470] CloseHandle (hObject=0x318) returned 1
	[0188.470] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.470] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.470] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b4e94, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b080) returned 1
	[0188.470] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.470] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.470] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b480) returned 1
	[0188.471] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.471] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x26b4f4c*=0x1, dwFlags=0x0) returned 1
	[0188.471] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x26b4f18, dwFlags=0x0) returned 1
	[0188.471] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b4f5c*, pdwDataLen=0x99f054*=0x290, dwBufLen=0x290 | out: pbData=0x26b4f5c*, pdwDataLen=0x99f054*=0x290) returned 1
	[0188.471] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b51f8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26b51f8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.471] CryptDestroyKey (hKey=0x82b480) returned 1
	[0188.471] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.471] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0188.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.471] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.472] GetFileType (hFile=0x318) returned 0x1
	[0188.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.472] GetFileType (hFile=0x318) returned 0x1
	[0188.472] WriteFile (in: hFile=0x318, lpBuffer=0x26b543c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26b543c*, lpNumberOfBytesWritten=0x99f014*=0x290, lpOverlapped=0x0) returned 1
	[0188.473] CloseHandle (hObject=0x318) returned 1
	[0188.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0188.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0188.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.473] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaaaad37e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0188.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.473] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0188.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.474] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b6a30 | out: lpFileInformation=0x26b6a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910bc9cd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287)) returned 1
	[0188.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0188.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.475] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.475] GetFileType (hFile=0x318) returned 0x1
	[0188.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.475] GetFileType (hFile=0x318) returned 0x1
	[0188.475] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x287
	[0188.475] ReadFile (in: hFile=0x318, lpBuffer=0x26b7164, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26b7164*, lpNumberOfBytesRead=0x99f04c*=0x287, lpOverlapped=0x0) returned 1
	[0188.476] CloseHandle (hObject=0x318) returned 1
	[0188.476] CryptDestroyKey (hKey=0x82b080) returned 1
	[0188.476] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.476] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26b8200, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b200) returned 1
	[0188.476] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.476] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.476] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0188.476] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.476] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26b82b8*=0x1, dwFlags=0x0) returned 1
	[0188.476] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26b8284, dwFlags=0x0) returned 1
	[0188.477] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26b82c8*, pdwDataLen=0x99f054*=0x290, dwBufLen=0x290 | out: pbData=0x26b82c8*, pdwDataLen=0x99f054*=0x290) returned 1
	[0188.477] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b8564*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26b8564*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.477] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.477] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.477] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.477] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0188.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.477] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.478] GetFileType (hFile=0x318) returned 0x1
	[0188.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.478] GetFileType (hFile=0x318) returned 0x1
	[0188.478] WriteFile (in: hFile=0x318, lpBuffer=0x26b87c0*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26b87c0*, lpNumberOfBytesWritten=0x99f014*=0x290, lpOverlapped=0x0) returned 1
	[0188.479] CloseHandle (hObject=0x318) returned 1
	[0188.479] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0188.479] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0188.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.479] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaaaad37e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0188.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.479] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.480] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0188.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.480] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26b9de4 | out: lpFileInformation=0x26b9de4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910bc9cd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be)) returned 1
	[0188.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0188.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.481] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.481] GetFileType (hFile=0x318) returned 0x1
	[0188.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.481] GetFileType (hFile=0x318) returned 0x1
	[0188.481] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2be
	[0188.481] ReadFile (in: hFile=0x318, lpBuffer=0x26ba580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26ba580*, lpNumberOfBytesRead=0x99f04c*=0x2be, lpOverlapped=0x0) returned 1
	[0188.482] CloseHandle (hObject=0x318) returned 1
	[0188.482] CryptDestroyKey (hKey=0x82b200) returned 1
	[0188.482] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.483] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26bb61c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0188.483] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.483] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.483] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b380) returned 1
	[0188.483] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.483] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26bb6d4*=0x1, dwFlags=0x0) returned 1
	[0188.483] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x26bb6a0, dwFlags=0x0) returned 1
	[0188.483] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26bb6e4*, pdwDataLen=0x99f054*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x26bb6e4*, pdwDataLen=0x99f054*=0x2c0) returned 1
	[0188.483] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bb9b0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26bb9b0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.483] CryptDestroyKey (hKey=0x82b380) returned 1
	[0188.483] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.483] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0188.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.483] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.484] GetFileType (hFile=0x318) returned 0x1
	[0188.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.484] GetFileType (hFile=0x318) returned 0x1
	[0188.484] WriteFile (in: hFile=0x318, lpBuffer=0x26bbc24*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26bbc24*, lpNumberOfBytesWritten=0x99f014*=0x2c0, lpOverlapped=0x0) returned 1
	[0188.485] CloseHandle (hObject=0x318) returned 1
	[0188.485] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa5
	[0188.485] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd4
	[0188.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.485] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaaad3545, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0188.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.486] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.487] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0188.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.487] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26bd278 | out: lpFileInformation=0x26bd278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910e2c39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a)) returned 1
	[0188.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.487] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0188.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.487] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.487] GetFileType (hFile=0x318) returned 0x1
	[0188.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.488] GetFileType (hFile=0x318) returned 0x1
	[0188.488] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x28a
	[0188.488] ReadFile (in: hFile=0x318, lpBuffer=0x26bda10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26bda10*, lpNumberOfBytesRead=0x99f04c*=0x28a, lpOverlapped=0x0) returned 1
	[0188.489] CloseHandle (hObject=0x318) returned 1
	[0188.489] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.489] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.489] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26beaac, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0188.489] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.489] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.490] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0188.490] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.490] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26beb64*=0x1, dwFlags=0x0) returned 1
	[0188.490] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26beb30, dwFlags=0x0) returned 1
	[0188.490] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26beb74*, pdwDataLen=0x99f054*=0x290, dwBufLen=0x290 | out: pbData=0x26beb74*, pdwDataLen=0x99f054*=0x290) returned 1
	[0188.490] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bee10*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26bee10*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.490] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.490] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.490] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.490] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0188.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.490] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.491] GetFileType (hFile=0x318) returned 0x1
	[0188.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.492] GetFileType (hFile=0x318) returned 0x1
	[0188.492] WriteFile (in: hFile=0x318, lpBuffer=0x26bf09c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26bf09c*, lpNumberOfBytesWritten=0x99f014*=0x290, lpOverlapped=0x0) returned 1
	[0188.493] CloseHandle (hObject=0x318) returned 1
	[0188.493] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xaa
	[0188.493] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd9
	[0188.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.493] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaaad3545, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0188.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.493] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.494] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0188.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.494] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26c0714 | out: lpFileInformation=0x26c0714*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910e2c39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294)) returned 1
	[0188.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.494] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0188.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.495] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.495] GetFileType (hFile=0x318) returned 0x1
	[0188.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.495] GetFileType (hFile=0x318) returned 0x1
	[0188.495] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x294
	[0188.495] ReadFile (in: hFile=0x318, lpBuffer=0x26c0eb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26c0eb4*, lpNumberOfBytesRead=0x99f04c*=0x294, lpOverlapped=0x0) returned 1
	[0188.497] CloseHandle (hObject=0x318) returned 1
	[0188.497] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.497] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.497] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c1f50, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b480) returned 1
	[0188.497] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.497] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.497] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0188.497] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.497] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26c2008*=0x1, dwFlags=0x0) returned 1
	[0188.497] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26c1fd4, dwFlags=0x0) returned 1
	[0188.497] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c2018*, pdwDataLen=0x99f054*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x26c2018*, pdwDataLen=0x99f054*=0x2a0) returned 1
	[0188.497] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c22c4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26c22c4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.497] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.497] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.497] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.497] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0188.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.498] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.499] GetFileType (hFile=0x318) returned 0x1
	[0188.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.499] GetFileType (hFile=0x318) returned 0x1
	[0188.499] WriteFile (in: hFile=0x318, lpBuffer=0x26c2550*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26c2550*, lpNumberOfBytesWritten=0x99f014*=0x2a0, lpOverlapped=0x0) returned 1
	[0188.500] CloseHandle (hObject=0x318) returned 1
	[0188.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0188.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xda
	[0188.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.500] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaaaf9870, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0188.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.500] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.501] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xba
	[0188.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.501] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26c3bd4 | out: lpFileInformation=0x26c3bd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910e2c39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29f)) returned 1
	[0188.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.501] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xba
	[0188.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.502] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.502] GetFileType (hFile=0x318) returned 0x1
	[0188.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.502] GetFileType (hFile=0x318) returned 0x1
	[0188.502] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x29f
	[0188.502] ReadFile (in: hFile=0x318, lpBuffer=0x26c4400, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26c4400*, lpNumberOfBytesRead=0x99f04c*=0x29f, lpOverlapped=0x0) returned 1
	[0188.526] CloseHandle (hObject=0x318) returned 1
	[0188.527] CryptDestroyKey (hKey=0x82b480) returned 1
	[0188.527] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.527] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c549c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0188.527] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.527] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.527] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b040) returned 1
	[0188.527] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.527] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x26c5554*=0x1, dwFlags=0x0) returned 1
	[0188.527] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x26c5520, dwFlags=0x0) returned 1
	[0188.527] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c5564*, pdwDataLen=0x99f054*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x26c5564*, pdwDataLen=0x99f054*=0x2a0) returned 1
	[0188.527] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c5810*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26c5810*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.527] CryptDestroyKey (hKey=0x82b040) returned 1
	[0188.527] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.527] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.527] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xba
	[0188.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.527] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.529] GetFileType (hFile=0x318) returned 0x1
	[0188.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.529] GetFileType (hFile=0x318) returned 0x1
	[0188.529] WriteFile (in: hFile=0x318, lpBuffer=0x26c5adc*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26c5adc*, lpNumberOfBytesWritten=0x99f014*=0x2a0, lpOverlapped=0x0) returned 1
	[0188.530] CloseHandle (hObject=0x318) returned 1
	[0188.530] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xba
	[0188.530] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe9
	[0188.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.530] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaab45c89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1
	[0188.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.530] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.531] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.531] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26c71d4 | out: lpFileInformation=0x26c71d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0188.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.532] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.532] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.532] GetFileType (hFile=0x318) returned 0x1
	[0188.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.532] GetFileType (hFile=0x318) returned 0x1
	[0188.532] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2c8
	[0188.532] ReadFile (in: hFile=0x318, lpBuffer=0x26c7928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26c7928*, lpNumberOfBytesRead=0x99f04c*=0x2c8, lpOverlapped=0x0) returned 1
	[0188.534] CloseHandle (hObject=0x318) returned 1
	[0188.534] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.534] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26c89c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b100) returned 1
	[0188.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.534] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b340) returned 1
	[0188.534] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.534] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26c8a7c*=0x1, dwFlags=0x0) returned 1
	[0188.534] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26c8a48, dwFlags=0x0) returned 1
	[0188.534] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c8a8c*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26c8a8c*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0188.534] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c8d68*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26c8d68*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.534] CryptDestroyKey (hKey=0x82b340) returned 1
	[0188.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.534] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.534] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.535] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.536] GetFileType (hFile=0x318) returned 0x1
	[0188.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.536] GetFileType (hFile=0x318) returned 0x1
	[0188.536] WriteFile (in: hFile=0x318, lpBuffer=0x26c8fb4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26c8fb4*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.537] CloseHandle (hObject=0x318) returned 1
	[0188.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0188.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.537] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaab45c89, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.538] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.538] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb6
	[0188.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.539] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26ca5b8 | out: lpFileInformation=0x26ca5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910e2c39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e5)) returned 1
	[0188.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.539] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb6
	[0188.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.539] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.539] GetFileType (hFile=0x318) returned 0x1
	[0188.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.539] GetFileType (hFile=0x318) returned 0x1
	[0188.539] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2e5
	[0188.539] ReadFile (in: hFile=0x318, lpBuffer=0x26cae0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26cae0c*, lpNumberOfBytesRead=0x99f04c*=0x2e5, lpOverlapped=0x0) returned 1
	[0188.540] CloseHandle (hObject=0x318) returned 1
	[0188.540] CryptDestroyKey (hKey=0x82b100) returned 1
	[0188.541] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.541] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26cbea8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b5c0) returned 1
	[0188.541] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.541] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.541] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0188.541] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.541] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x26cbf60*=0x1, dwFlags=0x0) returned 1
	[0188.541] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x26cbf2c, dwFlags=0x0) returned 1
	[0188.541] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26cbf70*, pdwDataLen=0x99f054*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x26cbf70*, pdwDataLen=0x99f054*=0x2f0) returned 1
	[0188.541] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26cc26c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26cc26c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.541] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.541] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.541] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.541] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb6
	[0188.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.541] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.543] GetFileType (hFile=0x318) returned 0x1
	[0188.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.543] GetFileType (hFile=0x318) returned 0x1
	[0188.543] WriteFile (in: hFile=0x318, lpBuffer=0x26cc528*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26cc528*, lpNumberOfBytesWritten=0x99f014*=0x2f0, lpOverlapped=0x0) returned 1
	[0188.544] CloseHandle (hObject=0x318) returned 1
	[0188.544] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xb6
	[0188.544] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xe5
	[0188.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.544] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaab6bdc1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0188.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.544] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.545] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.545] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26cdc00 | out: lpFileInformation=0x26cdc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91108ea4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x368)) returned 1
	[0188.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.546] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.546] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.546] GetFileType (hFile=0x318) returned 0x1
	[0188.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.546] GetFileType (hFile=0x318) returned 0x1
	[0188.546] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x368
	[0188.546] ReadFile (in: hFile=0x318, lpBuffer=0x26ce444, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26ce444*, lpNumberOfBytesRead=0x99f04c*=0x368, lpOverlapped=0x0) returned 1
	[0188.548] CloseHandle (hObject=0x318) returned 1
	[0188.548] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0188.548] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.548] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26cf4e0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b100) returned 1
	[0188.548] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.548] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.548] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b2c0) returned 1
	[0188.548] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.548] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x4, pbData=0x26cf598*=0x1, dwFlags=0x0) returned 1
	[0188.548] CryptSetKeyParam (hKey=0x82b2c0, dwParam=0x1, pbData=0x26cf564, dwFlags=0x0) returned 1
	[0188.548] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26cf5a8*, pdwDataLen=0x99f054*=0x370, dwBufLen=0x370 | out: pbData=0x26cf5a8*, pdwDataLen=0x99f054*=0x370) returned 1
	[0188.548] CryptEncrypt (in: hKey=0x82b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26cf924*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26cf924*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.549] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0188.549] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.549] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.549] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.549] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.550] GetFileType (hFile=0x318) returned 0x1
	[0188.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.550] GetFileType (hFile=0x318) returned 0x1
	[0188.550] WriteFile (in: hFile=0x318, lpBuffer=0x26cfb98*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26cfb98*, lpNumberOfBytesWritten=0x99f014*=0x370, lpOverlapped=0x0) returned 1
	[0188.551] CloseHandle (hObject=0x318) returned 1
	[0188.551] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.551] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0188.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.551] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaab6bdc1, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1
	[0188.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.551] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.552] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.552] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26d11e0 | out: lpFileInformation=0x26d11e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91108ea4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x359)) returned 1
	[0188.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.553] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.553] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.553] GetFileType (hFile=0x318) returned 0x1
	[0188.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.553] GetFileType (hFile=0x318) returned 0x1
	[0188.553] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x359
	[0188.553] ReadFile (in: hFile=0x318, lpBuffer=0x26d1a18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26d1a18*, lpNumberOfBytesRead=0x99f04c*=0x359, lpOverlapped=0x0) returned 1
	[0188.554] CloseHandle (hObject=0x318) returned 1
	[0188.554] CryptDestroyKey (hKey=0x82b100) returned 1
	[0188.554] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.555] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d2ab4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b100) returned 1
	[0188.555] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.555] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.555] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0188.555] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.555] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26d2b6c*=0x1, dwFlags=0x0) returned 1
	[0188.555] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26d2b38, dwFlags=0x0) returned 1
	[0188.555] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d2b7c*, pdwDataLen=0x99f054*=0x360, dwBufLen=0x360 | out: pbData=0x26d2b7c*, pdwDataLen=0x99f054*=0x360) returned 1
	[0188.555] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d2ee8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26d2ee8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.555] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.555] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.555] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.555] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.555] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.556] GetFileType (hFile=0x318) returned 0x1
	[0188.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.556] GetFileType (hFile=0x318) returned 0x1
	[0188.556] WriteFile (in: hFile=0x318, lpBuffer=0x26d315c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26d315c*, lpNumberOfBytesWritten=0x99f014*=0x360, lpOverlapped=0x0) returned 1
	[0188.557] CloseHandle (hObject=0x318) returned 1
	[0188.557] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.557] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0188.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.557] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaab9205e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0188.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.558] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.559] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.559] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26d47a4 | out: lpFileInformation=0x26d47a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91108ea4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354)) returned 1
	[0188.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.559] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.560] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.560] GetFileType (hFile=0x318) returned 0x1
	[0188.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.560] GetFileType (hFile=0x318) returned 0x1
	[0188.560] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x354
	[0188.560] ReadFile (in: hFile=0x318, lpBuffer=0x26d4fd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26d4fd4*, lpNumberOfBytesRead=0x99f04c*=0x354, lpOverlapped=0x0) returned 1
	[0188.586] CloseHandle (hObject=0x318) returned 1
	[0188.586] CryptDestroyKey (hKey=0x82b100) returned 1
	[0188.586] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.586] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d6070, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0188.586] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.586] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.586] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0188.586] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.586] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x26d6128*=0x1, dwFlags=0x0) returned 1
	[0188.586] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x26d60f4, dwFlags=0x0) returned 1
	[0188.586] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d6138*, pdwDataLen=0x99f054*=0x360, dwBufLen=0x360 | out: pbData=0x26d6138*, pdwDataLen=0x99f054*=0x360) returned 1
	[0188.586] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d64a4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26d64a4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.586] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.586] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.586] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.586] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.588] GetFileType (hFile=0x318) returned 0x1
	[0188.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.588] GetFileType (hFile=0x318) returned 0x1
	[0188.588] WriteFile (in: hFile=0x318, lpBuffer=0x26d6718*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26d6718*, lpNumberOfBytesWritten=0x99f014*=0x360, lpOverlapped=0x0) returned 1
	[0188.589] CloseHandle (hObject=0x318) returned 1
	[0188.589] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.589] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0188.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.589] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaabde52b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0188.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.589] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.590] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.590] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26d7d60 | out: lpFileInformation=0x26d7d60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9112f110, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e)) returned 1
	[0188.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.590] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.591] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.591] GetFileType (hFile=0x318) returned 0x1
	[0188.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.591] GetFileType (hFile=0x318) returned 0x1
	[0188.591] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x34e
	[0188.591] ReadFile (in: hFile=0x318, lpBuffer=0x26d858c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26d858c*, lpNumberOfBytesRead=0x99f04c*=0x34e, lpOverlapped=0x0) returned 1
	[0188.592] CloseHandle (hObject=0x318) returned 1
	[0188.592] CryptDestroyKey (hKey=0x82b540) returned 1
	[0188.592] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.593] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26d9628, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b400) returned 1
	[0188.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.593] CryptDuplicateKey (in: hKey=0x82b400, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0188.593] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.593] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26d96e0*=0x1, dwFlags=0x0) returned 1
	[0188.593] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26d96ac, dwFlags=0x0) returned 1
	[0188.593] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26d96f0*, pdwDataLen=0x99f054*=0x350, dwBufLen=0x350 | out: pbData=0x26d96f0*, pdwDataLen=0x99f054*=0x350) returned 1
	[0188.593] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d9a4c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26d9a4c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.593] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.593] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.593] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.593] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.593] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.595] GetFileType (hFile=0x318) returned 0x1
	[0188.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.595] GetFileType (hFile=0x318) returned 0x1
	[0188.595] WriteFile (in: hFile=0x318, lpBuffer=0x26d9cc0*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26d9cc0*, lpNumberOfBytesWritten=0x99f014*=0x350, lpOverlapped=0x0) returned 1
	[0188.596] CloseHandle (hObject=0x318) returned 1
	[0188.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0188.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.596] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaabde52b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0188.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.596] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.597] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.598] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26db308 | out: lpFileInformation=0x26db308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9112f110, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9112f110, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9112f110, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354)) returned 1
	[0188.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.598] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.598] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.598] GetFileType (hFile=0x318) returned 0x1
	[0188.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.598] GetFileType (hFile=0x318) returned 0x1
	[0188.598] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x354
	[0188.598] ReadFile (in: hFile=0x318, lpBuffer=0x26dbb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26dbb38*, lpNumberOfBytesRead=0x99f04c*=0x354, lpOverlapped=0x0) returned 1
	[0188.600] CloseHandle (hObject=0x318) returned 1
	[0188.600] CryptDestroyKey (hKey=0x82b400) returned 1
	[0188.600] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.600] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26dcbd4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b040) returned 1
	[0188.600] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.600] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.600] CryptDuplicateKey (in: hKey=0x82b040, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b200) returned 1
	[0188.600] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.600] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x26dcc8c*=0x1, dwFlags=0x0) returned 1
	[0188.600] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x26dcc58, dwFlags=0x0) returned 1
	[0188.601] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26dcc9c*, pdwDataLen=0x99f054*=0x360, dwBufLen=0x360 | out: pbData=0x26dcc9c*, pdwDataLen=0x99f054*=0x360) returned 1
	[0188.601] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dd008*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26dd008*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.601] CryptDestroyKey (hKey=0x82b200) returned 1
	[0188.601] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.601] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.601] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.602] GetFileType (hFile=0x318) returned 0x1
	[0188.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.602] GetFileType (hFile=0x318) returned 0x1
	[0188.602] WriteFile (in: hFile=0x318, lpBuffer=0x26dd27c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26dd27c*, lpNumberOfBytesWritten=0x99f014*=0x360, lpOverlapped=0x0) returned 1
	[0188.603] CloseHandle (hObject=0x318) returned 1
	[0188.604] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0188.604] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0188.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.604] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9112f110, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9112f110, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaabde52b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0188.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.604] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.605] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26de8c4 | out: lpFileInformation=0x26de8c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9112f110, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9112f110, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9112f110, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c7)) returned 1
	[0188.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.606] ReadFile (in: hFile=0x318, lpBuffer=0x26def38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26def38*, lpNumberOfBytesRead=0x99f04c*=0x1c7, lpOverlapped=0x0) returned 1
	[0188.607] CryptDestroyKey (hKey=0x82b040) returned 1
	[0188.607] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.607] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26dffd4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b480) returned 1
	[0188.607] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.607] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.607] CryptDuplicateKey (in: hKey=0x82b480, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b000) returned 1
	[0188.607] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.607] CryptSetKeyParam (hKey=0x82b000, dwParam=0x4, pbData=0x26e008c*=0x1, dwFlags=0x0) returned 1
	[0188.607] CryptSetKeyParam (hKey=0x82b000, dwParam=0x1, pbData=0x26e0058, dwFlags=0x0) returned 1
	[0188.607] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e009c*, pdwDataLen=0x99f054*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26e009c*, pdwDataLen=0x99f054*=0x1d0) returned 1
	[0188.607] CryptEncrypt (in: hKey=0x82b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e0278*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26e0278*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.607] CryptDestroyKey (hKey=0x82b000) returned 1
	[0188.607] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.607] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.607] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.607] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.609] GetFileType (hFile=0x318) returned 0x1
	[0188.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.609] GetFileType (hFile=0x318) returned 0x1
	[0188.609] WriteFile (in: hFile=0x318, lpBuffer=0x26e04d4*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26e04d4*, lpNumberOfBytesWritten=0x99f014*=0x1d0, lpOverlapped=0x0) returned 1
	[0188.610] CloseHandle (hObject=0x318) returned 1
	[0188.610] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0188.610] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0188.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.610] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9112f110, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9112f110, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaac047c5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0188.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.611] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.612] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0188.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.612] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26e1aec | out: lpFileInformation=0x26e1aec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9112f110, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9112f110, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9112f110, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a)) returned 1
	[0188.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.612] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0188.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.613] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.613] GetFileType (hFile=0x318) returned 0x1
	[0188.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.613] GetFileType (hFile=0x318) returned 0x1
	[0188.613] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x34a
	[0188.613] ReadFile (in: hFile=0x318, lpBuffer=0x26e22e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26e22e4*, lpNumberOfBytesRead=0x99f04c*=0x34a, lpOverlapped=0x0) returned 1
	[0188.614] CloseHandle (hObject=0x318) returned 1
	[0188.614] CryptDestroyKey (hKey=0x82b480) returned 1
	[0188.614] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.614] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e3380, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0188.614] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.615] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.615] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b440) returned 1
	[0188.615] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.615] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26e3438*=0x1, dwFlags=0x0) returned 1
	[0188.615] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26e3404, dwFlags=0x0) returned 1
	[0188.615] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e3448*, pdwDataLen=0x99f054*=0x350, dwBufLen=0x350 | out: pbData=0x26e3448*, pdwDataLen=0x99f054*=0x350) returned 1
	[0188.615] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e37a4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26e37a4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.615] CryptDestroyKey (hKey=0x82b440) returned 1
	[0188.615] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.615] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.615] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0188.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.615] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.616] GetFileType (hFile=0x318) returned 0x1
	[0188.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.616] GetFileType (hFile=0x318) returned 0x1
	[0188.616] WriteFile (in: hFile=0x318, lpBuffer=0x26e3a00*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26e3a00*, lpNumberOfBytesWritten=0x99f014*=0x350, lpOverlapped=0x0) returned 1
	[0188.617] CloseHandle (hObject=0x318) returned 1
	[0188.617] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9f
	[0188.617] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xce
	[0188.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.617] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9112f110, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9112f110, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaac047c5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0188.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.618] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.619] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.619] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26e5024 | out: lpFileInformation=0x26e5024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9115537f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c)) returned 1
	[0188.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.619] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.619] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.619] GetFileType (hFile=0x318) returned 0x1
	[0188.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.619] GetFileType (hFile=0x318) returned 0x1
	[0188.619] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x34c
	[0188.619] ReadFile (in: hFile=0x318, lpBuffer=0x26e586c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26e586c*, lpNumberOfBytesRead=0x99f04c*=0x34c, lpOverlapped=0x0) returned 1
	[0188.638] CloseHandle (hObject=0x318) returned 1
	[0188.638] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0188.638] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.638] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e6908, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b4c0) returned 1
	[0188.639] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.639] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.639] CryptDuplicateKey (in: hKey=0x82b4c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0188.639] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.639] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26e69c0*=0x1, dwFlags=0x0) returned 1
	[0188.639] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26e698c, dwFlags=0x0) returned 1
	[0188.639] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e69d0*, pdwDataLen=0x99f054*=0x350, dwBufLen=0x350 | out: pbData=0x26e69d0*, pdwDataLen=0x99f054*=0x350) returned 1
	[0188.639] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e6d2c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26e6d2c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.639] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.639] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.639] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.639] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.640] GetFileType (hFile=0x318) returned 0x1
	[0188.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.640] GetFileType (hFile=0x318) returned 0x1
	[0188.640] WriteFile (in: hFile=0x318, lpBuffer=0x26e6fb0*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26e6fb0*, lpNumberOfBytesWritten=0x99f014*=0x350, lpOverlapped=0x0) returned 1
	[0188.641] CloseHandle (hObject=0x318) returned 1
	[0188.641] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.641] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0188.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.642] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaac50cc5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0188.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.642] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.644] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26e8618 | out: lpFileInformation=0x26e8618*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9115537f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34d)) returned 1
	[0188.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.644] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.644] GetFileType (hFile=0x318) returned 0x1
	[0188.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.644] GetFileType (hFile=0x318) returned 0x1
	[0188.644] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x34d
	[0188.645] ReadFile (in: hFile=0x318, lpBuffer=0x26e8e64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26e8e64*, lpNumberOfBytesRead=0x99f04c*=0x34d, lpOverlapped=0x0) returned 1
	[0188.646] CloseHandle (hObject=0x318) returned 1
	[0188.646] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0188.646] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.646] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26e9f00, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0188.646] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.646] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.646] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b300) returned 1
	[0188.646] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.646] CryptSetKeyParam (hKey=0x82b300, dwParam=0x4, pbData=0x26e9fb8*=0x1, dwFlags=0x0) returned 1
	[0188.646] CryptSetKeyParam (hKey=0x82b300, dwParam=0x1, pbData=0x26e9f84, dwFlags=0x0) returned 1
	[0188.646] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e9fc8*, pdwDataLen=0x99f054*=0x350, dwBufLen=0x350 | out: pbData=0x26e9fc8*, pdwDataLen=0x99f054*=0x350) returned 1
	[0188.646] CryptEncrypt (in: hKey=0x82b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ea324*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26ea324*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.646] CryptDestroyKey (hKey=0x82b300) returned 1
	[0188.646] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.646] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.647] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.648] GetFileType (hFile=0x318) returned 0x1
	[0188.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.648] GetFileType (hFile=0x318) returned 0x1
	[0188.648] WriteFile (in: hFile=0x318, lpBuffer=0x26ea5a8*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26ea5a8*, lpNumberOfBytesWritten=0x99f014*=0x350, lpOverlapped=0x0) returned 1
	[0188.649] CloseHandle (hObject=0x318) returned 1
	[0188.649] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.649] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0188.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.649] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaac50cc5, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1
	[0188.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.649] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.650] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26ebc10 | out: lpFileInformation=0x26ebc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0188.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.651] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.651] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.651] GetFileType (hFile=0x318) returned 0x1
	[0188.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.651] GetFileType (hFile=0x318) returned 0x1
	[0188.651] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2cc
	[0188.651] ReadFile (in: hFile=0x318, lpBuffer=0x26ec368, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26ec368*, lpNumberOfBytesRead=0x99f04c*=0x2cc, lpOverlapped=0x0) returned 1
	[0188.652] CloseHandle (hObject=0x318) returned 1
	[0188.653] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0188.653] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.653] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26ed404, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0188.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.653] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b340) returned 1
	[0188.653] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.653] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x26ed4bc*=0x1, dwFlags=0x0) returned 1
	[0188.653] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x26ed488, dwFlags=0x0) returned 1
	[0188.653] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26ed4cc*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26ed4cc*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0188.653] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26ed7a8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26ed7a8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.653] CryptDestroyKey (hKey=0x82b340) returned 1
	[0188.653] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.653] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.653] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.653] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.654] GetFileType (hFile=0x318) returned 0x1
	[0188.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.654] GetFileType (hFile=0x318) returned 0x1
	[0188.654] WriteFile (in: hFile=0x318, lpBuffer=0x26ed9f4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26ed9f4*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0188.655] CloseHandle (hObject=0x318) returned 1
	[0188.655] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9b
	[0188.655] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xca
	[0188.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.655] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaac76eb3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0188.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.656] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.657] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.657] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26eeff8 | out: lpFileInformation=0x26eeff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9115537f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x359)) returned 1
	[0188.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.657] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.657] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.657] GetFileType (hFile=0x318) returned 0x1
	[0188.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.657] GetFileType (hFile=0x318) returned 0x1
	[0188.658] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x359
	[0188.658] ReadFile (in: hFile=0x318, lpBuffer=0x26ef850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26ef850*, lpNumberOfBytesRead=0x99f04c*=0x359, lpOverlapped=0x0) returned 1
	[0188.659] CloseHandle (hObject=0x318) returned 1
	[0188.659] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0188.659] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.659] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f08ec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b080) returned 1
	[0188.659] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.659] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.659] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b380) returned 1
	[0188.659] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.659] CryptSetKeyParam (hKey=0x82b380, dwParam=0x4, pbData=0x26f09a4*=0x1, dwFlags=0x0) returned 1
	[0188.659] CryptSetKeyParam (hKey=0x82b380, dwParam=0x1, pbData=0x26f0970, dwFlags=0x0) returned 1
	[0188.659] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f09b4*, pdwDataLen=0x99f054*=0x360, dwBufLen=0x360 | out: pbData=0x26f09b4*, pdwDataLen=0x99f054*=0x360) returned 1
	[0188.660] CryptEncrypt (in: hKey=0x82b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f0d20*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26f0d20*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.660] CryptDestroyKey (hKey=0x82b380) returned 1
	[0188.660] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.660] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.660] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.660] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.661] GetFileType (hFile=0x318) returned 0x1
	[0188.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.661] GetFileType (hFile=0x318) returned 0x1
	[0188.661] WriteFile (in: hFile=0x318, lpBuffer=0x26f0fa4*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26f0fa4*, lpNumberOfBytesWritten=0x99f014*=0x360, lpOverlapped=0x0) returned 1
	[0188.662] CloseHandle (hObject=0x318) returned 1
	[0188.662] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.662] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0188.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.662] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaac76eb3, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0188.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.662] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.664] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.664] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f260c | out: lpFileInformation=0x26f260c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9115537f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353)) returned 1
	[0188.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.664] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.664] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.664] GetFileType (hFile=0x318) returned 0x1
	[0188.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.664] GetFileType (hFile=0x318) returned 0x1
	[0188.664] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x353
	[0188.664] ReadFile (in: hFile=0x318, lpBuffer=0x26f2e5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26f2e5c*, lpNumberOfBytesRead=0x99f04c*=0x353, lpOverlapped=0x0) returned 1
	[0188.666] CloseHandle (hObject=0x318) returned 1
	[0188.666] CryptDestroyKey (hKey=0x82b080) returned 1
	[0188.666] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.666] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f3ef8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b5c0) returned 1
	[0188.666] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.666] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.666] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0188.666] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.666] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x26f3fb0*=0x1, dwFlags=0x0) returned 1
	[0188.666] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x26f3f7c, dwFlags=0x0) returned 1
	[0188.667] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f3fc0*, pdwDataLen=0x99f054*=0x360, dwBufLen=0x360 | out: pbData=0x26f3fc0*, pdwDataLen=0x99f054*=0x360) returned 1
	[0188.667] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f432c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26f432c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.667] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0188.667] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.667] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.667] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.668] GetFileType (hFile=0x318) returned 0x1
	[0188.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.668] GetFileType (hFile=0x318) returned 0x1
	[0188.668] WriteFile (in: hFile=0x318, lpBuffer=0x26f45b0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26f45b0*, lpNumberOfBytesWritten=0x99f014*=0x360, lpOverlapped=0x0) returned 1
	[0188.669] CloseHandle (hObject=0x318) returned 1
	[0188.669] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.669] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0188.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.670] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaac9d147, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0188.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.670] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.671] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.671] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f5c18 | out: lpFileInformation=0x26f5c18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35c)) returned 1
	[0188.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.672] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.672] GetFileType (hFile=0x318) returned 0x1
	[0188.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.672] GetFileType (hFile=0x318) returned 0x1
	[0188.672] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x35c
	[0188.672] ReadFile (in: hFile=0x318, lpBuffer=0x26f6470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26f6470*, lpNumberOfBytesRead=0x99f04c*=0x35c, lpOverlapped=0x0) returned 1
	[0188.696] CloseHandle (hObject=0x318) returned 1
	[0188.696] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0188.696] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.696] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26f750c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b100) returned 1
	[0188.697] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.697] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.697] CryptDuplicateKey (in: hKey=0x82b100, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b440) returned 1
	[0188.697] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.697] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x26f75c4*=0x1, dwFlags=0x0) returned 1
	[0188.697] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x26f7590, dwFlags=0x0) returned 1
	[0188.697] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26f75d4*, pdwDataLen=0x99f054*=0x360, dwBufLen=0x360 | out: pbData=0x26f75d4*, pdwDataLen=0x99f054*=0x360) returned 1
	[0188.697] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26f7940*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26f7940*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.697] CryptDestroyKey (hKey=0x82b440) returned 1
	[0188.697] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.697] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.697] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.697] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.703] GetFileType (hFile=0x318) returned 0x1
	[0188.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.703] GetFileType (hFile=0x318) returned 0x1
	[0188.703] WriteFile (in: hFile=0x318, lpBuffer=0x26f7bc4*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26f7bc4*, lpNumberOfBytesWritten=0x99f014*=0x360, lpOverlapped=0x0) returned 1
	[0188.704] CloseHandle (hObject=0x318) returned 1
	[0188.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0188.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.704] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaace966b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0188.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.704] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.705] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.705] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26f922c | out: lpFileInformation=0x26f922c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35d)) returned 1
	[0188.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.706] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.706] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.706] GetFileType (hFile=0x318) returned 0x1
	[0188.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.706] GetFileType (hFile=0x318) returned 0x1
	[0188.706] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x35d
	[0188.706] ReadFile (in: hFile=0x318, lpBuffer=0x26f9a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26f9a88*, lpNumberOfBytesRead=0x99f04c*=0x35d, lpOverlapped=0x0) returned 1
	[0188.708] CloseHandle (hObject=0x318) returned 1
	[0188.708] CryptDestroyKey (hKey=0x82b100) returned 1
	[0188.708] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.708] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fab24, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0188.709] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.709] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.709] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0188.709] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.709] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x26fabdc*=0x1, dwFlags=0x0) returned 1
	[0188.709] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x26faba8, dwFlags=0x0) returned 1
	[0188.709] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fabec*, pdwDataLen=0x99f054*=0x360, dwBufLen=0x360 | out: pbData=0x26fabec*, pdwDataLen=0x99f054*=0x360) returned 1
	[0188.709] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26faf58*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26faf58*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.709] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0188.709] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.709] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.709] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.709] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.711] GetFileType (hFile=0x318) returned 0x1
	[0188.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.711] GetFileType (hFile=0x318) returned 0x1
	[0188.711] WriteFile (in: hFile=0x318, lpBuffer=0x26fb1dc*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26fb1dc*, lpNumberOfBytesWritten=0x99f014*=0x360, lpOverlapped=0x0) returned 1
	[0188.712] CloseHandle (hObject=0x318) returned 1
	[0188.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0188.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0188.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.712] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaace966b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1
	[0188.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.712] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.714] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26fc844 | out: lpFileInformation=0x26fc844*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0188.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0188.715] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0188.715] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.715] GetFileType (hFile=0x318) returned 0x1
	[0188.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0188.715] GetFileType (hFile=0x318) returned 0x1
	[0188.715] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1e0
	[0188.715] ReadFile (in: hFile=0x318, lpBuffer=0x26fce50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x26fce50*, lpNumberOfBytesRead=0x99f04c*=0x1e0, lpOverlapped=0x0) returned 1
	[0188.716] CloseHandle (hObject=0x318) returned 1
	[0188.716] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0188.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.717] CryptImportKey (in: hProv=0x7f93c0, pbData=0x26fdeec, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0188.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.717] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b100) returned 1
	[0188.717] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0188.717] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x26fdfa4*=0x1, dwFlags=0x0) returned 1
	[0188.717] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x26fdf70, dwFlags=0x0) returned 1
	[0188.717] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fdfb4*, pdwDataLen=0x99f054*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x26fdfb4*, pdwDataLen=0x99f054*=0x1f0) returned 1
	[0188.717] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fe1b0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x26fe1b0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0188.717] CryptDestroyKey (hKey=0x82b100) returned 1
	[0188.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.717] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0188.717] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0188.717] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0188.719] GetFileType (hFile=0x318) returned 0x1
	[0188.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0188.719] GetFileType (hFile=0x318) returned 0x1
	[0188.719] WriteFile (in: hFile=0x318, lpBuffer=0x26fe3cc*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x26fe3cc*, lpNumberOfBytesWritten=0x99f014*=0x1f0, lpOverlapped=0x0) returned 1
	[0188.720] CloseHandle (hObject=0x318) returned 1
	[0188.720] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0188.720] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0188.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0188.720] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xaad0fc2e, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
	[0188.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0188.721] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0188.731] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa0
	[0188.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0188.731] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x26ff970 | out: lpFileInformation=0x26ff970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb)) returned 1
	[0188.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0189.161] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.203] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.275] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.323] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.353] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.354] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.361] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.423] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.435] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.443] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.448] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.449] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.560] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0189.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0
	[0191.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.280] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.280] GetFileType (hFile=0x318) returned 0x1
	[0191.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.280] GetFileType (hFile=0x318) returned 0x1
	[0191.280] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2cb
	[0191.281] ReadFile (in: hFile=0x318, lpBuffer=0x27290a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27290a8*, lpNumberOfBytesRead=0x99f04c*=0x2cb, lpOverlapped=0x0) returned 1
	[0191.282] CloseHandle (hObject=0x318) returned 1
	[0191.283] CryptDestroyKey (hKey=0x82b540) returned 1
	[0191.283] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.283] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272a144, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0191.283] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.283] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.283] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b4c0) returned 1
	[0191.283] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.283] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x272a1fc*=0x1, dwFlags=0x0) returned 1
	[0191.283] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x272a1c8, dwFlags=0x0) returned 1
	[0191.283] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272a20c*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x272a20c*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0191.283] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272a4e8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x272a4e8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.283] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0191.283] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.283] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.283] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.283] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.285] GetFileType (hFile=0x318) returned 0x1
	[0191.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.285] GetFileType (hFile=0x318) returned 0x1
	[0191.285] WriteFile (in: hFile=0x318, lpBuffer=0x272a764*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x272a764*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.286] CloseHandle (hObject=0x318) returned 1
	[0191.286] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.286] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0191.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.286] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac5859ff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.286] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.288] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.288] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x272bdc8 | out: lpFileInformation=0x272bdc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916d8d0a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd)) returned 1
	[0191.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.288] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.288] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.288] GetFileType (hFile=0x318) returned 0x1
	[0191.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.288] GetFileType (hFile=0x318) returned 0x1
	[0191.288] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2cd
	[0191.288] ReadFile (in: hFile=0x318, lpBuffer=0x272c584, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x272c584*, lpNumberOfBytesRead=0x99f04c*=0x2cd, lpOverlapped=0x0) returned 1
	[0191.290] CloseHandle (hObject=0x318) returned 1
	[0191.290] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.290] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.290] CryptImportKey (in: hProv=0x7f93c0, pbData=0x272d620, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0191.290] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.290] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.290] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b440) returned 1
	[0191.290] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.290] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x272d6d8*=0x1, dwFlags=0x0) returned 1
	[0191.290] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x272d6a4, dwFlags=0x0) returned 1
	[0191.290] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x272d6e8*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x272d6e8*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0191.290] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x272d9c4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x272d9c4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.290] CryptDestroyKey (hKey=0x82b440) returned 1
	[0191.290] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.290] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.290] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.291] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.292] GetFileType (hFile=0x318) returned 0x1
	[0191.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.292] GetFileType (hFile=0x318) returned 0x1
	[0191.292] WriteFile (in: hFile=0x318, lpBuffer=0x272dc40*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x272dc40*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.293] CloseHandle (hObject=0x318) returned 1
	[0191.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0191.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.293] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac5859ff, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.293] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.294] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.294] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x272f2a4 | out: lpFileInformation=0x272f2a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90306b27, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90306b27, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90306b27, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285)) returned 1
	[0191.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.295] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.295] GetFileType (hFile=0x318) returned 0x1
	[0191.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.295] GetFileType (hFile=0x318) returned 0x1
	[0191.295] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x285
	[0191.295] ReadFile (in: hFile=0x318, lpBuffer=0x272f9a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x272f9a8*, lpNumberOfBytesRead=0x99f04c*=0x285, lpOverlapped=0x0) returned 1
	[0191.296] CloseHandle (hObject=0x318) returned 1
	[0191.296] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.296] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.296] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2730a44, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0191.297] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.297] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.297] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0191.297] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.297] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2730afc*=0x1, dwFlags=0x0) returned 1
	[0191.297] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2730ac8, dwFlags=0x0) returned 1
	[0191.297] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2730b0c*, pdwDataLen=0x99f054*=0x290, dwBufLen=0x290 | out: pbData=0x2730b0c*, pdwDataLen=0x99f054*=0x290) returned 1
	[0191.297] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2730da8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2730da8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.297] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.297] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.297] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.297] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.297] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.298] GetFileType (hFile=0x318) returned 0x1
	[0191.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.298] GetFileType (hFile=0x318) returned 0x1
	[0191.298] WriteFile (in: hFile=0x318, lpBuffer=0x2730fec*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2730fec*, lpNumberOfBytesWritten=0x99f014*=0x290, lpOverlapped=0x0) returned 1
	[0191.299] CloseHandle (hObject=0x318) returned 1
	[0191.299] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.299] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0191.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.299] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90306b27, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90306b27, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac5ac496, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1
	[0191.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.300] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.301] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.301] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27325e0 | out: lpFileInformation=0x27325e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916d8d0a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1
	[0191.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.301] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.301] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.301] GetFileType (hFile=0x318) returned 0x1
	[0191.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.301] GetFileType (hFile=0x318) returned 0x1
	[0191.301] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2cc
	[0191.301] ReadFile (in: hFile=0x318, lpBuffer=0x2732d88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2732d88*, lpNumberOfBytesRead=0x99f04c*=0x2cc, lpOverlapped=0x0) returned 1
	[0191.303] CloseHandle (hObject=0x318) returned 1
	[0191.303] CryptDestroyKey (hKey=0x82b540) returned 1
	[0191.303] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.303] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2733e24, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b280) returned 1
	[0191.303] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.303] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.303] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b5c0) returned 1
	[0191.303] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.303] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x2733edc*=0x1, dwFlags=0x0) returned 1
	[0191.303] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x2733ea8, dwFlags=0x0) returned 1
	[0191.303] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2733eec*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2733eec*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0191.303] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27341c8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27341c8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.303] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0191.303] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.303] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.303] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.305] GetFileType (hFile=0x318) returned 0x1
	[0191.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.305] GetFileType (hFile=0x318) returned 0x1
	[0191.305] WriteFile (in: hFile=0x318, lpBuffer=0x273443c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x273443c*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.305] CloseHandle (hObject=0x318) returned 1
	[0191.306] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.306] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0191.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.306] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac5ac496, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.306] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.307] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.307] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2735a84 | out: lpFileInformation=0x2735a84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916d8d0a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7)) returned 1
	[0191.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.308] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.308] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.308] GetFileType (hFile=0x318) returned 0x1
	[0191.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.308] GetFileType (hFile=0x318) returned 0x1
	[0191.308] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2c7
	[0191.308] ReadFile (in: hFile=0x318, lpBuffer=0x2736228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2736228*, lpNumberOfBytesRead=0x99f04c*=0x2c7, lpOverlapped=0x0) returned 1
	[0191.309] CloseHandle (hObject=0x318) returned 1
	[0191.309] CryptDestroyKey (hKey=0x82b280) returned 1
	[0191.309] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.309] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27372c4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0191.309] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.310] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.310] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0191.310] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.310] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x273737c*=0x1, dwFlags=0x0) returned 1
	[0191.310] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2737348, dwFlags=0x0) returned 1
	[0191.310] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273738c*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x273738c*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0191.310] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2737668*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2737668*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.310] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.310] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.310] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.310] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.311] GetFileType (hFile=0x318) returned 0x1
	[0191.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.311] GetFileType (hFile=0x318) returned 0x1
	[0191.311] WriteFile (in: hFile=0x318, lpBuffer=0x27378dc*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27378dc*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.315] CloseHandle (hObject=0x318) returned 1
	[0191.315] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.315] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0191.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.315] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac5cbf32, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.315] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.316] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2738f24 | out: lpFileInformation=0x2738f24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916d8d0a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7)) returned 1
	[0191.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.317] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.317] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.317] GetFileType (hFile=0x318) returned 0x1
	[0191.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.317] GetFileType (hFile=0x318) returned 0x1
	[0191.317] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2c7
	[0191.317] ReadFile (in: hFile=0x318, lpBuffer=0x27396c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27396c8*, lpNumberOfBytesRead=0x99f04c*=0x2c7, lpOverlapped=0x0) returned 1
	[0191.339] CloseHandle (hObject=0x318) returned 1
	[0191.339] CryptDestroyKey (hKey=0x82b540) returned 1
	[0191.339] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.339] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273a764, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0191.339] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.339] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.339] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b4c0) returned 1
	[0191.339] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.339] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x273a81c*=0x1, dwFlags=0x0) returned 1
	[0191.339] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x273a7e8, dwFlags=0x0) returned 1
	[0191.339] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273a82c*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x273a82c*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0191.339] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273ab08*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x273ab08*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.340] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0191.340] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.340] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.340] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.340] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.341] GetFileType (hFile=0x318) returned 0x1
	[0191.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.341] GetFileType (hFile=0x318) returned 0x1
	[0191.341] WriteFile (in: hFile=0x318, lpBuffer=0x273ad7c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x273ad7c*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.342] CloseHandle (hObject=0x318) returned 1
	[0191.342] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.342] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0191.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.342] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac6183e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.342] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.343] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.344] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x273c3c4 | out: lpFileInformation=0x273c3c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916d8d0a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7)) returned 1
	[0191.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.344] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.344] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.344] GetFileType (hFile=0x318) returned 0x1
	[0191.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.344] GetFileType (hFile=0x318) returned 0x1
	[0191.345] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2c7
	[0191.345] ReadFile (in: hFile=0x318, lpBuffer=0x273cb68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x273cb68*, lpNumberOfBytesRead=0x99f04c*=0x2c7, lpOverlapped=0x0) returned 1
	[0191.346] CloseHandle (hObject=0x318) returned 1
	[0191.346] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.346] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.346] CryptImportKey (in: hProv=0x7f93c0, pbData=0x273dc04, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0191.346] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.346] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.346] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0191.346] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.346] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x273dcbc*=0x1, dwFlags=0x0) returned 1
	[0191.347] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x273dc88, dwFlags=0x0) returned 1
	[0191.347] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x273dccc*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x273dccc*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0191.347] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x273dfa8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x273dfa8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.347] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.347] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.347] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.347] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.347] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.348] GetFileType (hFile=0x318) returned 0x1
	[0191.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.348] GetFileType (hFile=0x318) returned 0x1
	[0191.348] WriteFile (in: hFile=0x318, lpBuffer=0x273e21c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x273e21c*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.349] CloseHandle (hObject=0x318) returned 1
	[0191.349] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa4
	[0191.349] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd3
	[0191.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.349] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac6183e6, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.349] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.350] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0191.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.350] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x273f864 | out: lpFileInformation=0x273f864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916fef72, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916fef72, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916fef72, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db)) returned 1
	[0191.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.351] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0191.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.351] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.351] GetFileType (hFile=0x318) returned 0x1
	[0191.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.351] GetFileType (hFile=0x318) returned 0x1
	[0191.351] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2db
	[0191.351] ReadFile (in: hFile=0x318, lpBuffer=0x274004c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x274004c*, lpNumberOfBytesRead=0x99f04c*=0x2db, lpOverlapped=0x0) returned 1
	[0191.360] CloseHandle (hObject=0x318) returned 1
	[0191.360] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.360] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.360] CryptImportKey (in: hProv=0x7f93c0, pbData=0x27410e8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b2c0) returned 1
	[0191.360] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.360] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.360] CryptDuplicateKey (in: hKey=0x82b2c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b040) returned 1
	[0191.360] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.360] CryptSetKeyParam (hKey=0x82b040, dwParam=0x4, pbData=0x27411a0*=0x1, dwFlags=0x0) returned 1
	[0191.360] CryptSetKeyParam (hKey=0x82b040, dwParam=0x1, pbData=0x274116c, dwFlags=0x0) returned 1
	[0191.360] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27411b0*, pdwDataLen=0x99f054*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27411b0*, pdwDataLen=0x99f054*=0x2e0) returned 1
	[0191.360] CryptEncrypt (in: hKey=0x82b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274149c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x274149c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.360] CryptDestroyKey (hKey=0x82b040) returned 1
	[0191.360] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.360] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.360] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0191.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.361] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.362] GetFileType (hFile=0x318) returned 0x1
	[0191.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.362] GetFileType (hFile=0x318) returned 0x1
	[0191.362] WriteFile (in: hFile=0x318, lpBuffer=0x2741728*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2741728*, lpNumberOfBytesWritten=0x99f014*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.363] CloseHandle (hObject=0x318) returned 1
	[0191.363] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0191.363] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xda
	[0191.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.363] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916fef72, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916fef72, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac64ad6f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.363] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.364] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0191.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.364] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2742dac | out: lpFileInformation=0x2742dac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916fef72, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916fef72, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916fef72, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db)) returned 1
	[0191.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0191.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.365] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.365] GetFileType (hFile=0x318) returned 0x1
	[0191.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.365] GetFileType (hFile=0x318) returned 0x1
	[0191.365] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2db
	[0191.365] ReadFile (in: hFile=0x318, lpBuffer=0x2743594, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2743594*, lpNumberOfBytesRead=0x99f04c*=0x2db, lpOverlapped=0x0) returned 1
	[0191.366] CloseHandle (hObject=0x318) returned 1
	[0191.366] CryptDestroyKey (hKey=0x82b2c0) returned 1
	[0191.366] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.367] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2744630, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0191.367] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.367] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.367] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b5c0) returned 1
	[0191.367] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.367] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x27446e8*=0x1, dwFlags=0x0) returned 1
	[0191.367] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x27446b4, dwFlags=0x0) returned 1
	[0191.367] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27446f8*, pdwDataLen=0x99f054*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27446f8*, pdwDataLen=0x99f054*=0x2e0) returned 1
	[0191.367] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27449e4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27449e4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.367] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0191.367] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.367] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.367] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0191.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.367] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.368] GetFileType (hFile=0x318) returned 0x1
	[0191.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.368] GetFileType (hFile=0x318) returned 0x1
	[0191.368] WriteFile (in: hFile=0x318, lpBuffer=0x2744c70*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2744c70*, lpNumberOfBytesWritten=0x99f014*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.369] CloseHandle (hObject=0x318) returned 1
	[0191.370] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xab
	[0191.370] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xda
	[0191.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.370] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916fef72, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916fef72, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac64ad6f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.370] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.371] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.371] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27462f4 | out: lpFileInformation=0x27462f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916fef72, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916fef72, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916fef72, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5)) returned 1
	[0191.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.372] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.372] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.372] GetFileType (hFile=0x318) returned 0x1
	[0191.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.372] GetFileType (hFile=0x318) returned 0x1
	[0191.372] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2d5
	[0191.372] ReadFile (in: hFile=0x318, lpBuffer=0x2746ab8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2746ab8*, lpNumberOfBytesRead=0x99f04c*=0x2d5, lpOverlapped=0x0) returned 1
	[0191.395] CloseHandle (hObject=0x318) returned 1
	[0191.395] CryptDestroyKey (hKey=0x82b540) returned 1
	[0191.395] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.396] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2747b54, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0191.396] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.396] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.396] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b400) returned 1
	[0191.396] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.396] CryptSetKeyParam (hKey=0x82b400, dwParam=0x4, pbData=0x2747c0c*=0x1, dwFlags=0x0) returned 1
	[0191.396] CryptSetKeyParam (hKey=0x82b400, dwParam=0x1, pbData=0x2747bd8, dwFlags=0x0) returned 1
	[0191.396] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2747c1c*, pdwDataLen=0x99f054*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2747c1c*, pdwDataLen=0x99f054*=0x2e0) returned 1
	[0191.396] CryptEncrypt (in: hKey=0x82b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2747f08*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2747f08*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.396] CryptDestroyKey (hKey=0x82b400) returned 1
	[0191.396] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.396] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.396] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.396] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.397] GetFileType (hFile=0x318) returned 0x1
	[0191.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.397] GetFileType (hFile=0x318) returned 0x1
	[0191.397] WriteFile (in: hFile=0x318, lpBuffer=0x2748184*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2748184*, lpNumberOfBytesWritten=0x99f014*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.398] CloseHandle (hObject=0x318) returned 1
	[0191.398] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.398] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0191.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.399] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916fef72, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916fef72, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac68aadc, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.399] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.400] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27497e8 | out: lpFileInformation=0x27497e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916fef72, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916fef72, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916fef72, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4)) returned 1
	[0191.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.401] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.401] GetFileType (hFile=0x318) returned 0x1
	[0191.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.401] GetFileType (hFile=0x318) returned 0x1
	[0191.401] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2d4
	[0191.401] ReadFile (in: hFile=0x318, lpBuffer=0x2749fa8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2749fa8*, lpNumberOfBytesRead=0x99f04c*=0x2d4, lpOverlapped=0x0) returned 1
	[0191.403] CloseHandle (hObject=0x318) returned 1
	[0191.403] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.403] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274b044, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b280) returned 1
	[0191.403] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.403] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.403] CryptDuplicateKey (in: hKey=0x82b280, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b5c0) returned 1
	[0191.403] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.403] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x4, pbData=0x274b0fc*=0x1, dwFlags=0x0) returned 1
	[0191.403] CryptSetKeyParam (hKey=0x82b5c0, dwParam=0x1, pbData=0x274b0c8, dwFlags=0x0) returned 1
	[0191.403] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274b10c*, pdwDataLen=0x99f054*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x274b10c*, pdwDataLen=0x99f054*=0x2e0) returned 1
	[0191.403] CryptEncrypt (in: hKey=0x82b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274b3f8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x274b3f8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.403] CryptDestroyKey (hKey=0x82b5c0) returned 1
	[0191.403] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.404] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.404] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.404] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.405] GetFileType (hFile=0x318) returned 0x1
	[0191.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.405] GetFileType (hFile=0x318) returned 0x1
	[0191.405] WriteFile (in: hFile=0x318, lpBuffer=0x274b674*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x274b674*, lpNumberOfBytesWritten=0x99f014*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.406] CloseHandle (hObject=0x318) returned 1
	[0191.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0191.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.407] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916fef72, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916fef72, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac6b0d47, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.407] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.408] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.408] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x274ccd8 | out: lpFileInformation=0x274ccd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917251dd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917251dd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917251dd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.409] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.409] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.409] GetFileType (hFile=0x318) returned 0x1
	[0191.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.409] GetFileType (hFile=0x318) returned 0x1
	[0191.409] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2d0
	[0191.409] ReadFile (in: hFile=0x318, lpBuffer=0x274d494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x274d494*, lpNumberOfBytesRead=0x99f04c*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.411] CloseHandle (hObject=0x318) returned 1
	[0191.411] CryptDestroyKey (hKey=0x82b280) returned 1
	[0191.411] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.411] CryptImportKey (in: hProv=0x7f93c0, pbData=0x274e530, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b0c0) returned 1
	[0191.411] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.411] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.411] CryptDuplicateKey (in: hKey=0x82b0c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b340) returned 1
	[0191.411] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.411] CryptSetKeyParam (hKey=0x82b340, dwParam=0x4, pbData=0x274e5e8*=0x1, dwFlags=0x0) returned 1
	[0191.411] CryptSetKeyParam (hKey=0x82b340, dwParam=0x1, pbData=0x274e5b4, dwFlags=0x0) returned 1
	[0191.412] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x274e5f8*, pdwDataLen=0x99f054*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x274e5f8*, pdwDataLen=0x99f054*=0x2e0) returned 1
	[0191.412] CryptEncrypt (in: hKey=0x82b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x274e8e4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x274e8e4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.412] CryptDestroyKey (hKey=0x82b340) returned 1
	[0191.412] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.412] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.412] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.412] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.413] GetFileType (hFile=0x318) returned 0x1
	[0191.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.413] GetFileType (hFile=0x318) returned 0x1
	[0191.414] WriteFile (in: hFile=0x318, lpBuffer=0x274eb60*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x274eb60*, lpNumberOfBytesWritten=0x99f014*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.415] CloseHandle (hObject=0x318) returned 1
	[0191.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0191.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.415] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917251dd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917251dd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac6b0d47, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.415] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.416] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.416] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27501c4 | out: lpFileInformation=0x27501c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917251dd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917251dd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917251dd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.417] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.417] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.417] GetFileType (hFile=0x318) returned 0x1
	[0191.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.417] GetFileType (hFile=0x318) returned 0x1
	[0191.417] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2d0
	[0191.417] ReadFile (in: hFile=0x318, lpBuffer=0x2750980, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2750980*, lpNumberOfBytesRead=0x99f04c*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.419] CloseHandle (hObject=0x318) returned 1
	[0191.419] CryptDestroyKey (hKey=0x82b0c0) returned 1
	[0191.419] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.419] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2751a1c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0191.419] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.419] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.419] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b280) returned 1
	[0191.419] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.419] CryptSetKeyParam (hKey=0x82b280, dwParam=0x4, pbData=0x2751ad4*=0x1, dwFlags=0x0) returned 1
	[0191.419] CryptSetKeyParam (hKey=0x82b280, dwParam=0x1, pbData=0x2751aa0, dwFlags=0x0) returned 1
	[0191.420] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2751ae4*, pdwDataLen=0x99f054*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2751ae4*, pdwDataLen=0x99f054*=0x2e0) returned 1
	[0191.420] CryptEncrypt (in: hKey=0x82b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2751dd0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2751dd0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.420] CryptDestroyKey (hKey=0x82b280) returned 1
	[0191.420] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.420] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.420] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.421] GetFileType (hFile=0x318) returned 0x1
	[0191.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.422] GetFileType (hFile=0x318) returned 0x1
	[0191.422] WriteFile (in: hFile=0x318, lpBuffer=0x275204c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x275204c*, lpNumberOfBytesWritten=0x99f014*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.423] CloseHandle (hObject=0x318) returned 1
	[0191.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0191.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.423] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917251dd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917251dd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac6d6f7c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.423] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.424] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0191.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.424] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27536b0 | out: lpFileInformation=0x27536b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90306b27, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90306b27, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90306b27, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e3)) returned 1
	[0191.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.425] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0191.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.425] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.425] GetFileType (hFile=0x318) returned 0x1
	[0191.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.425] GetFileType (hFile=0x318) returned 0x1
	[0191.425] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2e3
	[0191.425] ReadFile (in: hFile=0x318, lpBuffer=0x2753eb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2753eb0*, lpNumberOfBytesRead=0x99f04c*=0x2e3, lpOverlapped=0x0) returned 1
	[0191.426] CloseHandle (hObject=0x318) returned 1
	[0191.426] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.426] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.427] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2754f4c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b380) returned 1
	[0191.427] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.427] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.427] CryptDuplicateKey (in: hKey=0x82b380, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0191.427] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.427] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x2755004*=0x1, dwFlags=0x0) returned 1
	[0191.427] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x2754fd0, dwFlags=0x0) returned 1
	[0191.427] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2755014*, pdwDataLen=0x99f054*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x2755014*, pdwDataLen=0x99f054*=0x2f0) returned 1
	[0191.427] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2755310*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2755310*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.427] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.427] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.427] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0191.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.427] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.428] GetFileType (hFile=0x318) returned 0x1
	[0191.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.428] GetFileType (hFile=0x318) returned 0x1
	[0191.428] WriteFile (in: hFile=0x318, lpBuffer=0x27555a4*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27555a4*, lpNumberOfBytesWritten=0x99f014*=0x2f0, lpOverlapped=0x0) returned 1
	[0191.429] CloseHandle (hObject=0x318) returned 1
	[0191.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xac
	[0191.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xdb
	[0191.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.430] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90306b27, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90306b27, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac6d6f7c, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1
	[0191.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.430] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.431] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0191.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.431] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2756c2c | out: lpFileInformation=0x2756c2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917251dd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917251dd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917251dd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0191.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.431] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0191.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.431] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.432] GetFileType (hFile=0x318) returned 0x1
	[0191.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.432] GetFileType (hFile=0x318) returned 0x1
	[0191.432] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2d3
	[0191.432] ReadFile (in: hFile=0x318, lpBuffer=0x27573fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27573fc*, lpNumberOfBytesRead=0x99f04c*=0x2d3, lpOverlapped=0x0) returned 1
	[0191.455] CloseHandle (hObject=0x318) returned 1
	[0191.455] CryptDestroyKey (hKey=0x82b380) returned 1
	[0191.455] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.455] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2758498, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0191.455] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.455] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.455] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b200) returned 1
	[0191.455] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.455] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x2758550*=0x1, dwFlags=0x0) returned 1
	[0191.455] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x275851c, dwFlags=0x0) returned 1
	[0191.455] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2758560*, pdwDataLen=0x99f054*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2758560*, pdwDataLen=0x99f054*=0x2e0) returned 1
	[0191.455] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275884c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x275884c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.455] CryptDestroyKey (hKey=0x82b200) returned 1
	[0191.455] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.455] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.455] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0191.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.455] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.457] GetFileType (hFile=0x318) returned 0x1
	[0191.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.457] GetFileType (hFile=0x318) returned 0x1
	[0191.457] WriteFile (in: hFile=0x318, lpBuffer=0x2758ad0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2758ad0*, lpNumberOfBytesWritten=0x99f014*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.458] CloseHandle (hObject=0x318) returned 1
	[0191.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0191.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0191.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.458] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917251dd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917251dd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac72346b, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.458] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.459] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0191.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.459] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x275a138 | out: lpFileInformation=0x275a138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917251dd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917251dd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917251dd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3)) returned 1
	[0191.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.460] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0191.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.460] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.460] GetFileType (hFile=0x318) returned 0x1
	[0191.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.460] GetFileType (hFile=0x318) returned 0x1
	[0191.460] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2d3
	[0191.460] ReadFile (in: hFile=0x318, lpBuffer=0x275a908, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x275a908*, lpNumberOfBytesRead=0x99f04c*=0x2d3, lpOverlapped=0x0) returned 1
	[0191.461] CloseHandle (hObject=0x318) returned 1
	[0191.461] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.461] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.462] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275b9a4, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b440) returned 1
	[0191.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.462] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0191.462] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.462] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x275ba5c*=0x1, dwFlags=0x0) returned 1
	[0191.462] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x275ba28, dwFlags=0x0) returned 1
	[0191.462] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275ba6c*, pdwDataLen=0x99f054*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x275ba6c*, pdwDataLen=0x99f054*=0x2e0) returned 1
	[0191.462] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275bd58*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x275bd58*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.462] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.462] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.462] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0191.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.462] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.463] GetFileType (hFile=0x318) returned 0x1
	[0191.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.464] GetFileType (hFile=0x318) returned 0x1
	[0191.464] WriteFile (in: hFile=0x318, lpBuffer=0x275bfdc*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x275bfdc*, lpNumberOfBytesWritten=0x99f014*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.464] CloseHandle (hObject=0x318) returned 1
	[0191.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0191.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd7
	[0191.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.465] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917251dd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917251dd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac749618, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.465] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.466] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x275d644 | out: lpFileInformation=0x275d644*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174b44d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9174b44d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9174b44d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1)) returned 1
	[0191.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.468] GetFileType (hFile=0x318) returned 0x1
	[0191.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.468] GetFileType (hFile=0x318) returned 0x1
	[0191.468] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2c1
	[0191.468] ReadFile (in: hFile=0x318, lpBuffer=0x275dd94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x275dd94*, lpNumberOfBytesRead=0x99f04c*=0x2c1, lpOverlapped=0x0) returned 1
	[0191.469] CloseHandle (hObject=0x318) returned 1
	[0191.469] CryptDestroyKey (hKey=0x82b440) returned 1
	[0191.469] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.469] CryptImportKey (in: hProv=0x7f93c0, pbData=0x275ee30, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0191.469] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.469] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.470] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0191.470] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.470] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x275eee8*=0x1, dwFlags=0x0) returned 1
	[0191.470] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x275eeb4, dwFlags=0x0) returned 1
	[0191.470] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x275eef8*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x275eef8*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0191.470] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x275f1d4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x275f1d4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.470] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.470] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.470] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.470] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.470] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.471] GetFileType (hFile=0x318) returned 0x1
	[0191.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.471] GetFileType (hFile=0x318) returned 0x1
	[0191.471] WriteFile (in: hFile=0x318, lpBuffer=0x275f420*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x275f420*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.472] CloseHandle (hObject=0x318) returned 1
	[0191.472] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.472] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0191.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.473] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174b44d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9174b44d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac749618, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.473] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.474] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2760a18 | out: lpFileInformation=0x2760a18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174b44d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9174b44d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9174b44d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1
	[0191.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.474] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.475] GetFileType (hFile=0x318) returned 0x1
	[0191.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.475] GetFileType (hFile=0x318) returned 0x1
	[0191.475] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2c3
	[0191.475] ReadFile (in: hFile=0x318, lpBuffer=0x2761168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2761168*, lpNumberOfBytesRead=0x99f04c*=0x2c3, lpOverlapped=0x0) returned 1
	[0191.476] CloseHandle (hObject=0x318) returned 1
	[0191.476] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.476] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.476] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2762204, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0191.476] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.476] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.477] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0191.477] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.477] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x27622bc*=0x1, dwFlags=0x0) returned 1
	[0191.477] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x2762288, dwFlags=0x0) returned 1
	[0191.477] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27622cc*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27622cc*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0191.477] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27625a8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27625a8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.477] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.477] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.477] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.477] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.477] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.478] GetFileType (hFile=0x318) returned 0x1
	[0191.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.479] GetFileType (hFile=0x318) returned 0x1
	[0191.479] WriteFile (in: hFile=0x318, lpBuffer=0x27627f4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27627f4*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.479] CloseHandle (hObject=0x318) returned 1
	[0191.480] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.480] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0191.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.480] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174b44d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9174b44d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac76f853, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.480] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.481] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2763dec | out: lpFileInformation=0x2763dec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174b44d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9174b44d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9174b44d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5)) returned 1
	[0191.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.482] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.482] GetFileType (hFile=0x318) returned 0x1
	[0191.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.482] GetFileType (hFile=0x318) returned 0x1
	[0191.482] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2d5
	[0191.482] ReadFile (in: hFile=0x318, lpBuffer=0x27645b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27645b0*, lpNumberOfBytesRead=0x99f04c*=0x2d5, lpOverlapped=0x0) returned 1
	[0191.483] CloseHandle (hObject=0x318) returned 1
	[0191.483] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.483] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.483] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276564c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0191.483] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.483] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.483] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b4c0) returned 1
	[0191.483] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.484] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2765704*=0x1, dwFlags=0x0) returned 1
	[0191.484] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x27656d0, dwFlags=0x0) returned 1
	[0191.484] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2765714*, pdwDataLen=0x99f054*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2765714*, pdwDataLen=0x99f054*=0x2e0) returned 1
	[0191.484] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2765a00*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2765a00*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.484] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0191.484] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.484] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.484] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.484] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.485] GetFileType (hFile=0x318) returned 0x1
	[0191.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.485] GetFileType (hFile=0x318) returned 0x1
	[0191.485] WriteFile (in: hFile=0x318, lpBuffer=0x2765c7c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2765c7c*, lpNumberOfBytesWritten=0x99f014*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.486] CloseHandle (hObject=0x318) returned 1
	[0191.486] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.486] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0191.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.486] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174b44d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9174b44d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac76f853, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.486] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.488] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.488] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x27672e0 | out: lpFileInformation=0x27672e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174b44d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9174b44d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9174b44d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5)) returned 1
	[0191.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.488] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.488] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.488] GetFileType (hFile=0x318) returned 0x1
	[0191.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.488] GetFileType (hFile=0x318) returned 0x1
	[0191.488] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2d5
	[0191.489] ReadFile (in: hFile=0x318, lpBuffer=0x2767aa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2767aa4*, lpNumberOfBytesRead=0x99f04c*=0x2d5, lpOverlapped=0x0) returned 1
	[0191.511] CloseHandle (hObject=0x318) returned 1
	[0191.511] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.511] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.511] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2768b40, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0191.511] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.511] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.511] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b440) returned 1
	[0191.511] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.511] CryptSetKeyParam (hKey=0x82b440, dwParam=0x4, pbData=0x2768bf8*=0x1, dwFlags=0x0) returned 1
	[0191.511] CryptSetKeyParam (hKey=0x82b440, dwParam=0x1, pbData=0x2768bc4, dwFlags=0x0) returned 1
	[0191.511] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2768c08*, pdwDataLen=0x99f054*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x2768c08*, pdwDataLen=0x99f054*=0x2e0) returned 1
	[0191.511] CryptEncrypt (in: hKey=0x82b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2768ef4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2768ef4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.511] CryptDestroyKey (hKey=0x82b440) returned 1
	[0191.511] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.511] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.511] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.513] GetFileType (hFile=0x318) returned 0x1
	[0191.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.513] GetFileType (hFile=0x318) returned 0x1
	[0191.513] WriteFile (in: hFile=0x318, lpBuffer=0x2769170*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2769170*, lpNumberOfBytesWritten=0x99f014*=0x2e0, lpOverlapped=0x0) returned 1
	[0191.514] CloseHandle (hObject=0x318) returned 1
	[0191.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0191.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.514] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174b44d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9174b44d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac7bbdb0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1
	[0191.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.514] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.515] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x276a7d4 | out: lpFileInformation=0x276a7d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917716b4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ba)) returned 1
	[0191.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.516] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.516] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.516] GetFileType (hFile=0x318) returned 0x1
	[0191.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.516] GetFileType (hFile=0x318) returned 0x1
	[0191.516] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2ba
	[0191.516] ReadFile (in: hFile=0x318, lpBuffer=0x276af1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x276af1c*, lpNumberOfBytesRead=0x99f04c*=0x2ba, lpOverlapped=0x0) returned 1
	[0191.518] CloseHandle (hObject=0x318) returned 1
	[0191.518] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.518] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.518] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276bfb8, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b540) returned 1
	[0191.518] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.518] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.518] CryptDuplicateKey (in: hKey=0x82b540, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0191.518] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.518] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x276c070*=0x1, dwFlags=0x0) returned 1
	[0191.518] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x276c03c, dwFlags=0x0) returned 1
	[0191.518] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276c080*, pdwDataLen=0x99f054*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x276c080*, pdwDataLen=0x99f054*=0x2c0) returned 1
	[0191.518] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276c34c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x276c34c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.518] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.518] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.518] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.518] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.519] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.520] GetFileType (hFile=0x318) returned 0x1
	[0191.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.520] GetFileType (hFile=0x318) returned 0x1
	[0191.520] WriteFile (in: hFile=0x318, lpBuffer=0x276c598*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x276c598*, lpNumberOfBytesWritten=0x99f014*=0x2c0, lpOverlapped=0x0) returned 1
	[0191.521] CloseHandle (hObject=0x318) returned 1
	[0191.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0191.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.521] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac7bbdb0, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1
	[0191.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.521] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.522] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.522] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x276db90 | out: lpFileInformation=0x276db90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917716b4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d9)) returned 1
	[0191.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.523] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.523] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.523] GetFileType (hFile=0x318) returned 0x1
	[0191.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.523] GetFileType (hFile=0x318) returned 0x1
	[0191.523] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1d9
	[0191.523] ReadFile (in: hFile=0x318, lpBuffer=0x276e198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x276e198*, lpNumberOfBytesRead=0x99f04c*=0x1d9, lpOverlapped=0x0) returned 1
	[0191.524] CloseHandle (hObject=0x318) returned 1
	[0191.524] CryptDestroyKey (hKey=0x82b540) returned 1
	[0191.524] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.524] CryptImportKey (in: hProv=0x7f93c0, pbData=0x276f234, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0191.524] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.524] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.524] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b100) returned 1
	[0191.524] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.524] CryptSetKeyParam (hKey=0x82b100, dwParam=0x4, pbData=0x276f2ec*=0x1, dwFlags=0x0) returned 1
	[0191.525] CryptSetKeyParam (hKey=0x82b100, dwParam=0x1, pbData=0x276f2b8, dwFlags=0x0) returned 1
	[0191.525] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276f2fc*, pdwDataLen=0x99f054*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x276f2fc*, pdwDataLen=0x99f054*=0x1e0) returned 1
	[0191.525] CryptEncrypt (in: hKey=0x82b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276f4e8*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x276f4e8*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.525] CryptDestroyKey (hKey=0x82b100) returned 1
	[0191.525] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.525] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.525] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.525] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.526] GetFileType (hFile=0x318) returned 0x1
	[0191.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.526] GetFileType (hFile=0x318) returned 0x1
	[0191.526] WriteFile (in: hFile=0x318, lpBuffer=0x276f704*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x276f704*, lpNumberOfBytesWritten=0x99f014*=0x1e0, lpOverlapped=0x0) returned 1
	[0191.527] CloseHandle (hObject=0x318) returned 1
	[0191.527] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.527] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0191.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.527] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac7e2881, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0191.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.528] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.529] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.529] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2770ca8 | out: lpFileInformation=0x2770ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917716b4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8)) returned 1
	[0191.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.530] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.530] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.530] GetFileType (hFile=0x318) returned 0x1
	[0191.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.530] GetFileType (hFile=0x318) returned 0x1
	[0191.530] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2c8
	[0191.530] ReadFile (in: hFile=0x318, lpBuffer=0x27713ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27713ec*, lpNumberOfBytesRead=0x99f04c*=0x2c8, lpOverlapped=0x0) returned 1
	[0191.531] CloseHandle (hObject=0x318) returned 1
	[0191.532] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.532] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.532] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2772488, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b6c0) returned 1
	[0191.532] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.532] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.532] CryptDuplicateKey (in: hKey=0x82b6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b4c0) returned 1
	[0191.532] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.532] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x4, pbData=0x2772540*=0x1, dwFlags=0x0) returned 1
	[0191.532] CryptSetKeyParam (hKey=0x82b4c0, dwParam=0x1, pbData=0x277250c, dwFlags=0x0) returned 1
	[0191.532] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2772550*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2772550*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0191.532] CryptEncrypt (in: hKey=0x82b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277282c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x277282c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.532] CryptDestroyKey (hKey=0x82b4c0) returned 1
	[0191.532] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.532] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.532] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.532] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.533] GetFileType (hFile=0x318) returned 0x1
	[0191.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.533] GetFileType (hFile=0x318) returned 0x1
	[0191.533] WriteFile (in: hFile=0x318, lpBuffer=0x2772a70*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2772a70*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.534] CloseHandle (hObject=0x318) returned 1
	[0191.534] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.534] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0191.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.535] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac7e2881, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.535] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.536] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.536] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2774064 | out: lpFileInformation=0x2774064*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917716b4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca)) returned 1
	[0191.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.536] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.536] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.536] GetFileType (hFile=0x318) returned 0x1
	[0191.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.536] GetFileType (hFile=0x318) returned 0x1
	[0191.537] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2ca
	[0191.537] ReadFile (in: hFile=0x318, lpBuffer=0x27747ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x27747ac*, lpNumberOfBytesRead=0x99f04c*=0x2ca, lpOverlapped=0x0) returned 1
	[0191.538] CloseHandle (hObject=0x318) returned 1
	[0191.538] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.538] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.538] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2775848, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b080) returned 1
	[0191.538] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.538] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.538] CryptDuplicateKey (in: hKey=0x82b080, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0191.538] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.538] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x2775900*=0x1, dwFlags=0x0) returned 1
	[0191.538] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x27758cc, dwFlags=0x0) returned 1
	[0191.538] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2775910*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x2775910*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0191.538] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2775bec*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2775bec*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.538] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.538] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.538] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.538] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.539] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.540] GetFileType (hFile=0x318) returned 0x1
	[0191.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.540] GetFileType (hFile=0x318) returned 0x1
	[0191.540] WriteFile (in: hFile=0x318, lpBuffer=0x2775e30*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2775e30*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.541] CloseHandle (hObject=0x318) returned 1
	[0191.541] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x99
	[0191.541] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc8
	[0191.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.541] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac7e2881, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.541] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.543] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0191.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.543] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2777424 | out: lpFileInformation=0x2777424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90306b27, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90306b27, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9032cd93, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2f9)) returned 1
	[0191.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.543] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0191.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.544] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.544] GetFileType (hFile=0x318) returned 0x1
	[0191.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.544] GetFileType (hFile=0x318) returned 0x1
	[0191.544] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2f9
	[0191.544] ReadFile (in: hFile=0x318, lpBuffer=0x2777b9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2777b9c*, lpNumberOfBytesRead=0x99f04c*=0x2f9, lpOverlapped=0x0) returned 1
	[0191.568] CloseHandle (hObject=0x318) returned 1
	[0191.568] CryptDestroyKey (hKey=0x82b080) returned 1
	[0191.568] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.568] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2778c38, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b440) returned 1
	[0191.568] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.568] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.568] CryptDuplicateKey (in: hKey=0x82b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b1c0) returned 1
	[0191.569] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.569] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x4, pbData=0x2778cf0*=0x1, dwFlags=0x0) returned 1
	[0191.569] CryptSetKeyParam (hKey=0x82b1c0, dwParam=0x1, pbData=0x2778cbc, dwFlags=0x0) returned 1
	[0191.569] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2778d00*, pdwDataLen=0x99f054*=0x300, dwBufLen=0x300 | out: pbData=0x2778d00*, pdwDataLen=0x99f054*=0x300) returned 1
	[0191.569] CryptEncrypt (in: hKey=0x82b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277900c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x277900c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.569] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.569] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.569] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.569] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0191.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.569] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.570] GetFileType (hFile=0x318) returned 0x1
	[0191.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.570] GetFileType (hFile=0x318) returned 0x1
	[0191.570] WriteFile (in: hFile=0x318, lpBuffer=0x2779250*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2779250*, lpNumberOfBytesWritten=0x99f014*=0x300, lpOverlapped=0x0) returned 1
	[0191.571] CloseHandle (hObject=0x318) returned 1
	[0191.571] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x98
	[0191.571] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc7
	[0191.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.571] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90306b27, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90306b27, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac82e41f, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x300)) returned 1
	[0191.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.572] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.573] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.573] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x277a838 | out: lpFileInformation=0x277a838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917716b4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0191.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.573] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.573] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.573] GetFileType (hFile=0x318) returned 0x1
	[0191.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.574] GetFileType (hFile=0x318) returned 0x1
	[0191.574] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2c9
	[0191.574] ReadFile (in: hFile=0x318, lpBuffer=0x277af90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x277af90*, lpNumberOfBytesRead=0x99f04c*=0x2c9, lpOverlapped=0x0) returned 1
	[0191.575] CloseHandle (hObject=0x318) returned 1
	[0191.575] CryptDestroyKey (hKey=0x82b440) returned 1
	[0191.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.575] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277c02c, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82afc0) returned 1
	[0191.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.575] CryptDuplicateKey (in: hKey=0x82afc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b6c0) returned 1
	[0191.575] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.575] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x4, pbData=0x277c0e4*=0x1, dwFlags=0x0) returned 1
	[0191.575] CryptSetKeyParam (hKey=0x82b6c0, dwParam=0x1, pbData=0x277c0b0, dwFlags=0x0) returned 1
	[0191.575] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277c0f4*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x277c0f4*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0191.575] CryptEncrypt (in: hKey=0x82b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277c3d0*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x277c3d0*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.575] CryptDestroyKey (hKey=0x82b6c0) returned 1
	[0191.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.575] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.576] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.576] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.577] GetFileType (hFile=0x318) returned 0x1
	[0191.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.577] GetFileType (hFile=0x318) returned 0x1
	[0191.577] WriteFile (in: hFile=0x318, lpBuffer=0x277c61c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x277c61c*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.578] CloseHandle (hObject=0x318) returned 1
	[0191.578] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9a
	[0191.578] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xc9
	[0191.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.578] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac854829, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.578] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.579] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.579] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x277dc14 | out: lpFileInformation=0x277dc14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9)) returned 1
	[0191.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.580] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.580] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.580] GetFileType (hFile=0x318) returned 0x1
	[0191.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.580] GetFileType (hFile=0x318) returned 0x1
	[0191.580] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x2c9
	[0191.580] ReadFile (in: hFile=0x318, lpBuffer=0x277e37c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x277e37c*, lpNumberOfBytesRead=0x99f04c*=0x2c9, lpOverlapped=0x0) returned 1
	[0191.581] CloseHandle (hObject=0x318) returned 1
	[0191.581] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.581] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.581] CryptImportKey (in: hProv=0x7f93c0, pbData=0x277f418, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b1c0) returned 1
	[0191.581] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.581] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.581] CryptDuplicateKey (in: hKey=0x82b1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b200) returned 1
	[0191.581] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.581] CryptSetKeyParam (hKey=0x82b200, dwParam=0x4, pbData=0x277f4d0*=0x1, dwFlags=0x0) returned 1
	[0191.582] CryptSetKeyParam (hKey=0x82b200, dwParam=0x1, pbData=0x277f49c, dwFlags=0x0) returned 1
	[0191.582] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x277f4e0*, pdwDataLen=0x99f054*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x277f4e0*, pdwDataLen=0x99f054*=0x2d0) returned 1
	[0191.582] CryptEncrypt (in: hKey=0x82b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x277f7bc*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x277f7bc*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.582] CryptDestroyKey (hKey=0x82b200) returned 1
	[0191.582] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.582] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.582] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.582] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.583] GetFileType (hFile=0x318) returned 0x1
	[0191.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.583] GetFileType (hFile=0x318) returned 0x1
	[0191.583] WriteFile (in: hFile=0x318, lpBuffer=0x277fa10*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x277fa10*, lpNumberOfBytesWritten=0x99f014*=0x2d0, lpOverlapped=0x0) returned 1
	[0191.584] CloseHandle (hObject=0x318) returned 1
	[0191.584] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0x9d
	[0191.584] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcc
	[0191.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.584] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac854829, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1
	[0191.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.584] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.585] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.585] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2781024 | out: lpFileInformation=0x2781024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x369)) returned 1
	[0191.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.586] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.586] GetFileType (hFile=0x318) returned 0x1
	[0191.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.586] GetFileType (hFile=0x318) returned 0x1
	[0191.586] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x369
	[0191.586] ReadFile (in: hFile=0x318, lpBuffer=0x278187c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x278187c*, lpNumberOfBytesRead=0x99f04c*=0x369, lpOverlapped=0x0) returned 1
	[0191.587] CloseHandle (hObject=0x318) returned 1
	[0191.587] CryptDestroyKey (hKey=0x82b1c0) returned 1
	[0191.587] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.587] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2782918, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b200) returned 1
	[0191.588] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.588] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.588] CryptDuplicateKey (in: hKey=0x82b200, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82afc0) returned 1
	[0191.588] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.588] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x4, pbData=0x27829d0*=0x1, dwFlags=0x0) returned 1
	[0191.588] CryptSetKeyParam (hKey=0x82afc0, dwParam=0x1, pbData=0x278299c, dwFlags=0x0) returned 1
	[0191.588] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27829e0*, pdwDataLen=0x99f054*=0x370, dwBufLen=0x370 | out: pbData=0x27829e0*, pdwDataLen=0x99f054*=0x370) returned 1
	[0191.588] CryptEncrypt (in: hKey=0x82afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2782d5c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x2782d5c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.588] CryptDestroyKey (hKey=0x82afc0) returned 1
	[0191.588] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.588] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.588] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.589] GetFileType (hFile=0x318) returned 0x1
	[0191.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.590] GetFileType (hFile=0x318) returned 0x1
	[0191.590] WriteFile (in: hFile=0x318, lpBuffer=0x2782fd8*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2782fd8*, lpNumberOfBytesWritten=0x99f014*=0x370, lpOverlapped=0x0) returned 1
	[0191.590] CloseHandle (hObject=0x318) returned 1
	[0191.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa7
	[0191.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xd6
	[0191.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.591] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac87a88d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1
	[0191.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.591] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.592] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.592] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278463c | out: lpFileInformation=0x278463c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d4)) returned 1
	[0191.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.593] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.593] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.593] GetFileType (hFile=0x318) returned 0x1
	[0191.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.593] GetFileType (hFile=0x318) returned 0x1
	[0191.593] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1d4
	[0191.593] ReadFile (in: hFile=0x318, lpBuffer=0x2784cbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2784cbc*, lpNumberOfBytesRead=0x99f04c*=0x1d4, lpOverlapped=0x0) returned 1
	[0191.594] CloseHandle (hObject=0x318) returned 1
	[0191.594] CryptDestroyKey (hKey=0x82b200) returned 1
	[0191.594] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.594] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2785d58, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b000) returned 1
	[0191.594] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.594] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.594] CryptDuplicateKey (in: hKey=0x82b000, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b540) returned 1
	[0191.594] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.594] CryptSetKeyParam (hKey=0x82b540, dwParam=0x4, pbData=0x2785e10*=0x1, dwFlags=0x0) returned 1
	[0191.594] CryptSetKeyParam (hKey=0x82b540, dwParam=0x1, pbData=0x2785ddc, dwFlags=0x0) returned 1
	[0191.594] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2785e20*, pdwDataLen=0x99f054*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x2785e20*, pdwDataLen=0x99f054*=0x1e0) returned 1
	[0191.595] CryptEncrypt (in: hKey=0x82b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x278600c*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x278600c*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.595] CryptDestroyKey (hKey=0x82b540) returned 1
	[0191.595] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.595] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.595] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.595] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.596] GetFileType (hFile=0x318) returned 0x1
	[0191.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.596] GetFileType (hFile=0x318) returned 0x1
	[0191.596] WriteFile (in: hFile=0x318, lpBuffer=0x2786268*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x2786268*, lpNumberOfBytesWritten=0x99f014*=0x1e0, lpOverlapped=0x0) returned 1
	[0191.597] CloseHandle (hObject=0x318) returned 1
	[0191.597] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpFilePart=0x0) returned 0x9e
	[0191.597] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xcd
	[0191.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.597] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac87a88d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1
	[0191.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.597] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.599] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.599] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x2787880 | out: lpFileInformation=0x2787880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6)) returned 1
	[0191.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1
	[0191.599] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x99ea60, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99efa4) returned 1
	[0191.599] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.599] GetFileType (hFile=0x318) returned 0x1
	[0191.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99efa0) returned 1
	[0191.599] GetFileType (hFile=0x318) returned 0x1
	[0191.599] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x99f0a0 | out: lpFileSizeHigh=0x99f0a0*=0x0) returned 0x1c6
	[0191.599] ReadFile (in: hFile=0x318, lpBuffer=0x2787e74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99f04c, lpOverlapped=0x0 | out: lpBuffer=0x2787e74*, lpNumberOfBytesRead=0x99f04c*=0x1c6, lpOverlapped=0x0) returned 1
	[0191.600] CloseHandle (hObject=0x318) returned 1
	[0191.600] CryptDestroyKey (hKey=0x82b000) returned 1
	[0191.600] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.600] CryptImportKey (in: hProv=0x7f93c0, pbData=0x2788f10, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x99eff8 | out: phKey=0x99eff8*=0x82b5c0) returned 1
	[0191.601] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.601] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.601] CryptDuplicateKey (in: hKey=0x82b5c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x99efe8 | out: phKey=0x99efe8*=0x82b480) returned 1
	[0191.601] CryptContextAddRef (hProv=0x7f93c0, pdwReserved=0x0, dwFlags=0x0) returned 1
	[0191.601] CryptSetKeyParam (hKey=0x82b480, dwParam=0x4, pbData=0x2788fc8*=0x1, dwFlags=0x0) returned 1
	[0191.601] CryptSetKeyParam (hKey=0x82b480, dwParam=0x1, pbData=0x2788f94, dwFlags=0x0) returned 1
	[0191.601] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2788fd8*, pdwDataLen=0x99f054*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x2788fd8*, pdwDataLen=0x99f054*=0x1d0) returned 1
	[0191.601] CryptEncrypt (in: hKey=0x82b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27891b4*, pdwDataLen=0x99f05c*=0x0, dwBufLen=0x10 | out: pbData=0x27891b4*, pdwDataLen=0x99f05c*=0x10) returned 1
	[0191.601] CryptDestroyKey (hKey=0x82b480) returned 1
	[0191.601] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.601] CryptReleaseContext (hProv=0x7f93c0, dwFlags=0x0) returned 1
	[0191.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x99ea4c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef90) returned 1
	[0191.601] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318
	[0191.602] GetFileType (hFile=0x318) returned 0x1
	[0191.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef8c) returned 1
	[0191.602] GetFileType (hFile=0x318) returned 0x1
	[0191.602] WriteFile (in: hFile=0x318, lpBuffer=0x27893d0*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x99f014, lpOverlapped=0x0 | out: lpBuffer=0x27893d0*, lpNumberOfBytesWritten=0x99f014*=0x1d0, lpOverlapped=0x0) returned 1
	[0191.603] CloseHandle (hObject=0x318) returned 1
	[0191.603] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpFilePart=0x0) returned 0x8f
	[0191.603] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", nBufferLength=0x105, lpBuffer=0x99eb70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta", lpFilePart=0x0) returned 0xbe
	[0191.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99f024) returned 1
	[0191.603] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml"), fInfoLevelId=0x0, lpFileInformation=0x99f0a0 | out: lpFileInformation=0x99f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0xac87a88d, ftLastWriteTime.dwHighDateTime=0x1d51a17, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
	[0191.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99f020) returned 1
	[0191.604] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml id 7162402[Foxdecrypt@protonmail.com].vendetta" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml id 7162402[foxdecrypt@protonmail.com].vendetta")) returned 1
	[0191.628] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", nBufferLength=0x105, lpBuffer=0x99ea40, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", lpFilePart=0x0) returned 0xa8
	[0191.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ef40) returned 1
	[0191.628] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml"), fInfoLevelId=0x0, lpFileInformation=0x278a974 | out: lpFileInformation=0x278a974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x36a)) returned 1
	[0191.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ef3c) returned 1

Thread:
	id = 26
	os_tid = 0xdcc

	[0164.468] SleepEx (dwMilliseconds=0x1, bAlertable=0) returned 0x0

Thread:
	id = 27
	os_tid = 0x490


Thread:
	id = 28
	os_tid = 0xb6c


Thread:
	id = 29
	os_tid = 0xf48